# MoA/AoA Amendment Template for DPDPA Consent Manager Registration

**Legal template for embedding conflict-of-interest provisions per First Schedule, Part A, Item 7**

---

## ⚠️ Legal Disclaimer

This is a **technical template** for engineering and compliance teams to understand the structural requirements for Consent Manager registration. It is **NOT a substitute for legal counsel**.

**Before using this template:**
- Engage a qualified Indian corporate law attorney licensed to practice before the Registrar of Companies (RoC)
- Adapt language to your company's existing MoA/AoA structure
- Obtain Board of Directors approval per Companies Act, 2013, Section 14
- File Form MGT-14 with RoC within 30 days of passing the resolution

**This template addresses:** First Schedule, Part A, Item 7 requirement that the MoA/AoA "contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered to, that policies and procedures are in place to ensure such adherence, and that such provisions may be amended only with the previous approval of the Board."

---

## Part 1: Memorandum of Association (MoA) Amendment

### Add to Main Objects Clause (Clause III)

**NEW SUB-CLAUSE [X]** (insert at end of existing Main Objects):

> **[X]. Consent Manager Operations under DPDPA 2023**
>
> To carry on the business of a Consent Manager as defined under Section 2(g) of the Digital Personal Data Protection Act, 2023, and to act as a single point of contact enabling Data Principals to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform, subject to registration with the Data Protection Board of India under Section 6(9) of the said Act and compliance with all obligations prescribed under the Digital Personal Data Protection Rules, 2025, First Schedule.

### Add to Ancillary/Incidental Powers Clause (Clause IV)

**NEW SUB-CLAUSE [Y]** (insert at end of existing Ancillary Powers):

> **[Y]. Conflict-of-Interest Governance (DPDPA Consent Manager)**
>
> In furtherance of the company's Consent Manager operations under Main Objects Clause III([X]), the company shall:
>
> (a) Have in place measures to ensure that no conflict of interest arises on account of any Director, Key Managerial Personnel, or Senior Management of the company holding a directorship, financial interest, employment, or beneficial ownership in any Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023, of any size, or having a material pecuniary relationship with one (First Schedule, Part B, Item 10);
>
> (b) Ensure that no Director, Key Managerial Personnel, or Senior Management has a material pecuniary relationship (whether direct or indirect) with any Data Fiduciary, except for arms-length commercial arrangements incidental to the Consent Manager's ordinary course of business and disclosed to the Board of Directors;
>
> (c) Maintain policies and procedures to identify, disclose, and manage conflicts of interest between the company's Consent Manager operations and the interests of Data Fiduciaries;
>
> (d) Act in a fiduciary capacity in relation to Data Principals, prioritizing the interests of Data Principals above the commercial interests of Data Fiduciaries or the company's own interests where a conflict arises;
>
> (e) **Lock-In Clause:** The provisions of this sub-clause [Y] may be amended only with the **previous written approval of the Data Protection Board of India**, and any amendment to this sub-clause effected without such approval shall be void ab initio.

**RESOLVED THAT** the Memorandum of Association be and is hereby amended by inserting the foregoing clauses as Main Objects Clause III([X]) and Ancillary Powers Clause IV([Y]), and that such amendments are in compliance with the Digital Personal Data Protection Rules, 2025, First Schedule, Part A, Item 7.

---

## Part 2: Articles of Association (AoA) Amendment

### NEW ARTICLE [Z]: Consent Manager Conflict-of-Interest Provisions

Insert the following as a new standalone article (numbering to follow your existing AoA structure):

