# DPDPA Consent Manager Registration Readiness Checklist

**Pre-application self-audit against First Schedule, Part A (9 conditions)**

---

## How to Use This Checklist

**Purpose:** Determine if your organization is ready to submit a Consent Manager registration application to the Data Protection Board.

**Scoring:**
- **✅ PASS:** Condition fully met; evidence available
- **⚠️ PARTIAL:** Condition partially met; remediation needed
- **❌ FAIL:** Condition not met; blocker to registration
- **N/A:** Not applicable (rare for Part A conditions)

**Exit Criteria:** All 9 conditions must be **✅ PASS** before submitting the Board application.

---

## Condition 1: Indian Incorporation

**Regulatory Source:** First Schedule, Part A, Item 1

> "The applicant is a company incorporated in India."

**Requirements:**

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| Company incorporated under Companies Act, 2013 | ☐ PASS ☐ FAIL | Certificate of Incorporation | Foreign entities must establish Indian subsidiary |
| Corporate Identity Number (CIN) issued | ☐ PASS ☐ FAIL | CIN format: `U/L[5-digit][State][Year]PTC/PLC[6-digit]` | |
| Registered office in India | ☐ PASS ☐ FAIL | MCA21 company profile | Virtual offices may not suffice; verify Board requirements |
| Active status on MCA registry | ☐ PASS ☐ FAIL | MCA portal check (no "Strike Off" or "Defunct") | |

**Common Failure Points:**
- Foreign parent company applying directly (must establish Indian subsidiary first)
- Company incorporated but not yet active on MCA registry
- LLP or partnership firm applying (only "company" as defined under Companies Act qualifies)

**Remediation (if ❌ FAIL):**
- Incorporate Indian subsidiary: Timeline 2-4 weeks, cost ₹15,000-50,000 (incl. legal fees)
- Obtain DIN for at least 2 directors resident in India
- File INC-32 (SPICe+ Part B) for PAN/TAN

**Evidence for Board Submission:**
- Certified copy of Certificate of Incorporation
- Certified copy of MoA and AoA
- MCA21 company master data print (showing active status)

---

## Condition 2: Technical, Operational, and Financial Capacity

**Regulatory Source:** First Schedule, Part A, Item 2

> "The applicant has sufficient capacity, including technical, operational and financial capacity, to fulfil its obligations as a Consent Manager."

**Requirements:**

### Technical Capacity

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Zero-knowledge architecture** designed and documented | ☐ PASS ☐ PARTIAL ☐ FAIL | Architecture diagrams, threat model | See `architecture/zero-knowledge-flow.mmd` |
| **Immutable consent ledger** implemented or deployable | ☐ PASS ☐ PARTIAL ☐ FAIL | Database schema, retention policy | See `database/consent-ledger-schema.sql` |
| **Interoperable API** per OpenAPI spec | ☐ PASS ☐ PARTIAL ☐ FAIL | API documentation, OAuth integration | See `api-spec/consent-manager-api.yaml` |
| **High-availability infrastructure** (99.9% uptime SLA) | ☐ PASS ☐ PARTIAL ☐ FAIL | Cloud architecture diagram, SLA guarantee | Multi-AZ deployment recommended |
| **Security safeguards** benchmarked against Rule 6(1)(a)-(g) | ☐ PASS ☐ PARTIAL ☐ FAIL | ISO 27001 certification OR security audit report | Part B, Item 7 requires reasonable security safeguards; Rule 6 lists the Data Fiduciary minimum |

**Scoring:**
- **PASS:** All 5 technical requirements met; platform operational in staging OR production-ready
- **PARTIAL:** 3-4 requirements met; gaps identified with remediation plan
- **FAIL:** <3 requirements met; substantial technical build needed

