38 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC.

3(i)]

FIRST SCHEDULE
[See rule 4]
PART A
Conditions of registration of Consent Manager
1. The applicant is a company incorporated in India.
2. The applicant has sufficient capacity, including technical, operational and financial
capacity, to fulfil its obligations as a Consent Manager.
3. The financial condition and the general character of management of the applicant are
sound.
4. The net worth of the applicant is not less than two crore rupees.
5. The volume of business likely to be available to and the capital structure and earning
prospects of the applicant are adequate.
6. The directors, key managerial personnel and senior management of the applicant
company are individuals with a general reputation and record of fairness and integrity.
7. The memorandum of association and articles of association of the applicant company
contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered
to, that policies and procedures are in place to ensure such adherence, and that such
provisions may be amended only with the previous approval of the Board.
8. The operations proposed to be undertaken by the applicant are in the interests of Data
Principals.
9. It is independently certified that—
(a) the interoperable platform of the applicant to enable the Data Principal to give,
manage, review and withdraw her consent is consistent with such data protection
standards and assurance framework as may be published by the Board on its
website from time to time; and
(b) appropriate technical and organisational measures are in place to ensure
adherence to such standards and framework and effective observance of the
obligations under item 11 of Part B.

PART B
Obligations of Consent Manager
1. The Consent Manager shall enable a Data Principal using its platform to give consent
to the processing of her personal data by a Data Fiduciary onboarded onto such platform
either directly to such Data Fiduciary or through another Data Fiduciary onboarded onto
such platform, who maintains such personal data with the consent of that Data Principal.
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 39

Illustration.
Individuals are enabled to give, manage, review and withdraw their consent to the
processing of their personal data through P, a platform maintained by a Consent Manager.
X, an individual, is a registered user on P. B1 and B2 are banks onboarded onto P.

Case 1: B1 sends a request on P to X for consent to process personal data contained

in her bank account statement. X maintains the bank account statement as a digital record
in her digital locker. X uses P to directly give her consent to B1, and proceeds to give B1
access to her bank account statement.
Case 2: B1 sends a request on P to X for consent to process personal data contained
in her bank account statement. X maintains her bank account with B2. X uses P to route
her consent through B2 to B1, while also digitally instructing B2 to send her bank account
statement to B1. B2 proceeds to send the bank account statement to B1.
2. The Consent Manager shall ensure that the manner of making available the personal
data or its sharing is such that the contents thereof are not readable by it.
3. The Consent Manager shall maintain on its platform a record of the following,
namely:—
(a) Consents given, denied or withdrawn by her;
(b) Notices preceding or accompanying requests for consent; and
(c) Sharing of her personal data with a transferee Data Fiduciary.
4. The Consent Manager—
(a) shall give the Data Principal using such platform access to such record;
(b) shall, on the request of the Data Principal and in accordance with its terms of
service, make available to her the information contained in such record, in
machine-readable form; and
(c) shall maintain such record for at least seven years, or for such longer period as
the Data Principal and Consent Manager may agree upon or as may be required
by law.
5. The Consent Manager shall develop and maintain a website or app, or both, as the
primary means through which a Data Principal may access the services provided by the
Consent Manager.
6. The Consent Manager shall not sub-contract or assign the performance of any of its
obligations under the Act and these rules.
7. The Consent Manager shall take reasonable security safeguards to prevent personal
data breach.
8. The Consent Manager shall act in a fiduciary capacity in relation to the Data Principal.
9. The Consent Manager shall avoid conflict of interest with Data Fiduciaries, including
in respect of their promoters and key managerial personnel.
10. The Consent Manager shall have in place measures to ensure that no conflict of
interest arises on account of its directors, key managerial personnel and senior
40 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]

management holding a directorship, financial interest, employment or beneficial ownership

