# DPDPA Consent Manager Quick Reference Card

**Print this 2-page card for fast reference during platform development and Board registration preparation.**

---

## 9 Registration Conditions (First Schedule, Part A)

| # | Condition | Pass/Fail Criteria | Evidence Required |
|---|-----------|-------------------|-------------------|
| **1** | Indian incorporation | Company incorporated under Companies Act, 2013 | Certificate of Incorporation |
| **2** | Technical/operational/financial capacity | Infrastructure, team, runway to operate at scale | Org chart + financials + architecture docs |
| **3** | Sound financial condition & management | Clean audit, stable financials, director integrity | Audited balance sheet + declarations |
| **4** | **Net worth ≥ ₹2 crore** | `Total Assets - Liabilities ≥ ₹2,00,00,000` | CA-certified net worth statement |
| **5** | Business viability | Revenue model, customer pipeline, sustainability | 3-year projections + cap table |
| **6** | Management integrity | Directors/KMP clean background | Police verification + CIBIL + sanctions search |
| **7** | **MoA/AoA conflict provisions** | Conflict-of-interest clauses **embedded** + Board approval lock-in | Amended MoA/AoA filed with RoC |
| **8** | Operations serve Data Principals | Business model prioritizes DP interests over DF interests | Narrative + fiduciary capacity policy |
| **9** | **Independent certification** | Interoperable platform independently certified as consistent with the Board's data protection standards and assurance framework | Auditor certificate |

**Blockers (Fail = Cannot Register):**
- Not incorporated in India (Item 1)
- Net worth < ₹2 crore (Item 4)
- MoA/AoA do not contain the Part B, Items 9-10 conflict-of-interest provisions with a Board-approval lock (Item 7)
- Cannot build platform in-house due to sub-contracting dependency (conflicts with Part B, Item 6)

---

## 13 Ongoing Obligations (First Schedule, Part B)

| # | Obligation | Technical Requirement | Penalty Risk |
|---|------------|----------------------|--------------|
| **1** | Enable multi-fiduciary consent | Multi-tenant platform; support direct + delegated consent | Section 27(1)(c) |
| **2** | **Zero-knowledge data handling** | Personal data **not readable** by CM — E2E encryption only | **₹50 crore max** |
| **3** | Comprehensive consent record-keeping | Log: (a) consents, (b) notices, (c) data shares | Section 27(1)(c) |
| **4a** | Data Principal platform access | Web UI or app for querying consent history | Section 27(1)(c) |
| **4b** | Machine-readable export | JSON/CSV export on DP request | Section 27(1)(c) |
| **4c** | **7-year retention minimum** | Immutable ledger; purge only after 7 years (unless extended) | **₹50 crore max** |
| **5** | Website or app as primary access | Public-facing platform for DPs | Section 27(1)(c) |
| **6** | **No sub-contracting** | Core CM functions operated by registered entity only | **₹50 crore max** |
| **7** | Reasonable security safeguards | Benchmark: Rule 6(1)(a)-(g) (encryption, access controls, logging, backups) | Section 27(1)(c) |
| **8** | **Fiduciary capacity** | Duty of care to Data Principal > commercial interests | **₹50 crore max** |
| **9-10** | Conflict of interest avoidance | Measures so no conflict arises from directors/KMP/senior management holding a directorship, financial interest, employment or beneficial ownership in DFs, or material pecuniary ties | Section 27(1)(c)-(d) |
| **11** | Transparency disclosures | Publish: promoters, directors, KMP, senior management, >2% shareholders, bodies corporate in which they hold >2% | Section 27(1)(c)-(d) |
| **12** | Effective audit mechanisms | Monitor controls, registration conditions, obligation adherence; report outcomes to the Board | Section 27(1)(c) |
| **13** | Board approval for control transfer | Sale, merger, or ownership change requires **prior Board approval** | **₹50 crore max** |

**Penalty Exposure:** Breach of any obligation = Schedule Item 7 → **up to ₹50 crore** (Section 33(1); inquiry on a Data Principal's complaint under Section 27(1)(c), or under Section 27(1)(d) for breach of a registration condition)

---

## Critical Technical Constraints

### Zero-Knowledge Architecture (Part B, Item 2)

**What the CM Records:**
```
✅ principal_id (pseudonymised)
✅ fiduciary_id
✅ purpose_id
✅ event_type (GRANT/DENY/WITHDRAW/SHARE)
✅ payload_hash (SHA-256)
✅ timestamp
```

**What the CM NEVER Sees:**
```
❌ Aadhaar number
❌ PAN
❌ Financial data
❌ Health records
❌ ANY personal data plaintext
```

**Implementation:**
```
Data Principal → E2E encrypt → Consent Manager (hash only) → Data Fiduciary → decrypt
                 ┌──────────────────────┘
                 └─ CM stores SHA-256(encrypted_payload), NOT the payload
```