### Operational Capacity

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Staffing:** Compliance officer, security team, engineering team | ☐ PASS ☐ PARTIAL ☐ FAIL | Org chart with roles and headcount | Minimum: 1 compliance lead, 2 engineers, 1 security lead |
| **Runbooks:** Incident response, breach notification, grievance handling | ☐ PASS ☐ PARTIAL ☐ FAIL | Documented procedures | Use templates from `../dpdpa-breach-notification/` |
| **24/7 monitoring** for consent platform uptime and security | ☐ PASS ☐ PARTIAL ☐ FAIL | Monitoring dashboards (Grafana/Datadog) | Part B, Item 12 audit mechanisms |
| **Grievance redressal system** live at registration, with a published response period not exceeding 90 days | ☐ PASS ☐ PARTIAL ☐ FAIL | Grievance workflow design | Act S.13(1); Rule 14(3) (from 13 May 2027) |

**Scoring:**
- **PASS:** All 4 operational requirements met; team in place, procedures documented
- **PARTIAL:** 2-3 requirements met; hiring or documentation in progress
- **FAIL:** <2 requirements met; no operational readiness

### Financial Capacity

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Net worth ≥ ₹2 crore** (verified separately under Item 4) | ☐ PASS ☐ FAIL | CA-certified statement | See Condition 4 below |
| **12-month operating budget** secured | ☐ PASS ☐ PARTIAL ☐ FAIL | Financial model, funding commitment | Cover: salaries, infrastructure, compliance costs |
| **Burn rate** sustainable for at least 18 months | ☐ PASS ☐ PARTIAL ☐ FAIL | Cash flow projection | Account for pre-revenue period |

**Scoring:**
- **PASS:** All 3 financial requirements met; funded for 18+ months
- **PARTIAL:** Net worth met but operational budget <12 months
- **FAIL:** Net worth <₹2 crore OR <6 months runway

**Overall Condition 2 Assessment:**

**Result:** ☐ PASS (all 3 sub-categories PASS) ☐ PARTIAL (1-2 PARTIAL) ☐ FAIL (any FAIL)

**Evidence for Board Submission:**
- Technical capacity: Architecture docs, API spec, security audit report
- Operational capacity: Org chart, runbooks, monitoring dashboards
- Financial capacity: Financial model, funding letters, audited financials

---

## Condition 3: Sound Financial Condition and Management Character

**Regulatory Source:** First Schedule, Part A, Item 3

> "The financial condition and the general character of management of the applicant are sound."

**Requirements:**

### Financial Condition

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Audited financial statements** for last 2 years (if applicable) | ☐ PASS ☐ PARTIAL ☐ FAIL | Balance sheet, P&L, cash flow | Startups <2 years old: Provide Year 1 OR pro-forma |
| **No outstanding statutory dues** (GST, TDS, ESI, PF) | ☐ PASS ☐ FAIL | Compliance certificates | Check MCA21 for Form DPT-3, AOC-4 filing status |
| **No defaults** on loan repayments or trade payables >90 days | ☐ PASS ☐ FAIL | CIBIL/credit report for company | Default = red flag for Board |
| **Positive net worth** and sustainable business model | ☐ PASS ☐ PARTIAL ☐ FAIL | Auditor's notes, going concern opinion | Covered under Item 5 (business viability) |

### Management Character

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Directors:** No convictions, bankruptcies, or disqualifications | ☐ PASS ☐ FAIL | DIN status check, court records search | Section 164, Companies Act |
| **Directors:** No pending SEBI/RBI/NCLT proceedings | ☐ PASS ☐ FAIL | Regulatory database searches | Check SEBI debarment list, RBI wilful defaulters |
| **KMP:** Clean background checks (police verification, CIBIL) | ☐ PASS ☐ PARTIAL ☐ FAIL | Background verification reports | Use third-party agency |
| **No history of data protection violations** at prior organizations | ☐ PASS ☐ FAIL | Self-declaration + database search | Check global breach databases (GDPR fines, CCPA actions) |

**Overall Condition 3 Assessment:**

**Result:** ☐ PASS (all requirements PASS) ☐ FAIL (any FAIL)

**Evidence for Board Submission:**
- Audited financials (CA-certified)
- Statutory compliance certificates
- Director DIN status reports
- Background verification reports for all directors and KMP
- Self-declarations of clean record

---

## Condition 4: Minimum Net Worth ₹2 Crore

**Regulatory Source:** First Schedule, Part A, Item 4

> "The net worth of the applicant is not less than two crore rupees."