in Data Fiduciaries, or having a material pecuniary relationship with them.
11. The Consent Manager shall publish in an easily accessible manner, on its website or
app, or both, as the case may be, information regarding—
(a) the promoters, directors, key managerial personnel and senior management of
the company registered as Consent Manager;
(b) every person who holds shares in excess of two per cent of the shareholding of
the company registered as Consent Manager;
(c) every body corporate in whose shareholding any promoter, director, key
managerial personnel or senior management of the Consent Manager holds
shares in excess of two per cent. as on the first day of the preceding calendar
month; and
(d) such other information as the Board may direct the Consent Manager to disclose
in the interests of transparency.
12. The Consent Manager shall have in place effective audit mechanisms to review,
monitor, evaluate and report the outcome of such audit to the Board, periodically and on
such other occasions as the Board may direct, in respect of—
(a) technical and organisational controls, systems, procedures and safeguards;
(b) continued fulfilment of the conditions of registration; and
(c) adherence to its obligations under the Act and these rules.
13. The control of the company registered as the Consent Manager shall not be transferred
by way of sale, merger or otherwise, except with the previous approval of the Board and
subject to fulfilment of such conditions as the Board may specify in this behalf.

Note: In this Schedule,—

(a) the expression “body corporate” shall include a company, a body corporate as
defined under clause (11) of section 2 of the Companies Act, 2013 (18 of 2013),
a firm, a financial institution, a scheduled bank or a public sector enterprise
established or constituted by or under any Central Act, Provincial Act or State Act,
and any other incorporated association of persons or body of individuals;
(b) the expressions “company”, “control”, “director” and “key managerial personnel”
shall have the same meanings as are respectively assigned to them in the
Companies Act, 2013 (18 or 2013);
(c) the expression “net worth” shall mean the aggregate value of total assets as
reduced by the value of liabilities of the Consent Manager as appearing in its
books of accounts; and
(d) the expressions “promoter” and “senior management” shall have the same
meanings as are respectively assigned to them in the Companies Act, 2013 (18
or 2013).
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 41

SECOND SCHEDULE
[See rules 5(2) and 15]
Standards for processing of personal data by State and its instrumentalities under
clause (b) of section 7 and for processing of personal data necessary for the
purposes specified in clause (b) of sub-section (2) of section 17
Implementation of appropriate technical and organisational measures to ensure effective
observance of the following, in accordance with applicable law, for the processing of
personal data, namely:—
(a) Processing is carried out in a lawful manner;
(b) Processing is done for the uses specified in clause (b) of section 7 of the Act or
for the purposes specified in clause (b) of sub-section (2) of section 17 of the Act,
as the case may be;
(c) Processing is limited to such personal data as is necessary for such uses or
achieving such purposes, as the case may be;
(d) Processing is done while making reasonable efforts to ensure the accuracy of
personal data;
(e) Personal data is retained till required for such uses or achieving such purposes,
as the case may be, or for compliance with any law for the time being in force;
(f) Reasonable security safeguards to prevent personal data breach to protect
personal data in the possession or under control of the Data Fiduciary, including
in respect of any processing undertaken by it or on its behalf by a Data Processor;
(g) Where processing is to be done under clause (b) of section 7 of the Act, the same
is undertaken while giving the Data Principal an intimation in respect of the same
and—
(i) giving the business contact information of a person who is able to answer
on behalf of the Data Fiduciary the questions of the Data Principal about
the processing of her personal data;
(ii) specifying the particular communication link for accessing the website or
app, or both, of such Data Fiduciary, and a description of other means, if
any, using which such Data Principal may exercise her rights under the
Act; and
(iii) is carried on in a manner consistent with such other standards as may be
applicable to the processing of such personal data under policy issued by
the Central Government or any law for the time being in force; and
(h) Accountability of the person who alone or in conjunction with other persons
determines the purpose and means of processing of personal data, for effective
observance of these standards.
42 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]

THIRD SCHEDULE
[See rule 8(1)]

