First Schedule
Consent Manager: registration conditions and obligations
Part A sets the bar to register as a Consent Manager. Part B sets the thirteen obligations that continue once registered.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- Part A
- Conditions for registration: the applicant must be a company incorporated in India, have a net worth of at least Rs 2 crore, be of sound character and credit-worthiness, and have its interoperable platform independently certified.
- Part B
- Thirteen continuing obligations, including that personal data must not be readable by the Consent Manager itself, that a record of consents given, denied and withdrawn must be maintained and retained for at least seven years, that the function must not be sub-contracted, that the Consent Manager acts in a fiduciary capacity and avoids conflicts of interest, and that it makes transparency disclosures and maintains audit mechanisms.
In practice
The seven-year record obligation in Part B sits with the Consent Manager, and it is not the same as the Data Fiduciary’s own evidential burden under s.6(10). The Act is silent on what happens to those consent artefacts if a registration is suspended or cancelled under Rule 4, which is a contingency worth writing into a contract rather than assuming.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
First Schedule is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.