> **ARTICLE [Z]: CONFLICT-OF-INTEREST GOVERNANCE FOR CONSENT MANAGER OPERATIONS**
>
> **[Z.1] Definitions**
>
> For the purposes of this Article:
> - "**Consent Manager**" has the meaning assigned to it under Section 2(g) of the Digital Personal Data Protection Act, 2023;
> - "**Data Principal**" has the meaning assigned to it under Section 2(j) of the Act;
> - "**Data Fiduciary**" has the meaning assigned to it under Section 2(i) of the Act;
> - "**Key Managerial Personnel**" has the meaning assigned to it under Section 2(51) of the Companies Act, 2013;
> - "**Senior Management**" means personnel of the company who are members of its core management team, excluding the Board of Directors, comprising all members of management one level below the executive directors, including all functional heads.
>
> **[Z.2] Prohibition on Directorship in Data Fiduciaries**
>
> No Director, Key Managerial Personnel, or Senior Management shall, during their tenure with the company, hold any directorship (whether executive, non-executive, or independent) in any Data Fiduciary, whether incorporated in India or abroad.
>
> **[Z.3] Prohibition on Financial Interest in Data Fiduciaries**
>
> No Director, Key Managerial Personnel, or Senior Management shall, during their tenure with the company, hold a directorship, financial interest (including shares or other securities of **any** amount), employment, or beneficial ownership in any Data Fiduciary that gives rise to a conflict of interest. Every such holding, whatever its size, shall be disclosed under Article [Z.5] and assessed by the Board of Directors for conflict before it is held or, if it predates appointment, on appointment.
>
> For the purposes of this provision, "holding" includes direct ownership, beneficial ownership, and ownership through relatives as defined under Section 2(77) of the Companies Act, 2013.
>
> **[Z.4] Prohibition on Employment and Pecuniary Relationships**
>
> No Director, Key Managerial Personnel, or Senior Management shall, during their tenure with the company:
>
> (a) Hold any employment, consultancy, or advisory position with any Data Fiduciary; or
>
> (b) Have a material pecuniary relationship with any Data Fiduciary, except for:
>   - Arms-length commercial arrangements entered into in the ordinary course of the company's Consent Manager business and disclosed to the Board; or
>   - Relationships approved in advance by a resolution of the Board of Directors, subject to disclosure to the Data Protection Board.
>
> **[Z.5] Disclosure Obligations**
>
> (a) Every Director, Key Managerial Personnel, and Senior Management shall, upon appointment and annually thereafter, submit a declaration to the Board of Directors disclosing:
>   - Any shareholding in Data Fiduciaries, of any size;
>   - Any directorship, employment, or consultancy with Data Fiduciaries;
>   - Any material pecuniary relationship with Data Fiduciaries;
>   - Any changes to the foregoing during the year.
>
> (b) The company shall maintain a register of such disclosures and make it available for inspection by the Data Protection Board upon request.
>
> **[Z.6] Fiduciary Capacity to Data Principals**
>
> The company, in its capacity as a Consent Manager, shall act as a fiduciary to Data Principals. In the event of any conflict between:
> - The interests of Data Principals; and
> - The commercial interests of the company, its promoters, Directors, or Data Fiduciaries;
>
> the company shall prioritize the interests of Data Principals and take all necessary steps to mitigate such conflicts.
>
> **[Z.7] Policies and Procedures**
>
> The Board of Directors shall adopt, implement, and periodically review policies and procedures to:
>
> (a) Identify potential conflicts of interest between the company's Consent Manager operations and Data Fiduciaries;
>
> (b) Ensure compliance with the conflict-of-interest prohibitions under Articles [Z.2], [Z.3], and [Z.4];
>
> (c) Manage situations where a conflict arises despite preventive measures;
>
> (d) Train Directors, Key Managerial Personnel, and Senior Management on their conflict-of-interest obligations.
>
> **[Z.8] Breach and Remedies**
>
> (a) Any breach of Articles [Z.2], [Z.3], or [Z.4] by a Director, Key Managerial Personnel, or Senior Management shall be deemed a material breach of their terms of appointment or employment, as applicable.
>
> (b) The Board of Directors shall, upon becoming aware of a breach, forthwith:
>   - Investigate the breach and record findings in the Board minutes;
>   - Take disciplinary action, which may include termination of appointment or employment;
>   - Report the breach to the Data Protection Board within **seven (7) days** of the Board becoming aware of it.
>
> (c) Any transaction entered into by the company with a Data Fiduciary in violation of this Article shall be voidable at the option of the company.
>
> **[Z.9] Amendment Lock-In (MANDATORY - Part A, Item 7)**
>
> The provisions of this Article [Z] **may be amended only with the previous written approval of the Data Protection Board of India**, pursuant to the Digital Personal Data Protection Rules, 2025, First Schedule, Part A, Item 7.
>
> Any amendment to this Article [Z] effected without such approval shall be **void ab initio** and of no legal effect.
>
> No resolution to amend this Article [Z] shall be proposed to the shareholders in general meeting unless:
> - The Board of Directors has applied to the Data Protection Board for approval;
> - The Data Protection Board has granted written approval; and
> - The approval is annexed to the notice convening the general meeting.

**RESOLVED THAT** the Articles of Association be and are hereby amended by inserting Article [Z] as set out above, and that such amendment is in compliance with the Digital Personal Data Protection Rules, 2025, First Schedule, Part A, Item 7.