S. Class of Data
Purposes Time period
no. Fiduciaries
(1) (2) (3) (4)
1. Data Fiduciary For all purposes, except for Three years from the date on
who is an e- the following: which the Data Principal last
commerce entity (a) Enabling the Data approached the Data
having not less Principal to access her Fiduciary for the performance
than two crore user account; and of the specified purpose or
registered users (b) Enabling the Data exercise of her rights, or the
in India Principal to access any commencement of the Digital
virtual token that is Personal Data Protection
issued by or on behalf of Rules, 2025, whichever is
the Data Fiduciary, is latest
stored on the digital
facility or platform of such
Data Fiduciary, and may
be used to get money,
goods or services
2. Data Fiduciary For all purposes, except for Three years from the date on
who is an online the following: which the Data Principal last
gaming (a) Enabling the Data approached the Data
intermediary Principal to access her Fiduciary for the performance
having not less user account; and of the specified purpose or
than fifty lakh (b) Enabling the Data exercise of her rights, or the
registered users Principal to access commencement of the Digital
in India any virtual token that is Personal Data Protection
issued by or on behalf Rules, 2025, whichever is
of the Data Fiduciary, latest
is stored on the digital
facility or platform of
such Data Fiduciary,
and may be used to
get money, goods or
services
3. Data Fiduciary For all purposes, except for Three years from the date on
who is a social the following: which the Data Principal last
media (a) Enabling the Data approached the Data
intermediary Principal to access her Fiduciary for the performance
having not less user account; and of the specified purpose or
than two crore (b) Enabling the Data exercise of her rights, or the
registered users Principal to access commencement of the Digital
in India any virtual token that is Personal Data Protection
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 43

issued by or on behalf Rules, 2025, whichever is

of the Data Fiduciary, latest
is stored on the digital
facility or platform of
such Data Fiduciary,
and may be used to
get money, goods or
services

Note: In this Schedule,—

(a) “e-commerce entity” means any person who owns, operates or manages a digital
facility or platform for e-commerce as defined in the Consumer Protection Act, 2019
(35 of 2019), but does not include a seller offering her goods or services for sale on
a marketplace e-commerce entity as defined in the said Act;
(b) “online gaming intermediary” means any intermediary who enables the users of its
computer resource to access one or more online games;
(c) “social media intermediary” means an intermediary as defined in the Information
Technology Act, 2000 (21 of 2000) who primarily or solely enables online interaction
between two or more users and allows them to create, upload, share, disseminate,
modify or access information using her services; and
(d) “user”, in relation to—
(i) an e-commerce entity, means any person who accesses or avails any
computer resource of an e-commerce entity; and
(ii) an online gaming intermediary or a social media intermediary, means any
person who accesses or avails of any computer resource of an intermediary
for the purpose of hosting, publishing, sharing, transacting, viewing,
displaying, downloading or uploading information.
44 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]

FOURTH SCHEDULE
[See rule 11]
PART A
Classes of Data Fiduciaries in respect of whom provisions of sub-sections (1) and
(3) of section 9 shall not apply

S.
Class of Data Fiduciaries Conditions
No.
(1) (2) (3)
1. A Data Fiduciary who is a clinical Processing is restricted to
establishment, mental health provision of health services to the
establishment or healthcare professional child by such establishment or
professional, to the extent
necessary for the protection of her
health.
2. A Data Fiduciary who is an allied Processing is restricted to
healthcare professional supporting implementation of any
healthcare treatment and referral
plan recommended by such
professional for the child, to the
extent necessary for the protection
of her health.
3. A Data Fiduciary who is an educational Processing is restricted to tracking
institution and behavioural monitoring—
(a) for the educational activities of
such institution; or
(b) in the interests of safety of
children enrolled with such
institution.
4. A Data Fiduciary who is an individual in Processing is restricted to tracking
whose care infants and children in a and behavioural monitoring in the
crèche or child day care centre are interests of safety of children
entrusted entrusted in the care of such
institution, crèche or centre.
5. A Data Fiduciary who is engaged by an Processing is restricted to tracking
educational institution, crèche or child the location of such children, in the
care centre for transport of children interests of their safety, during the
enrolled with such institution, crèche or course of their travel to and from
centre such institution, crèche or centre.
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 45