**Validation Test:** Grep codebase for `decrypt(` on DP/DF data — should return ZERO matches in CM routing layer.

---

### 7-Year Immutable Ledger (Part B, Items 3, 4c)

**Database Design:**
```sql
CREATE TABLE consent_events (
    event_id UUID PRIMARY KEY,
    principal_id VARCHAR(255),
    fiduciary_id VARCHAR(255),
    event_type VARCHAR(50) CHECK (event_type IN ('CONSENT_GRANT', 'CONSENT_DENY', 'CONSENT_WITHDRAW', 'NOTICE_SERVED', 'DATA_SHARE')),
    purpose_id VARCHAR(255),
    payload_hash VARCHAR(64),  -- SHA-256
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Enforce immutability
CREATE TRIGGER enforce_immutability
    BEFORE UPDATE OR DELETE ON consent_events
    FOR EACH ROW EXECUTE FUNCTION prevent_consent_modification();
```

**Retention Policy:**
- **Minimum:** 7 years from event creation
- **Extension:** Longer if agreed with the Data Principal or required by law (Part B, Item 4(c))
- **Purge:** Automated monthly cron checks `created_at < NOW() - INTERVAL '7 years'` AND `retention_extended = FALSE`

---

### No Sub-Contracting (Part B, Item 6)

**You CANNOT Outsource:**
- ❌ Consent routing logic
- ❌ Data Principal support
- ❌ Grievance redressal
- ❌ Consent record custody

**You CAN Use (Not Sub-Contracting):**
- ✅ Cloud IaaS (AWS EC2, Azure VMs) — you operate the software
- ✅ Managed databases (RDS, Azure SQL) — data remains under your control
- ✅ Email/SMS vendors (SendGrid, Twilio) — transactional only, no decision logic
- ✅ Security tools (SIEM, WAF) — you operate and monitor

**Test:** If third party makes decisions or has custodial access to consent metadata, it's prohibited sub-contracting.

---

## Interoperability Requirements

### API Standards (Part A, Item 9)

**Required:**
- **OpenAPI 3.1** specification for all endpoints
- **OAuth 2.0** for Data Fiduciary authentication
- **TLS 1.3** minimum (cipher: `TLS_AES_256_GCM_SHA384`)
- **Webhook notifications** for real-time consent status

**Core Endpoints:**
```
POST   /fiduciaries          # Onboard Data Fiduciary
POST   /consent/grant        # Route consent grant (metadata only)
POST   /consent/withdraw     # Route withdrawal
POST   /data-share           # Route encrypted data (hash only)
GET    /export/{principal}   # Machine-readable export (Part B, Item 4b)
POST   /grievances           # Section 13 intake
```

**Machine-Readable Export Format (JSON):**
```json
{
  "format": "application/json",
  "schema_version": "1.0",
  "data_principal": {"identifier": "pseudonymised_id"},
  "records": [
    {
      "type": "CONSENT_GRANT",
      "fiduciary_id": "fiduciary_abc",
      "purpose": "Marketing communications",
      "timestamp": "2026-01-15T10:30:00Z",
      "notice_reference": "notice_hash_xyz"
    }
  ],
  "retention": {"minimum_years": 7, "policy": "immutable_append_only"}
}
```

---

## Grievance Redressal (Rule 14(3))

**Timeline:** Section 13(1) requires readily available grievance redressal from registration. Rule 14(3) (from 13 May 2027) requires you to publish your response period, **not exceeding 90 days**.

**Requirements:**
- ✅ Publicly accessible intake (web form + API endpoint)
- ✅ Auto-acknowledgement within 24 hours
- ✅ Status tracking: `SUBMITTED → IN_REVIEW → RESOLVED → CLOSED`
- ✅ SLA: Response within your published period, not exceeding 90 days (Rule 14(3))
- ✅ Audit trail: 7-year retention of all grievances

**Penalty Risk:** No grievance mechanism = breach of Section 13(1); missing the response period = breach of Section 13(2) read with Rule 14(3) → Schedule Item 7 → ₹50 crore max.

---

## Common Pitfalls

| Pitfall | Why It's a Problem | How to Avoid |
|---------|-------------------|--------------|
| **Logging decrypted personal data** | Violates Part B, Item 2 (zero-knowledge) | Log `payload_hash` only; never log plaintext PII |
| **Using third-party consent SaaS** | Violates Part B, Item 6 (no sub-contracting) | Build platform in-house; use IaaS only |
| **Directors with DF shareholdings** | Violates Part B, Items 9-10 (conflict of interest) | Background checks; MoA/AoA lock-in |
| **Updating consent records** | Undermines Part B, Items 3 and 4c (record-keeping, retention) | Trigger prevents UPDATE/DELETE; append-only ledger |
| **Deleting records <7 years** | Violates Part B, Item 4c (retention) | Automated purge checks `created_at` + 7 years |
| **Missing grievance system** | Violates Section 13(1) and Rule 14(3) (response within ≤ 90 days) | Deploy in Phase 4; test before registration |
| **Control transfer without Board approval** | Violates Part B, Item 13 | Obtain Board approval **before** M&A execution |