---

## Part 3: Board of Directors Resolution

**Draft Resolution for Approval and RoC Filing**

> **SPECIAL RESOLUTION**
>
> **RESOLVED THAT** pursuant to Section 14 of the Companies Act, 2013, and in compliance with the Digital Personal Data Protection Rules, 2025, First Schedule, Part A, Item 7, the Memorandum of Association and Articles of Association of the company be and are hereby amended as follows:
>
> 1. **Memorandum of Association:**
>    - Main Objects Clause III is amended by inserting sub-clause [X] as set out in Part 1 of the amendment template dated [DATE];
>    - Ancillary Powers Clause IV is amended by inserting sub-clause [Y] as set out in Part 1 of the amendment template dated [DATE].
>
> 2. **Articles of Association:**
>    - A new Article [Z] titled "Conflict-of-Interest Governance for Consent Manager Operations" is inserted as set out in Part 2 of the amendment template dated [DATE].
>
> **RESOLVED FURTHER THAT** the amended provisions contain a lock-in clause requiring the previous written approval of the Data Protection Board of India for any subsequent amendment to the conflict-of-interest provisions, and that such lock-in is necessary for the company's registration as a Consent Manager under the Digital Personal Data Protection Act, 2023, Section 6(9).
>
> **RESOLVED FURTHER THAT** [COMPANY SECRETARY / AUTHORIZED SIGNATORY] be and is hereby authorized to:
> - File Form MGT-14 with the Registrar of Companies within thirty (30) days of the passing of this resolution;
> - Attach certified true copies of the amended MoA and AoA;
> - Take all steps necessary to give effect to this resolution.

**Signed:**

| Role | Name | Signature | Date |
|------|------|-----------|------|
| **Chairperson** | | | |
| **Director 1** | | | |
| **Director 2** | | | |
| **Company Secretary** | | | |

---

## Part 4: RoC Filing Checklist (Form MGT-14)

**Required Documents for MCA21 Portal Submission:**

- [ ] **Form MGT-14** (Event-based filing for resolutions and agreements)
  - Event type: Amendment of Memorandum/Articles
  - SRN (Service Request Number) obtained after e-filing

- [ ] **Certified True Copy of Board Resolution**
  - Signed by Chairperson and one Director
  - Company Secretary certification

- [ ] **Certified True Copy of Shareholders' Special Resolution** (if required)
  - For private companies: Board resolution may suffice if AoA permits
  - For public companies: Special resolution in general meeting required

- [ ] **Amended Memorandum of Association**
  - Clean copy with inserted clauses highlighted
  - Certified by Company Secretary

- [ ] **Amended Articles of Association**
  - Clean copy with new Article [Z] highlighted
  - Certified by Company Secretary

- [ ] **Explanatory Statement** (Section 102, if special resolution in general meeting)
  - Explain the purpose: DPDPA Consent Manager registration
  - Attach extracts of First Schedule, Part A, Item 7

- [ ] **Director Identification Numbers (DINs)** for all signing directors

- [ ] **Filing Fee** (per MCA Schedule)
  - Calculated based on authorized capital

**Timeline:**
- Board resolution passed: [DATE]
- Form MGT-14 filed: Within **30 days** of resolution date
- RoC processing: 7-15 days (if no defects)
- Approval confirmation: Updated Certificate of Incorporation (if name change) OR SRN acknowledgement

---

## Part 5: Post-Amendment Compliance

**Once MoA/AoA amendments are approved by RoC:**

### Immediate Actions (Within 7 Days)

- [ ] Obtain **updated copies** of MoA and AoA from RoC
- [ ] Update company records and website with new objects and articles
- [ ] Notify all Directors, KMP, and Senior Management of new conflict-of-interest obligations
- [ ] Distribute disclosure forms for completion (Article [Z.5])

### Within 30 Days

- [ ] Conduct conflict-of-interest training for Board, KMP, and Senior Management
- [ ] Establish conflict-of-interest register
- [ ] Draft and approve conflict-of-interest policy (Article [Z.7])
- [ ] Submit disclosure declarations from all covered personnel

### Ongoing Obligations

- [ ] **Annual disclosure cycle:** Directors, KMP, and Senior Management submit updated declarations
- [ ] **Quarterly Board review:** Review conflict-of-interest register
- [ ] **Annual Board certification:** Board certifies compliance with Article [Z] in annual report
- [ ] **Pre-Board approval requirement:** Any transaction with Data Fiduciary reviewed for conflict risk

---

## Part 6: FAQs

**Q: Must these provisions be in the MoA AND AoA, or can we choose one?**

A: Part A, Item 7 refers to "memorandum of association **and** articles of association." To maximize compliance certainty, include provisions in **both**. The MoA establishes objects (Consent Manager operations) and the AoA establishes internal governance (conflict-of-interest rules).