PART B

Purposes for which provisions of sub-sections (1) and (3) of section 9 shall not
apply

S.
Purposes Conditions
No.
(1) (2) (3)
1. For the exercise of any power, Processing is restricted to the
performance of any function or discharge extent necessary for such
of any duties in the interests of a child, exercise, performance or
under any law for the time being in force discharge.
in India
2. For the providing or issuing of any Processing is restricted to the
subsidy, benefit, service, certificate, extent necessary for such
licence or permit, by whatever name provision or issuance.
called, under law or policy or using public
funds, in the interests of a child, under
clause (b) of section 7 of the Act
3. For the creation of a user account for Processing is restricted to the
communicating by email extent necessary for creating such
user account, the use of which is
limited to communication by email.
4. For ensuring that information likely to Processing is restricted to the
cause any detrimental effect on the well- extent necessary to ensure that
being of a child is not accessible to her such information is not accessible
to the child.
5. For confirmation by the Data Fiduciary Processing is restricted to the
that the Data Principal is not a child and extent necessary for such
observance of due diligence under rule confirmation or observance.
10

Note: In this Schedule—

(a) “allied healthcare professional” shall have the same meaning as is assigned to it in
the National Commission for Allied and Healthcare Professions Act, 2021 (14 of
2021);
(b) “clinical establishment” means and includes all establishments and places—
(i) falling within the meaning assigned to the term “clinical establishment” in
clause (c) of section 2 of the Clinical Establishments (Registration and
Regulation) Act, 2010 (23 of 2010); and
(ii) as referred to in sub-clauses (i) or (ii) of the said clause that is owned,
controlled or managed by any force constituted under the Army Act, 1950 (46
of 1950), the Air Force Act, 1950 (45 of 1950) or the Navy Act, 1957 (62 of
1957);
(c) “educational institution” shall mean and include an institution of learning that imparts
education, including vocational education;
46 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]

(d) “healthcare professional” shall have the same meaning as is assigned to it in the
National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);
(e) “health services” shall mean the services referred to in clause (j) of section 2 of the
National Commission for Allied and Healthcare Professions Act, 2021 (14 of 2021);
and
(f) “mental health establishment” shall have the same meaning as is assigned to it in
the Mental Healthcare Act, 2017 (10 of 2017).

FIFTH SCHEDULE
[See rule 17]
Terms and conditions of service of Chairperson and other Members
1. Salary.—(1) The Chairperson shall be entitled to receive a consolidated salary of rupees
four lakh fifty thousand per month, without the facility of house and car.
(2) Every Member other than the Chairperson shall be entitled to receive a consolidated
salary of rupees four lakh per month, without the facility of house and car.
2. Provident Fund.—The Chairperson and every other Member shall be eligible to
contribute to the Provident Fund of the Board, and the manner and terms and conditions
applicable in this regard shall, mutatis mutandis, be the same as those applicable to other
officers and employees of the Board for their Provident Fund.
3. Pension and gratuity.—The Chairperson and every other Member shall not be entitled
to payment of pension or gratuity for service rendered in the Board.
4. Travelling allowance.—(1) The Chairperson and every other Member, while on transfer
to join the Board, or on the expiry of her term with the Board for proceeding to her home
town with family (including in respect of journey undertaken by her and her family), or on
tour within India, shall be entitled to journey allowance, daily allowance and reimbursement
of expense on transportation of personal effects at such scales and rates as are applicable
to an officer of the Central Government in the following level of the pay matrix, namely:—
(a) level 17, in the case of the Chairperson; and
(b) level 15, in the case of every other Member.

