--- title: "First Schedule: Consent Managers: conditions of registration and obligations" url: https://dpdp.myndsolution.com/wiki/rules/schedule-1-conditions-for-registration-of-consent-manager-obligations/ description: "First Schedule to the DPDP Rules, 2025 (Conditions for registration of Consent Manager; Obligations of Consent Manager), [See rule 4]. Official text…" kind: rules-schedule updated: 2026-09-09 official_source: https://egazette.gov.in/WriteReadData/2025/267650.pdf text_type: official-text-plus-interpretation publisher: MYND Integrated Solutions license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions. disclaimer: Not legal advice. Official text prevails over any interpretation. html_version: https://dpdp.myndsolution.com/wiki/rules/schedule-1-conditions-for-registration-of-consent-manager-obligations/ --- # First Schedule: Consent Managers: conditions of registration and obligations *[See rule 4]* ## Official text ### PART A The applicant is a company incorporated in India. The applicant has sufficient capacity, including technical, operational and financial capacity, to fulfil its obligations as a Consent Manager. The financial condition and the general character of management of the applicant are sound. The net worth of the applicant is not less than two crore rupees. The volume of business likely to be available to and the capital structure and earning prospects of the applicant are adequate. The directors, key managerial personnel and senior management of the applicant company are individuals with a general reputation and record of fairness and integrity. The memorandum of association and articles of association of the applicant company contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered to, that policies and procedures are in place to ensure such adherence, and that such provisions may be amended only with the previous approval of the Board. The operations proposed to be undertaken by the applicant are in the interests of Data Principals. It is independently certified that— - **(a)** the interoperable platform of the applicant to enable the Data Principal to give, manage, review and withdraw her consent is consistent with such data protection standards and assurance framework as may be published by the Board on its website from time to time; and - **(b)** appropriate technical and organisational measures are in place to ensure adherence to such standards and framework and effective observance of the obligations under item 11 of Part B. ### PART B The Consent Manager shall enable a Data Principal using its platform to give consent to the processing of her personal data by a Data Fiduciary onboarded onto such platform either directly to such Data Fiduciary or through another Data Fiduciary onboarded onto such platform, who maintains such personal data with the consent of that Data Principal. > **Illustration.** Individuals are enabled to give, manage, review and withdraw their consent to the processing of their personal data through P, a platform maintained by a Consent Manager. X, an individual, is a registered user on P. B1 and B2 are banks onboarded onto P. Case 1:B1 sends a request on P to X for consent to process personal data contained in her bank account statement. X maintains the bank account statement as a digital record in her digital locker. X uses P to directly give her consent to B1, and proceeds to give B1 access to her bank account statement. Case 2:B1 sends a request on P to X for consent to process personal data contained in her bank account statement. X maintains her bank account with B2. X uses P to route her consent through B2 to B1, while also digitally instructing B2 to send her bank account statement to B1. B2 proceeds to send the bank account statement to B1. The Consent Manager shall ensure that the manner of making available the personal data or its sharing is such that the contents thereof are not readable by it. The Consent Manager shall maintain on its platform a record of the following, namely:— - **(a)** Consents given, denied or withdrawn by her; - **(b)** Notices preceding or accompanying requests for consent; and - **(c)** Sharing of her personal data with a transferee Data Fiduciary. The Consent Manager: — - **(a)** shall give the Data Principal using such platform access to such record; - **(b)** shall, on the request of the Data Principal and in accordance with its terms of service, make available to her the information contained in such record, in machine-readable form; and - **(c)** shall maintain such record for at least seven years, or for such longer period as the Data Principal and Consent Manager may agree upon or as may be required by law. The Consent Manager shall develop and maintain a website or app, or both, as the primary means through which a Data Principal may access the services provided by the Consent Manager. The Consent Manager shall not sub-contract or assign the performance of any of its obligations under the Act and these rules. The Consent Manager shall take reasonable security safeguards to prevent personal data breach. The Consent Manager shall act in a fiduciary capacity in relation to the Data Principal. The Consent Manager shall avoid conflict of interest with Data Fiduciaries, including in respect of their promoters and key managerial personnel. The Consent Manager shall have in place measures to ensure that no conflict of interest arises on account of its directors, key managerial personnel and senior management holding a