**Definition (from First Schedule):**

> the expression "net worth" shall mean the aggregate value of total assets as reduced by the value of liabilities of the Consent Manager as appearing in its books of accounts

**Calculation:**

| Component | Amount (₹) | Source |
|-----------|------------|--------|
| **Total Assets** | | Balance sheet as on [Date] |
| Less: **Total Liabilities** | | Balance sheet as on [Date] |
| **= Net Worth** | | Must be ≥ ₹2,00,00,000 |

**Requirements:**

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Net worth ≥ ₹2 crore** per audited financials | ☐ PASS ☐ FAIL | CA-certified net worth statement | Auditor must sign and seal |
| **Valuation date** within 6 months of application | ☐ PASS ☐ FAIL | Balance sheet date | If >6 months old, obtain updated valuation |
| **No hidden liabilities** (contingent liabilities disclosed) | ☐ PASS ☐ FAIL | Notes to accounts, auditor's report | Check for off-balance-sheet liabilities |

**Common Failure Points:**
- Net worth calculated incorrectly (e.g., including intangibles not on books)
- Stale financials (>6 months old) without updated valuation
- Capitalization via non-cash contributions not properly recorded

**Remediation (if net worth < ₹2 crore):**
- Fresh equity infusion: Issue shares to promoters/investors
- Debt-to-equity conversion: Convert shareholder loans to equity
- Timeline: 2-4 weeks for capital infusion + RoC filing (Form PAS-3 if private company)

**Evidence for Board Submission:**
- CA-certified statement of net worth (format: "I certify that the net worth of [Company Name] as on [Date] is ₹[Amount], computed per the First Schedule definition.")
- Audited balance sheet
- CA's membership number and firm registration

---

## Condition 5: Adequate Business Viability

**Regulatory Source:** First Schedule, Part A, Item 5

> "The volume of business likely to be available to and the capital structure and earning prospects of the applicant are adequate."

**Requirements:**

### Volume of Business

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Customer pipeline:** LOIs/MOUs from Data Fiduciaries | ☐ PASS ☐ PARTIAL ☐ FAIL | Signed LOIs, term sheets | Minimum: 3-5 fiduciaries committed |
| **Projected consent volume:** >10,000 events/month within Year 1 | ☐ PASS ☐ PARTIAL ☐ FAIL | Business plan, market sizing | Demonstrate scale justification |
| **Market opportunity:** Addressable market analysis | ☐ PASS ☐ PARTIAL ☐ FAIL | Industry research, TAM/SAM/SOM | E.g., fintech, e-commerce, healthtech sectors |

### Capital Structure

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Equity capitalization:** ₹2 crore+ net worth (per Item 4) | ☐ PASS ☐ FAIL | Cap table | Covered under Condition 4 |
| **Debt-to-equity ratio:** <2:1 (prudent leverage) | ☐ PASS ☐ PARTIAL ☐ FAIL | Balance sheet | High debt = solvency risk |
| **Investor profile:** Credible investors/promoters | ☐ PASS ☐ PARTIAL ☐ FAIL | Shareholder list | VC/PE backing = positive signal |

### Earning Prospects

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Revenue model:** Defined and sustainable | ☐ PASS ☐ PARTIAL ☐ FAIL | Pricing strategy, unit economics | E.g., per-consent transaction fee, SaaS subscription |
| **Break-even timeline:** Within 24-36 months | ☐ PASS ☐ PARTIAL ☐ FAIL | Financial projections | Demonstrate path to profitability |
| **Sensitivity analysis:** Scenario modeling (best/base/worst case) | ☐ PASS ☐ PARTIAL ☐ FAIL | Excel model | Show resilience under adverse assumptions |

**Overall Condition 5 Assessment:**

**Result:** ☐ PASS (all 3 sub-categories PASS) ☐ PARTIAL (1-2 PARTIAL) ☐ FAIL (any FAIL)

**Evidence for Board Submission:**
- 3-year financial projections (revenue, EBITDA, cash flow)
- LOIs/MOUs from onboarding Data Fiduciaries
- Market opportunity analysis
- Cap table and shareholder list

---

## Condition 6: Management Integrity

**Regulatory Source:** First Schedule, Part A, Item 6

> "The directors, key managerial personnel and senior management of the applicant company are individuals with a general reputation and record of fairness and integrity."

