First Schedule explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Items 8 to 13 of Part B of the First Schedule make a Consent Manager a fiduciary of the Data Principal. They require it to avoid conflicts of interest, publish who owns and runs it, audit itself and report to the Board, and not change hands without the Board's previous approval.
These items apply through rule 4(3), in the group that comes into force one year after the date of publication of the Gazette (rule 1(3)). The Consent Manager must act in a fiduciary capacity towards the Data Principal, avoid conflict of interest with Data Fiduciaries and their promoters and key managerial personnel, publish its own people and every holder of shares in excess of two per cent., run audit mechanisms reporting to the Board, and obtain the Board's previous approval before control is transferred.
Where these items sit
Items 1 to 7 (platform, records and security) are in the sibling article on platform, records and security obligations. The rule that carries Part B is explained in rule 4, and the Consent Manager's place in the Act is in Section 6 of the DPDP Act: the Consent Manager. Counting from the Gazette date of 13 November 2025, one year ends in mid-November 2026; confirm the exact date of publication before relying on a date.
Part A item 7 requires a Consent Manager's memorandum and articles to carry items 9 and 10 of this Part. For a review of governance documents against these items, consider legal due diligence.
Item 8: fiduciary capacity
"The Consent Manager shall act in a fiduciary capacity in relation to the Data Principal." The item is one line. It does not list the duties of a fiduciary; it names the capacity. The Consent Manager's loyalty is to the Data Principal using its platform, not to the Data Fiduciaries that pay for or use it.
Item 9: avoid conflict of interest
"The Consent Manager shall avoid conflict of interest with Data Fiduciaries, including in respect of their promoters and key managerial personnel." Two things stand out. The duty is to avoid the conflict, not to disclose it after the fact. And it reaches through the Data Fiduciaries to their promoters and key managerial personnel.
Item 10: measures inside the company
The Consent Manager "shall have in place measures to ensure that no conflict of interest arises on account of its directors, key managerial personnel and senior management holding a directorship, financial interest, employment or beneficial ownership in Data Fiduciaries, or having a material pecuniary relationship with them".
So item 10 turns item 9 into a control. The conflicts it targets are:
- a directorship in a Data Fiduciary;
- a financial interest;
- employment;
- beneficial ownership; or
- a material pecuniary relationship,
each held or had by a director, key managerial personnel or senior management of the Consent Manager. The Schedule does not say what is "material"; the text is silent. "Director", "key managerial personnel", "promoter" and "senior management" take their meanings from the Companies Act, 2013 under Note (b) and (d). Context is in our post on people and roles under the Companies Act.
Example (invented): the Chief Financial Officer of consent platform ClearConsent holds a directorship in a lender, MoneyMart, that is onboarded on the platform. Item 10 expects ClearConsent to have a measure in place that prevents this from becoming a conflict, for example a rule that bars such directorships for senior management. Whether a particular measure is enough is for the Board to judge.
Item 11: public disclosure
The Consent Manager "shall publish in an easily accessible manner, on its website or app, or both, as the case may be, information regarding":
| Clause | Information to publish |
|---|---|
| (a) | The promoters, directors, key managerial personnel and senior management of the company registered as Consent Manager |
| (b) | Every person who holds shares in excess of two per cent. of the shareholding of the company registered as Consent Manager |
| (c) | Every body corporate in whose shareholding any promoter, director, key managerial personnel or senior management of the Consent Manager holds shares in excess of two per cent. as on the first day of the preceding calendar month |
| (d) | Such other information as the Board may direct the Consent Manager to disclose in the interests of transparency |
Clause (c) is the one most easily missed. It looks outwards: if a director of the Consent Manager holds more than two per cent. of the shares of another body corporate, that body corporate must be named. "Body corporate" is given an extended meaning in Note (a), covering a company, a firm, a financial institution, a scheduled bank, a public sector enterprise and other incorporated associations or bodies of individuals. The date mark is "the first day of the preceding calendar month", so the information is read as it stood on that day. Clause (d) refers to what the Board may direct in future; no direction is in the Rules.
Item 12: audit
The Consent Manager "shall have in place effective audit mechanisms to review, monitor, evaluate and report the outcome of such audit to the Board, periodically and on such other occasions as the Board may direct, in respect of" three things: (a) technical and organisational controls, systems, procedures and safeguards; (b) continued fulfilment of the conditions of registration; and (c) adherence to its obligations under the Act and the Rules.
The Schedule does not fix how often "periodically" is, and it does not say who audits; the text is silent on both. The Board may also direct an audit report on other occasions.
Item 13: control
"The control of the company registered as the Consent Manager shall not be transferred by way of sale, merger or otherwise, except with the previous approval of the Board and subject to fulfilment of such conditions as the Board may specify in this behalf." "Control" has the Companies Act, 2013 meaning under Note (b). Two features: the approval must be previous (before the transfer, not after) and the words "or otherwise" widen the item beyond sale and merger. The Board's conditions are not in the Rules.
Printing slip in the Note
Note (d) prints "(18 or 2013)" for the Companies Act, 2013. It is quoted as printed.
Enforcement
If a Consent Manager does not adhere to these obligations, rule 4(4) and 4(5) let the Board give a direction after a hearing, and suspend or cancel registration by a reasoned order. For a related duty to retain data for investigation, see the broader security rule in rule 6.
Need help with governance of a Consent Manager?
Fiduciary duty, disclosure and audit each depend on documents and policies that must exist before registration. For a structured check of those documents, ask about legal due diligence and share your shareholding and governance records.
Key takeaways
- Items 8 to 13 apply through rule 4(3), which starts one year after the date of publication of the Gazette.
- The Consent Manager acts in a fiduciary capacity in relation to the Data Principal.
- It must avoid conflict of interest with Data Fiduciaries, their promoters and key managerial personnel, and have measures for its own directors, key managerial personnel and senior management.
- It must publish its people and every holder of shares in excess of two per cent., and bodies corporate in which its people hold more than two per cent. as on the first day of the preceding calendar month.
- It must have audit mechanisms reporting to the Board periodically and when the Board directs.
- Control cannot be transferred without the Board's previous approval.
- Later amendments and notifications should be checked.
Read next
- First Schedule Part B items 1 to 7: platform, records and security
- First Schedule Part A: conditions for registration
- Section 6 of the DPDP Act: the Consent Manager
- Key managerial personnel under the Companies Act, 2013
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.