---

## Decision Tree: Should You Register?

```
START: Are you a single Data Fiduciary managing your own consent only?
  ├─ YES → Do NOT register. Implement Section 6 directly. STOP.
  └─ NO → Continue

Do you operate a multi-tenant consent platform serving other Data Fiduciaries?
  ├─ YES → Continue
  └─ NO → Do NOT register. Registration is for platform operators, not software vendors. STOP.

Can you incorporate in India with ₹2 crore net worth?
  ├─ YES → Continue
  └─ NO → BLOCKER. Resolve before proceeding. STOP.

Can you build the platform in-house without sub-contracting core logic?
  ├─ YES → Continue
  └─ NO → BLOCKER. Part B, Item 6 prohibits sub-contracting. STOP.

Do any directors/KMP/senior management hold a directorship, financial interest, employment or beneficial ownership in Data Fiduciaries, or have material pecuniary ties with them?
  ├─ YES → BLOCKER until conflict-of-interest measures are in place (Part B, Items 9-10). STOP.
  └─ NO → Continue

Can you implement zero-knowledge architecture (E2E encryption, no payload access)?
  ├─ YES → Continue
  └─ NO → BLOCKER. Part B, Item 2 is mandatory. STOP.

Is your transaction volume high enough to justify registration overhead?
  ├─ YES (>10,000 consent events/month) → PROCEED with registration.
  └─ NO (<10,000/month) → Consider software licensing model instead. Registration may not be economical.
```

---

## Critical Timelines

| Event | Timeline | Source |
|-------|----------|--------|
| **Rule 4 and Section 6(9) in force** | **13 November 2026** | Rule 1(3) |
| **Grievance response period** | Published period, **not exceeding 90 days** (from 13 May 2027) | Rule 14(3) |
| **Consent record retention** | **7 years minimum** | Part B, Item 4(c) |
| **Breach intimation** (where the CM is a Data Fiduciary for its users' own data) | Initial intimation **without delay** to affected Data Principals and the Board; detailed Board report **within 72 hours** of becoming aware, extendable on written request | Section 8(6) + Rule 7(1), 7(2)(a), 7(2)(b) (from 13 May 2027) |
| **Board approval for M&A** | **Before** control transfer | Part B, Item 13 |
| **Independent certification renewal** | **Annually** (recommended) | Part A, Item 9 |

---

## Penalty Exposure

| Violation | Penalty | Section |
|-----------|---------|---------|
| Breach of any Consent Manager obligation | **Up to ₹50 crore** | Schedule Item 7 |
| Data Fiduciary's failure to take security safeguards (S.8(5)), for the CM's own users' account data (it is the Data Fiduciary for that data) | **Up to ₹250 crore** | Schedule Item 1 |
| Non-compliance with Board directions (S.27(2); Rule 4(4)-(5)) | **Up to ₹50 crore** | Schedule Item 7 |

**Enforcement:** Data Protection Board has authority to:
- Inquire on Data Principal complaints (Section 27(1)(c))
- Inquire on breach of registration conditions (Section 27(1)(d))
- Direct measures to ensure adherence (Rule 4(4))
- Suspend or cancel registration, after a hearing (Rule 4(5))

---

## Audit Mechanisms (Part B, Item 12)

**Required Monitoring:**
- **(a)** Technical and organisational controls effectiveness
- **(b)** Continued fulfilment of 9 registration conditions
- **(c)** Adherence to 13 ongoing obligations

**Implementation:**
- **Daily:** TLS 1.3 enforcement check, zero-knowledge validation (no decrypt logs)
- **Weekly:** API error rate analysis, webhook delivery success rate
- **Monthly:** Retention policy execution, net worth verification
- **Quarterly:** Internal compliance audit (self-assessment)
- **Annually:** Independent audit for re-certification

**Deliverable:** Compliance dashboard (Grafana/Datadog) with Part B, Item 12 metrics.

---

## Resources & Links

**This Package:**
- [Implementation Checklist](./implementation-checklist.md) — 16-week phased plan
- [README](./README.md) — Resource overview and quick start paths
- [API Specification](./api-spec/consent-manager-api.yaml) — OpenAPI 3.1 spec
- [Database Schema](./database/consent-ledger-schema.sql) — Immutable consent ledger
- [Architecture Diagrams](./architecture/) — Zero-knowledge flow, multi-tenant routing

**Related DPDPA Resources:**
- [DPDPA-ISO 27001 Mapping](../dpdpa-iso-27001-mapping/) — Security controls for Part B, Item 7
- [Encryption Requirements](../dpdpa-encryption-requirements/) — TLS 1.3 configs, database encryption
- [Breach Notification](../dpdpa-breach-notification/) — Section 8(6) incident response

**Legal Sources:**
- **DPDPA 2023:** Sections 2(g), 6(7)-(9), 13, 27(1)(c)-(d), 33 and the Schedule
- **DPDP Rules 2025:** Rule 4, Rule 14(3), First Schedule (Parts A & B)

---

**Print Instructions:** Print pages 1-2 double-sided. Laminate for desk reference durability.

---

**StateCheck Security | DPDPA Compliance Resources**
[https://statechecksecurity.com/consent-manager-audit](https://statechecksecurity.com/consent-manager-audit)