**Requirements:**

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Police verification** for all directors and KMP | ☐ PASS ☐ FAIL | PVR certificates from local police | Timeline: 2-3 weeks |
| **CIBIL/credit check** for all directors and KMP | ☐ PASS ☐ FAIL | CIBIL score reports | Score <650 = potential red flag |
| **Court records search** (civil and criminal) | ☐ PASS ☐ FAIL | District court, High Court, Supreme Court | Check for pending litigation |
| **Regulatory sanctions check:** SEBI, RBI, IRDA, MCA | ☐ PASS ☐ FAIL | Debarment lists, enforcement orders | SEBI debarment list, RBI wilful defaulters |
| **Data protection violations check** (global) | ☐ PASS ☐ FAIL | GDPR fines database, CCPA actions | Self-declaration + third-party search |
| **Professional references** from prior employers/clients | ☐ PASS ☐ PARTIAL ☐ FAIL | Reference letters (2 per director/KMP) | Optional but strengthens application |

**Likely Disqualifying Factors (our assessment; the Rules list no specific disqualifications):**
- ❌ Conviction for fraud, embezzlement, or data breach
- ❌ SEBI/RBI debarment or penalty order
- ❌ Bankruptcy/insolvency proceedings
- ❌ Disqualification under Section 164, Companies Act

**Overall Condition 6 Assessment:**

**Result:** ☐ PASS (all requirements PASS, zero disqualifying factors) ☐ FAIL (any disqualifying factor)

**Evidence for Board Submission:**
- Police verification reports
- CIBIL reports
- Court search affidavits (from legal counsel)
- Regulatory sanctions clearance certificate
- Self-declarations from all directors/KMP

---

## Condition 7: Constitutional Embedding of Conflict-of-Interest Provisions

**Regulatory Source:** First Schedule, Part A, Item 7

> "The memorandum of association and articles of association of the applicant company contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered to, that policies and procedures are in place to ensure such adherence, and that such provisions may be amended only with the previous approval of the Board."

**Requirements:**

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **MoA amendment:** Consent Manager objects clause added | ☐ PASS ☐ FAIL | Amended MoA filed with RoC | See `registration/moa-aoa-amendment-template.md` |
| **MoA amendment:** Conflict-of-interest ancillary powers clause added | ☐ PASS ☐ FAIL | Amended MoA filed with RoC | Includes lock-in provision |
| **AoA amendment:** Article [Z] on conflict-of-interest governance inserted | ☐ PASS ☐ FAIL | Amended AoA filed with RoC | Detailed prohibitions on directorship, shareholding, employment |
| **Lock-in clause:** Amendment requires Board approval | ☐ PASS ☐ FAIL | MoA/AoA text | Exact language: "may be amended only with the previous approval of the Board" |
| **RoC filing:** Form MGT-14 submitted and approved | ☐ PASS ☐ PENDING ☐ FAIL | SRN, updated Certificate of Incorporation | Timeline: 30 days to file, 7-15 days for approval |

**Common Failure Points:**
- Lock-in clause omitted or watered down (e.g., "may seek Board approval" instead of "only with...approval")
- MoA/AoA amended but Form MGT-14 not filed with RoC
- Conflict-of-interest provisions placed in policies (not MoA/AoA) — insufficient

**Overall Condition 7 Assessment:**

**Result:** ☐ PASS (all requirements PASS, RoC approval obtained) ☐ PENDING (MGT-14 filed, awaiting RoC) ☐ FAIL

**Evidence for Board Submission:**
- RoC-certified copies of amended MoA and AoA
- Form MGT-14 filing acknowledgement (SRN)
- Board resolution approving amendments

---

## Condition 8: Operations in Data Principals' Interests

**Regulatory Source:** First Schedule, Part A, Item 8

> "The operations proposed to be undertaken by the applicant are in the interests of Data Principals."

