First Schedule explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Part A of the First Schedule lists nine conditions an applicant must fulfil before the Board can register it as a Consent Manager. They cover the company form, capacity, financial soundness, a net worth of not less than two crore rupees, the integrity of its people, the contents of its charter documents, the interests of Data Principals, and an independent certification.
The First Schedule follows rule 4, which under rule 1(3) comes into force one year after the date of publication of the Gazette. An applicant must be a company incorporated in India, have sufficient technical, operational and financial capacity, and have net worth of not less than two crore rupees as the Note defines it. Its charter must lock in the conflict-of-interest obligations, and its platform must be independently certified. The Board decides under rule 4(2).
Where Part A sits
Rule 4(1) lets a person "who fulfils the conditions for registration of Consent Managers set out in Part A of First Schedule" apply to the Board. Rule 4(2) lets the Board inquire into those conditions. The procedure is in our article on rule 4. The Consent Manager itself is a creature of section 6 of the Act; see Section 6 of the DPDP Act: the Consent Manager. Commencement is staged; the First Schedule has no commencement line of its own and follows rule 4. Counting from the Gazette date of 13 November 2025, one year ends in mid-November 2026; confirm the exact date of publication before relying on a date.
Those who want to test a company against these nine conditions before applying often need a document-level review, which is what legal due diligence is for.
The nine conditions
| Item | Condition | What it asks for |
|---|---|---|
| 1 | Company incorporated in India | The applicant is a company; "company" has the Companies Act, 2013 meaning under the Note |
| 2 | Sufficient capacity | Technical, operational and financial capacity to fulfil Consent Manager obligations |
| 3 | Sound finances and management | Financial condition and general character of management are sound |
| 4 | Net worth | Not less than two crore rupees |
| 5 | Business prospects | Volume of business likely to be available, capital structure and earning prospects are adequate |
| 6 | Integrity of people | Directors, key managerial personnel and senior management have a general reputation and record of fairness and integrity |
| 7 | Charter documents | Memorandum and articles require adherence to Part B items 9 and 10, with policies and procedures, and amendable only with the Board's previous approval |
| 8 | Interests of Data Principals | The proposed operations are in the interests of Data Principals |
| 9 | Independent certification | Platform and measures independently certified (two limbs) |
Items 1 to 3: form, capacity, soundness
Item 1 is short: "The applicant is a company incorporated in India." A partnership, an LLP or a sole proprietor is not a company in the sense of the Note, which gives "company" the meaning in the Companies Act, 2013. The Schedule describes nothing from inside that Act. For readers new to the term, our article on key definitions under the Companies Act gives context.
Item 2 asks for "sufficient capacity, including technical, operational and financial capacity". Item 3 adds that "the financial condition and the general character of management of the applicant are sound". The Schedule does not say how the Board measures either; it leaves that to the Board's inquiry under rule 4(2).
Item 4: net worth of not less than two crore rupees
"The net worth of the applicant is not less than two crore rupees." The Note's clause (c) gives a meaning for this Schedule: "the expression 'net worth' shall mean the aggregate value of total assets as reduced by the value of liabilities of the Consent Manager as appearing in its books of accounts". So the test is books of accounts: total assets minus liabilities. This is the Schedule's own meaning; do not import another from the Companies Act. For the Companies Act's separate term, the site has an article on net worth and turnover under that Act, which is context only.
Example: Rohit Digital Consent Private Limited shows total assets of Rs 3.1 crore and liabilities of Rs 1.4 crore in its books. Net worth under the Note is Rs 1.7 crore, less than two crore rupees, so item 4 is not met. (The figures are invented.)
Items 5 and 6: prospects and integrity
Item 5 requires that "the volume of business likely to be available to and the capital structure and earning prospects of the applicant are adequate". Item 6 looks at "directors, key managerial personnel and senior management", who must be "individuals with a general reputation and record of fairness and integrity". "Director" and "key managerial personnel" carry the Companies Act, 2013 meaning under Note (b), and "senior management" and "promoter" under Note (d). Context on those roles is in our post on people and roles under the Companies Act and on key managerial personnel.
Item 7: the charter documents
The memorandum and articles of association "contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered to, that policies and procedures are in place to ensure such adherence, and that such provisions may be amended only with the previous approval of the Board". Items 9 and 10 of Part B are the conflict-of-interest items; see Part B items 8 to 13. This is a charter test, so a company that wants to qualify may need to amend its documents before it applies.
Item 8: interests of Data Principals
"The operations proposed to be undertaken by the applicant are in the interests of Data Principals." The Schedule gives no tests for this; it is for the Board to be satisfied.
Item 9: independent certification
Item 9 says "It is independently certified that" two things:
- (a) the "interoperable platform of the applicant to enable the Data Principal to give, manage, review and withdraw her consent is consistent with such data protection standards and assurance framework as may be published by the Board on its website from time to time"; and
- (b) "appropriate technical and organisational measures are in place to ensure adherence to such standards and framework and effective observance of the obligations under item 11 of Part B".
The standards and assurance framework are for the Board to publish on its website and are not in the Rules, so they are not described here. Who may certify is not stated in the Schedule; it says only "independently certified". Note on the text: item 9(b) refers to "item 11 of Part B", which in the printed Schedule is the item on publishing information about promoters, directors and shareholders; item 7 of Part B is the item on security safeguards. The cross-reference is quoted as printed and the Schedule does not explain it.
Printing slip in the Note
Note (d) ends "(18 or 2013)" where "(18 of 2013)" is evidently meant for the Companies Act, 2013. It is quoted as printed.
Need help with Consent Manager eligibility?
An applicant's books, charter documents and management profile all feed into Part A. We can review them item by item before you approach the Board. Ask about our due diligence service and bring the latest balance sheet and constitutional documents.
Key takeaways
- Part A has nine items and follows rule 4, which starts one year after the date of publication of the Gazette.
- The applicant must be a company incorporated in India.
- Net worth must be not less than two crore rupees, measured as total assets minus liabilities as in its books of accounts (Note (c)).
- The memorandum and articles must carry the Part B items 9 and 10 obligations and can be amended only with the Board's previous approval.
- Independent certification covers the platform against the Board's published standards and the technical and organisational measures.
- Later amendments and notifications should be checked.
Read next
- Rule 4: registration of a Consent Manager and powers of the Board
- First Schedule Part B: platform, records and security obligations
- First Schedule Part B: fiduciary duty, conflict of interest and audit
- Section 6 of the DPDP Act: the Consent Manager
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.