Rule 4 — DPDP Rules, 2025
(1) A person who intends to act as a Consent Manager shall— (a) have a net worth of not less than twelve crore rupees; (b) be a company incorporated under the Companies Act, 2013; (c) apply to the Board for registration in Form I, along with a fee as specified. (2) A Consent Manager shall— (a) act on behalf of the Data Principal and in accordance with her instructions; (b) be accountable to the Data Principal in such manner as may be specified by the Board; (c) maintain interoperability with other Consent Managers; (d) not retain any log of the content of personal data processed by a Data Fiduciary; (e) publish the details of all Data Fiduciaries registered with it. (3) The registration of a Consent Manager shall be valid for such period and subject to such conditions as may be specified by the Board. (4) The Board may, after giving the Consent Manager an opportunity of being heard, cancel its registration on the grounds specified by it.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 4 is the most operationally significant rule in Phase 1. It establishes the Consent Manager as a new regulated category — not a self-certified role, but a Board-registered intermediary with a Rs 12 crore net worth floor. The Consent Manager acts on behalf of Data Principals (not Data Fiduciaries) and must maintain interoperability with other Consent Managers. Critically, a Consent Manager cannot store the content of personal data — it manages the consent signal and the consent record, not the data itself. truConsent is applying for registration when the Board opens the process (projected 13 November 2026).
A traditional Cookie Management Platform (CMP) captures a user's cookie consent on a specific website. A Consent Manager under Rule 4 is different: it operates across multiple Data Fiduciaries, allowing a Data Principal to manage all their consents from one place. The Data Principal can log into the Consent Manager's platform and see, adjust, or withdraw consent given to ten different Data Fiduciaries without visiting each one separately.
A Consent Manager cannot see or log the content of the personal data being processed by the Data Fiduciaries it is registered with. It manages the consent record — the fact that consent was given, for which purpose, at what time, and whether it has been withdrawn — but not the data itself. This is the architectural reason truConsent describes itself as 'data-blind'.
If a Data Principal has their consents managed by Consent Manager A, and later wants to switch to Consent Manager B, the existing consent records must be portable. Rule 4(2)(c) requires Consent Managers to maintain interoperability. The Board will specify the technical standards for this portability.