**Requirements:**

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Fiduciary capacity policy** adopted by Board | ☐ PASS ☐ FAIL | Board resolution, policy document | Prioritize DP interests over DF/commercial interests |
| **Revenue model alignment:** No incentive to deny withdrawals | ☐ PASS ☐ PARTIAL ☐ FAIL | Business model review | E.g., per-consent fee (neutral) vs. withdrawal penalty (misaligned) |
| **Transparency commitments:** Part B, Item 11 disclosures planned | ☐ PASS ☐ PARTIAL ☐ FAIL | Website mockup, disclosure template | Publish promoters, directors, KMP, senior management, >2% shareholders, and bodies corporate in which they hold >2% |
| **Grievance redressal:** live at registration; response period ≤ 90 days | ☐ PASS ☐ PARTIAL ☐ FAIL | Project plan, Act S.13 and Rule 14(3) compliance | See `implementation-checklist.md` Phase 4 |

**Narrative Requirement:**

Prepare a **1-2 page narrative** for the Board submission explaining:
1. How the platform serves Data Principals' interests (e.g., single consent hub, interoperability, transparency)
2. How commercial incentives align with DP welfare (e.g., revenue tied to consent volume, not denial of rights)
3. Conflict mitigation mechanisms (e.g., MoA/AoA lock-in, fiduciary capacity oversight)

**Overall Condition 8 Assessment:**

**Result:** ☐ PASS (all requirements PASS, narrative prepared) ☐ PARTIAL (1-2 PARTIAL) ☐ FAIL

**Evidence for Board Submission:**
- Fiduciary capacity policy
- Revenue model description
- Narrative on DP interests alignment

---

## Condition 9: Independent Certification

**Regulatory Source:** First Schedule, Part A, Item 9

> "It is independently certified that— (a) the interoperable platform of the applicant to enable the Data Principal to give, manage, review and withdraw her consent is consistent with such data protection standards and assurance framework as may be published by the Board on its website from time to time; and (b) appropriate technical and organisational measures are in place to ensure adherence to such standards and framework and effective observance of the obligations under item 11 of Part B."

**Requirements:**

### Select Independent Auditor

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **Auditor qualifications:** ISO 27001 lead auditor OR equivalent | ☐ PASS ☐ FAIL | Auditor credentials, accreditation | NABCB-accredited certification body preferred |
| **Independence:** No financial interest in applicant | ☐ PASS ☐ FAIL | Auditor independence declaration | Auditor cannot be investor/shareholder |

### Platform Certification Scope

| Requirement | Status | Evidence | Notes |
|-------------|--------|----------|-------|
| **(a) Interoperability:** OAuth 2.0, OpenAPI, standardized consent schemas | ☐ PASS ☐ PARTIAL ☐ FAIL | API spec review, auditor test results | See `api-spec/consent-manager-api.yaml` |
| **(a) Data protection standards:** Alignment with Board's published framework | ☐ PENDING | Board has not yet published standards | Build to ISO 27001 + NIST Privacy Framework as baseline |
| **(b) Technical measures:** Encryption, access controls, audit logging | ☐ PASS ☐ PARTIAL ☐ FAIL | Security assessment report | Measures to adhere to the Board's standards and framework; Rule 6(1)(a)-(g) as a benchmark |
| **(b) Organisational measures:** Policies, training, incident response | ☐ PASS ☐ PARTIAL ☐ FAIL | Policy review, auditor interviews | Governance framework |
| **(b) Part B, Item 11 transparency:** Disclosure mechanisms operational | ☐ PASS ☐ PARTIAL ☐ FAIL | Website review | Promoters, directors, shareholders published |

**Timeline:**
- Auditor selection: 2 weeks
- Platform assessment: 3-4 weeks
- Remediation (if needed): Variable
- Certification issuance: 1-2 weeks