**Q: Can we amend these provisions after registration?**

A: Yes, but **only with prior written approval from the Data Protection Board**. The lock-in clause (MoA Clause IV([Y])(e) and AoA Article [Z.9]) makes unauthorized amendments void.

**Q: What if a Director holds a small shareholding (say under 2%) in a Data Fiduciary? Is that permitted?**

A: The Rules set no shareholding threshold for this. Part B, Item 10 requires measures to ensure that no conflict of interest arises from a director's, KMP's or senior manager's directorship, financial interest, employment or beneficial ownership in a Data Fiduciary, at any size. The two per cent figure in the Rules is a **disclosure** threshold (Part B, Item 11(b)-(c)), not a safe harbour. So this template has no size threshold: every holding is disclosed under Article [Z.5] and assessed for conflict, and Article [Z.3] prohibits any holding that gives rise to one. A small holding is permitted only if that assessment finds no conflict.

**Q: Can we remove these provisions if we deregister as a Consent Manager in the future?**

A: Only with Board approval. The lock-in prevents **any** amendment without Board approval. If you deregister, you would apply to the Board for approval to remove the provisions.

**Q: What is "material pecuniary relationship" under Article [Z.4](b)?**

A: The term is not defined in DPDPA. Adopt a threshold (e.g., relationships exceeding ₹10 lakh annually) in your conflict-of-interest policy. Disclose all relationships to the Board for case-by-case evaluation.

**Q: Can promoters hold shares in Data Fiduciaries?**

A: Part B, Item 10 names the Consent Manager's **directors, KMP and senior management**, not its promoters. Item 9 is a general duty to "avoid conflict of interest with Data Fiduciaries, including in respect of their promoters and key managerial personnel", where "their" refers to the Data Fiduciaries, and Item 11(c) requires the Consent Manager to publish every body corporate in which a promoter holds more than two per cent of the shares. Treat a promoter's holding in a Data Fiduciary as a conflict to assess and disclose; if the promoter is also a Director or holds a KMP/senior management role, Item 10 applies directly.

**Q: How do we demonstrate compliance to the Board during registration?**

A: Submit:
- RoC-certified copies of amended MoA/AoA
- Conflict-of-interest policy
- Completed disclosure forms for all Directors/KMP/Senior Management (showing zero Data Fiduciary relationships OR relationships below thresholds)
- Board resolution certifying compliance

---

## Part 7: Sample Disclosure Form

**DPDPA Consent Manager Conflict-of-Interest Disclosure**

Pursuant to Article [Z.5] of the Articles of Association

**To:** Board of Directors, [Company Name]

**From:** [Name], [Designation]

**Declaration Period:** [Financial Year / Date Range]

I hereby declare the following interests in relation to Data Fiduciaries as defined under the Digital Personal Data Protection Act, 2023:

| Category | Details | Data Fiduciary Name | Nature of Interest | Value/Percentage |
|----------|---------|---------------------|-------------------|------------------|
| **Shareholding** | ☐ Yes ☐ No | [If Yes, list fiduciary] | [Direct/Beneficial/Relative] | [% of paid-up capital] |
| **Directorship** | ☐ Yes ☐ No | [If Yes, list fiduciary] | [Executive/Non-Executive/Independent] | N/A |
| **Employment/Consultancy** | ☐ Yes ☐ No | [If Yes, list fiduciary] | [Full-time/Part-time/Advisory] | [Annual compensation] |
| **Pecuniary Relationship** | ☐ Yes ☐ No | [If Yes, describe] | [Contract/Loan/Other] | [Annual value ₹] |

**Certification:**

I certify that:
1. The above information is true, complete, and accurate to the best of my knowledge.
2. I have no undisclosed interests in Data Fiduciaries that would violate Article [Z] of the AoA.
3. I will promptly notify the Board of any material changes to the above during my tenure.

**Signature:** _______________
**Date:** _______________
**PAN:** _______________
**DIN (if Director):** _______________

---

**END OF TEMPLATE**

**Next Steps:**
1. Engage legal counsel for finalization
2. Obtain Board approval of draft amendments
3. Convene general meeting (if required) for shareholders' special resolution
4. File Form MGT-14 with RoC within 30 days
5. Update conflict-of-interest governance framework post-approval