Rule 4: Registration and obligations of Consent Manager

This rule sets out how a person can become a registered Consent Manager. A Consent Manager is an entity that helps a Data Principal (the individual to whom the personal data relates) manage their consent. To apply, a person must meet the conditions listed in Part A of the First Schedule and submit the required information and documents to the Board.\n\nThe Board will review the application and make any necessary inquiries. If the Board is satisfied that the applicant meets the conditions, it will register the Consent Manager, notify them, and publish their details on its website. If the Board is not satisfied, it will reject the application and explain the reasons for the rejection. Once registered, the Consent Manager must follow the obligations listed in Part B of the First Schedule.\n\nThe Board actively monitors Consent Managers. If the Board believes a Consent Manager is failing to meet its conditions or obligations, it can direct the Consent Manager to take corrective measures after giving them a chance to be heard. The Board can also ask the Consent Manager to provide specific information at any time.\n\nIn more serious cases, the Board has the power to suspend or cancel a Consent Manager's registration to protect the interests of Data Principals. Before doing this, the Board must give the Consent Manager an opportunity to be heard and must record its reasons in writing. The Board can also issue specific directions to the Consent Manager to ensure Data Principals are protected.

Key points

• A person meeting the conditions in Part A of the First Schedule can apply to the Board to register as a Consent Manager. [(1)]
• The Board will register the applicant and publish their details if satisfied, or reject the application with reasons if not satisfied. [(2)]
• A registered Consent Manager must comply with the obligations set out in Part B of the First Schedule. [(3)]
• The Board can direct a Consent Manager to fix any non-adherence after giving them an opportunity to be heard. [(4)]
• The Board may suspend or cancel a registration and issue directions to protect Data Principals, provided it gives a hearing and records reasons in writing. [(5)]
• The Board can require a Consent Manager to furnish information at any time. [(6)]

Common misreadings

• A Consent Manager's registration cannot be cancelled without them first having an opportunity to be heard by the Board.
• The Board does not automatically approve applications; it may make inquiries to satisfy itself that the conditions are met before granting registration.