(2) The Chairperson and every other Member may undertake tour outside India only in
accordance with guidelines or instructions issued by the Central Government, and in
respect of such tour, she shall be entitled to draw the same allowances as an officer of the
Central Government, in the following level of the pay matrix, is entitled to draw, namely:—
(a) level 17, in the case of the Chairperson; and
(b) level 15, in the case of every other Member.
5. Medical assistance.—(1) The Chairperson and every other Member shall be entitled to
such medical assistance as may be admissible to them under any group health insurance
scheme of the Board for officers and employees of the Board and their eligible dependants.
(2) If the Chairperson or other Member has retired from Government service, or from the
service of a public sector entity or a body corporate established by a Central Act, Provincial
Act or State Act, and there are a separate set of rules for the grant of medical assistance
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 47

for such service, she may, in lieu of medical assistance under sub-paragraph (1), opt to be
governed by such rules.
6. Leave.—(1) The authority competent to sanction leave shall be the Central Government
in respect of the Chairperson, and the Chairperson in respect of any other Member.
(2) The Chairperson and every other Member may avail of such kinds of leave as are
admissible to a Government servant under sub-clause (i) of clause (a) and clause (b) of
sub-rule (1) of rule 26, rules 27, 29, 30 and 40 to 43-C of the Central Civil Services (Leave)
Rules, 1972 (hereinafter referred to as “Leave Rules”).
(3) Leave shall be subject to the conditions applicable to a Government servant under rules
7 to 11 and 22 to 25 of the Leave Rules, and the Central Government may, if satisfied that
the operation of any of the said rules causes undue hardship in a particular case, by order
relax the requirements of that rule to such extent and subject to such exceptions and
conditions as it may consider necessary for dealing with the case in a just and equitable
manner.
(4) The Chairperson and every other Member shall be entitled to casual leave to such
extent as is admissible to a Government servant under instructions issued by the Central
Government.
(5) The Chairperson and every other Member shall be entitled to encashment of earned
leave standing to her credit, subject to such conditions and in like manner as are applicable
to a Government servant under rule 38-A, sub-rules (1) and (2) and sub-clauses (i) and (ii)
of clause (a) of sub-rule (6) of rule 39, rule 39-A and rule 39-C of the Leave Rules, subject
to the maximum extent of encashment under any of the said rules, other than rule 38-A,
being fifty per cent. of the earned leave standing to her credit.
7. Leave travel concession.—(1) Leave travel concession shall be admissible to the
Chairperson and every other Member in accordance with the provisions applicable to
persons appointed to civil services and posts in connection with the affairs of the Union of
India under rule 3, clauses (a) and (d) of rule 4, rules 5 to 15 and rule 17 of the Central
Civil Services (Leave Travel Concession) Rules, 1988, and the entitlement for such
concession shall be the same as is applicable to officers of the Central Government in level
17 of the pay matrix in the case of the Chairperson, and to officers of the Central
Government in level 15 of the pay matrix in the case of a Member.
(2) The Chairperson and every other Member shall be eligible to avail of either leave
travel concession to home town or leave travel concession to any place in India in any
period of two years from the date of assumption of their office as a Member.
8. Other terms and conditions of service.—(1) The Chairperson and every other
Member shall ensure absence of conflict of interest in the performance of the functions of
her office and shall not have any such financial or other interests as are likely to prejudicially
affect the performance of the functions of such office.
(2) The provisions contained in Part IV to Part IX of the Central Civil Services
(Classification, Control and Appeal) Rules, 1965, as applicable to an officer of the Central
48 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]

Government who is a member of a Central Civil Services, Group ‘A’, shall apply, mutatis
mutandis, to the Chairperson and every other Member.
(3) The Chairperson and every other Member shall not be entitled to any sitting fee for
attending meetings of the Board.
(4) The Chairperson and every other Member shall not be entitled to any sumptuary
allowance.
(5) Any matter relating to the conditions of service of the Chairperson orany other Member,
in respect of which no express provision has been made in these rules, shall be referred
to the Central Government for its decision, and the decision of the Central Government on
the same shall be final.
9. In this Schedule, “pay matrix” shall mean the pay matrix referred to in Annexure I to the
Central Government’s Resolution published in the Official Gazette vide Notification no. 1-
2/2016-IC, dated the 25th July, 2016.
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 49

SIXTH SCHEDULE
[See rule 20(2)]
Terms and conditions of appointment and service of officers and employees of
Board

1. Classes of officials.—(1) The Board may, in accordance with the Fundamental Rules
and applicable guidelines issued by the Ministry of Personnel, Public Grievances and
Pensions, Department of Personnel and Training, appoint officers and employees on
deputation from the Central Government, a State Government, an autonomous body under
the overall control of the Central Government or a State Government, a statutory body, or
a public sector enterprise, for a period not exceeding five years.

