First Schedule explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Items 1 to 7 of Part B of the First Schedule say what a registered Consent Manager must do day to day. It must let a Data Principal give consent through its platform, keep the content of her data unreadable to itself, keep a record of consents, notices and sharing for at least seven years, run a website or app, never sub-contract its obligations and take reasonable security safeguards.
These obligations apply through rule 4(3), which comes into force one year after the date of publication of the Gazette (rule 1(3)). The platform must let consent flow directly or through another Data Fiduciary; the Consent Manager must make sure it cannot read the contents, keep a record for at least seven years (or longer as agreed or required by law), maintain a website or app, not sub-contract or assign its obligations, and take reasonable security safeguards. Items 8 to 13 are covered in the sibling article.
Where Part B sits
Rule 4(3) says "The Consent Manager shall have obligations as specified in Part B of First Schedule". Registration and the Board's powers are in our article on rule 4, and the entry conditions are in Part A. The role comes from section 6 of the Act; see Section 6 of the DPDP Act: the Consent Manager. Counting from the Gazette date of 13 November 2025, one year ends in mid-November 2026; confirm the exact date of publication before relying on a date. If you are planning a platform of this kind, a legal consultation at design stage is cheaper than a redesign.
Item 1: consent through the platform
"The Consent Manager shall enable a Data Principal using its platform to give consent to the processing of her personal data by a Data Fiduciary onboarded onto such platform either directly to such Data Fiduciary or through another Data Fiduciary onboarded onto such platform, who maintains such personal data with the consent of that Data Principal."
There are two routes. In the direct route the Data Principal gives consent to the requesting Data Fiduciary. In the indirect route she routes it through a second Data Fiduciary on the platform that already holds her data with her consent.
The Rules' own Illustration
The Schedule gives an Illustration. Individuals give, manage, review and withdraw consent through P, a platform of a Consent Manager. X is a registered user; B1 and B2 are banks onboarded onto P.
- Case 1: B1 asks X on P for consent to process personal data in her bank account statement. X keeps the statement as a digital record in her digital locker. She uses P to give consent directly to B1 and gives B1 access to the statement.
- Case 2: B1 asks X for the same consent. X's account is with B2. She uses P to route consent through B2 to B1 and digitally instructs B2 to send the statement to B1. B2 sends it.
Our own example, separate from the Illustration: Ananya uses an invented platform, ConsentBridge. A lender, LendKart, asks for her income details. Her payroll provider, already on the platform, holds them. She approves on ConsentBridge, and the payroll provider shares them with LendKart. The platform carries the consent and the instruction, and does not read the figures.
Item 2: contents not readable by the Consent Manager
"The Consent Manager shall ensure that the manner of making available the personal data or its sharing is such that the contents thereof are not readable by it." The obligation is about design. The platform may carry the data between Data Fiduciaries, but the way it does so must leave the contents unreadable to the Consent Manager itself. The Schedule does not name a technique, such as encryption, so the choice is the Consent Manager's, provided the result is that the contents are not readable by it.
Item 3: the record
The Consent Manager "shall maintain on its platform a record of the following":
| Clause | What is recorded |
|---|---|
| (a) | Consents given, denied or withdrawn by her |
| (b) | Notices preceding or accompanying requests for consent |
| (c) | Sharing of her personal data with a transferee Data Fiduciary |
Printing slip: in clause (a) "by her" has no person named before it in item 3. Items 1 and 4 show that the Data Principal is meant. It is quoted as printed.
Note that a "denied" consent is recorded as well as a given or withdrawn one. A platform that logs only grants is not following clause (a).
Item 4: access, machine-readable form and seven years
The Consent Manager:
- (a) "shall give the Data Principal using such platform access to such record";
- (b) "shall, on the request of the Data Principal and in accordance with its terms of service, make available to her the information contained in such record, in machine-readable form"; and
- (c) "shall maintain such record for at least seven years, or for such longer period as the Data Principal and Consent Manager may agree upon or as may be required by law".
So there are three duties: access to the record on the platform, a copy in machine-readable form when she asks (subject to the terms of service), and retention of at least seven years. The seven years is a minimum; it can be longer by agreement or because another law requires it. The Schedule does not say from which date the seven years run; it says only "for at least seven years".
Item 5: website or app
"The Consent Manager shall develop and maintain a website or app, or both, as the primary means through which a Data Principal may access the services provided by the Consent Manager." The website or app is the primary means. The Schedule does not forbid other channels.
Item 6: no sub-contracting
"The Consent Manager shall not sub-contract or assign the performance of any of its obligations under the Act and these rules." This is a flat prohibition. A Consent Manager cannot hand a Part B obligation, such as the record-keeping in item 3, to a vendor. The text of item 6 does not say whether using a cloud host for storage counts as sub-contracting the obligation; it is silent, so a business in that position should take advice.
Item 7: security safeguards
"The Consent Manager shall take reasonable security safeguards to prevent personal data breach." The item is one sentence. A Data Fiduciary's list of safeguards is in rule 6, covered in our article on reasonable security safeguards; the Schedule does not say that rule 6's list applies to the Consent Manager, and does not repeat it.
Need help designing a Consent Manager platform?
A consent platform lives or dies on records, architecture and contracts. If you are building one, speak to our legal team about the terms of service, the record-keeping design and the structure in which you will apply to the Board.
Key takeaways
- Part B items 1 to 7 apply through rule 4(3), which starts one year after the date of publication of the Gazette.
- Consent may be given directly to a Data Fiduciary or routed through another Data Fiduciary on the platform that holds the data.
- The contents of the data must not be readable by the Consent Manager.
- The record covers consents given, denied or withdrawn, notices, and sharing with a transferee Data Fiduciary, and must be kept for at least seven years.
- A website or app is the primary means of access.
- The Consent Manager may not sub-contract or assign any of its obligations.
- Check later amendments and notifications.
Read next
- First Schedule Part B items 8 to 13: fiduciary duty, conflict of interest and audit
- Rule 4: registration of a Consent Manager and powers of the Board
- Section 6 of the DPDP Act: the Consent Manager
- Data processing agreement template for DPDP compliance
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.