**Overall Condition 9 Assessment:**

**Result:** ☐ PASS (certification issued) ☐ PENDING (audit in progress) ☐ FAIL

**Evidence for Board Submission:**
- Independent auditor certification letter
- Audit report (summary version for Board)
- Remediation plan (if gaps identified)

**Note:** Since the Board has not yet published data protection standards (as of October 2026), auditors should certify against:
- ISO 27001:2022 controls
- NIST Privacy Framework alignment
- OpenAPI/OAuth interoperability standards
- Readiness to adapt when Board standards are published

---

## Go/No-Go Decision Matrix

**Complete this table to make the final registration decision:**

| Condition | Status | Blocker (Y/N) | Remediation Timeline |
|-----------|--------|---------------|----------------------|
| 1. Indian incorporation | ☐ PASS ☐ FAIL | Y | [If FAIL: 2-4 weeks] |
| 2. Technical/operational/financial capacity | ☐ PASS ☐ PARTIAL ☐ FAIL | Y (if FAIL) | [If PARTIAL: specify] |
| 3. Financial condition & management character | ☐ PASS ☐ FAIL | Y | [If FAIL: specify] |
| 4. Net worth ≥ ₹2 crore | ☐ PASS ☐ FAIL | Y | [If FAIL: 2-4 weeks capital raise] |
| 5. Business viability | ☐ PASS ☐ PARTIAL ☐ FAIL | N (if PARTIAL) | [If FAIL: 4-8 weeks] |
| 6. Management integrity | ☐ PASS ☐ FAIL | Y | [If FAIL: Change directors/KMP] |
| 7. MoA/AoA conflict provisions | ☐ PASS ☐ PENDING ☐ FAIL | Y | [If PENDING: wait for RoC] |
| 8. DP interests alignment | ☐ PASS ☐ PARTIAL ☐ FAIL | N (if PARTIAL) | [If FAIL: 2-4 weeks policy work] |
| 9. Independent certification | ☐ PASS ☐ PENDING ☐ FAIL | Y | [If PENDING: wait for audit] |

**Decision:**

- **GO (PROCEED WITH REGISTRATION):** All 9 conditions = ☐ PASS (or ☐ PENDING with <4 weeks to resolution)
- **DEFER (REMEDIATE FIRST):** 1-3 conditions = ☐ PARTIAL or ☐ PENDING with >4 weeks remediation
- **NO-GO (DO NOT REGISTER):** Any condition = ☐ FAIL with no viable remediation path

**Sign-Off:**

| Role | Name | Decision | Date |
|------|------|----------|------|
| **Chief Executive Officer** | | ☐ GO ☐ DEFER ☐ NO-GO | |
| **Chief Financial Officer** | | ☐ GO ☐ DEFER ☐ NO-GO | |
| **Compliance Officer** | | ☐ GO ☐ DEFER ☐ NO-GO | |
| **Legal Counsel** | | ☐ GO ☐ DEFER ☐ NO-GO | |

---

## Next Steps (If GO Decision)

1. **Compile Board Submission Package:**
   - Application form (format TBD by Board)
   - Evidence for all 9 conditions (per checklists above)
   - Application fee (amount TBD)

2. **Submit to Data Protection Board:**
   - Portal: [URL TBD by Board]
   - Submission timeline: [TBD]

3. **Post-Submission:**
   - Maintain "audit-ready" state during Board review
   - Respond to Board queries within stipulated timelines
   - Keep the grievance system live and publish its response period, not exceeding 90 days (Act S.13; Rule 14(3) from 13 May 2027)

4. **Expected Timeline:**
   - Board review: 3-6 months (estimate based on RBI AA precedent)
   - Outcome: registration, intimated to you and published on the Board's website (Rule 4(2)(a)), OR rejection with reasons communicated (Rule 4(2)(b))

---

**For assistance with registration preparation or Board submission strategy:**

**StateCheck Security**
DPDPA Consent Manager Registration Consulting
[https://statechecksecurity.com/consent-manager-audit](https://statechecksecurity.com/consent-manager-audit)