(2) The Board may also receive or take on deputation any officer or other employee from
the National Institute for Smart Government, for a period not exceeding five years, with
salary and allowances guided by market standards and on such other terms and conditions
as the Board may decide.

2. Gratuity.—The officers and employees shall be entitled to payment of such gratuity as

may be admissible under the Payment of Gratuity Act, 1972 (39 of 1972).

3. Travelling allowance.—The travelling allowance payable to the officers and employees

shall, mutatis mutandis, be the same as those applicable to the officers and employees of
the Central Government.

4. Medical assistance.—The officers and employees shall be entitled to such medical

assistance as may be admissible to them and their eligible dependants under any group
health insurance scheme of the Board, made with the previous approval of the Central
Government.

5. Leave.—(1)The officers and employees may avail of such kinds of leaves as are
admissible to a Government servant under the Central Civil Services (Leave) Rules, 1972,
subject to the conditions applicable under the said rules, and shall be eligible for
encashment of earned leave as provided therein.

(2) The officers and employees shall be entitled to casual leave to such extent as is
admissible to a Government servant under instructions issued by the Central Government.

6. Leave travel concession.—Leave travel concession shall be admissible to the officers

and employees appointed under clause (1) of paragraph 1, in accordance with the
provisions applicable to persons appointed to civil services and posts in connection with
the affairs of the Union of India under the Central Civil Services (Leave Travel Concession)
Rules, 1988.

7. Other terms and conditions of service.—(1) The provisions of the Civil Service
(Conduct) Rules, 1964 shall apply to the officers and employees in like manner as
applicable to a person appointed to a civil service or post in connection with the affairs of
the Union of India under the said rules.
50 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]

(2) The provisions contained in Part IV to Part IX of the Central Civil Services
(Classification, Control and Appeal) Rules, 1965 shall apply, mutatis mutandis, to the
officers and employees appointed under clause (1) of paragraph 1, in like manner as
applicable to a Government servant under the said rules.

(3) Any matter relating to the terms and conditions of service of the officers and employees
appointed under clause (1) of paragraph 1, in respect of which no express provision has
been made in these rules, shall be referred to the Central Government for its decision, and
the decision of the Central Government on the same shall be final.
[भाग II—खण्ड 3(i)] भारत का रािपत्र : असाधारण 51

SEVENTH SCHEDULE
[See rule 22(1)]

S. no. Purpose Authorised person

(1) (2) (3)
1. Use by the State or any of its Such officer of the State or of any of its
instrumentalities, of personal data instrumentalities notified under sub-
of a Data Principal in the interest of section (2) of section 17 of the Act, as
sovereignty and integrity of India or the Central Government or the head of
security of the State such instrumentality, as the case may
be, may designate in this behalf
2. Use by the State or any of its Person authorised under applicable law
instrumentalities for the following
purposes, namely:—
(i) Performance of any function
under any law for the time
being in force in India; or
(ii) Disclosure of any
information for fulfilling any
obligation under any law for
the time being in force in
India
3. Carrying out assessment for Such officer of the Central Government,
notifying any Data Fiduciary or in the Ministry of Electronics and
class of Data Fiduciaries as Information Technology, as the
Significant Data Fiduciary Secretary in charge of the said Ministry
may designate in this behalf
[F. No. AA-11038/1/2025-CL&ES]
BHUVNESH KUMAR, Addl. Secy.

Uploaded by Dte. of Printing at Government of India Press, Ring Road, Mayapuri, New Delhi-110064
and Published by the Controller of Publications, Delhi-110054.