directorship, financial interest, employment or beneficial ownership in Data Fiduciaries, or having a material pecuniary relationship with them. The Consent Manager shall publish in an easily accessible manner, on its website or app, or both, as the case may be, information regarding: — - **(a)** the promoters, directors, key managerial personnel and senior management of the company registered as Consent Manager; - **(b)** every person who holds shares in excess of two per cent. of the shareholding of the company registered as Consent Manager; - **(c)** everybody corporate in whose shareholding any promoter, director, key managerial personnel or senior management of the Consent Manager holds shares in excess of two per cent. as on the first day of the preceding calendar month; and - **(d)** such other information as the Board may direct the Consent Manager to disclose in the interests of transparency. The Consent Manager shall have in place effective audit mechanisms to review, monitor, evaluate and report the outcome of such audit to the Board, periodically and on such other occasions as the Board may direct, in respect of— - **(a)** technical and organisational controls, systems, procedures and safeguards; - **(b)** continued fulfilment of the conditions of registration; and - **(c)** adherence to its obligations under the Act and these rules. The control of the company registered as the Consent Manager shall not be transferred by way of sale, merger or otherwise, except with the previous approval of the Board and subject to fulfilment of such conditions as the Board may specify in this behalf. In this Schedule, — - **(a)** the expression “body corporate” shall include a company, a body corporate as defined under clause (11) of section 2 of the Companies Act, 2013 (18 of 2013), a firm, a financial institution, a scheduled bank or a public sector enterprise established or constituted by or under any Central Act, Provincial Act or State Act, and any other incorporated association of persons or body of individuals; - **(b)** the expressions “company”, “control”, “director” and “key managerial personnel” shall have the same meanings as are respectively assigned to them in the Companies Act, 2013 (18 of 2013); - **(c)** the expression “net worth” shall mean the aggregate value of total assets as reduced by the value of liabilities of the Consent Manager as appearing in its books of accounts; and - **(d)** the expressions “promoter” and “senior management” shall have the same meanings as are respectively assigned to them in the Companies Act, 2013 (18 or 2013). ## Interpretation in plain English (not legal advice) > This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation. Schedule I sets the rules for a Consent Manager, an entity that helps a Data Principal (the individual to whom the data relates) manage their consent. To register, the applicant must be a company incorporated in India with a net worth of at least two crore rupees. It must have sound finances, capable management, and an independently certified platform that meets standards published by the Board (the regulatory authority). Its founding documents must strictly prevent conflicts of interest and can only be amended with the Board's approval. Once registered, the Consent Manager must allow the Data Principal to give, manage, review, and withdraw consent to a Data Fiduciary (the entity determining how data is processed). The Consent Manager must ensure it cannot read the personal data being shared. It must maintain a record of all consents, notices, and data sharing, keeping these records for at least seven years. The Data Principal must have access to these records through a website or app, including a machine-readable copy upon request. The Consent Manager acts in a fiduciary capacity for the Data Principal and must avoid any conflicts of interest with Data Fiduciaries. It cannot sub-contract its legal obligations. It must publish details about its management and major shareholders (holding more than two percent) on its platform. Finally, it must conduct regular audits, maintain security safeguards, and cannot transfer control of the company without prior approval from the Board. ### Key points - An applicant must be an Indian company with a net worth of at least two crore rupees to register as a Consent Manager (Part A, 1 and 4). - The Consent Manager must ensure that the personal data being shared through its platform is not readable by it (Part B, 2). - It must keep records of consents, notices, and data sharing for at least seven years and give the Data Principal access to them (Part B, 3 and 4). - The Consent Manager cannot sub-contract or assign its obligations under the Act and rules (Part B, 6). - It must publish information about its management and anyone holding more than two percent of its shares (Part B, 11). - Control of the Consent Manager cannot be transferred through sale or merger without prior approval from the Board (Part B, 13). ### Common misreadings - Assuming a Consent Manager can view the personal data passing through its platform to verify it; the rules explicitly state the Consent Manager must ensure the contents of the personal data are not readable by it. - Assuming a Consent Manager can outsource its consent tracking functions to a third-party tech vendor; the rules state it shall not sub-contract or assign the performance of any of its obligations. *Interpretation prepared 2026-09-09 from the official text only; the official text prevails.*