Conditions for registration and obligations of Consent Manager

[See rule 4] PART A Conditions for registration of Consent Manager 1. The applicant is a company incorporated in India. 2. The applicant has sufficient capacity, including technical, operational and financial capacity, to fulfil its obligations as a Consent Manager. 3. The financial condition and the general character of management of the applicant are sound. 4. The net worth of the applicant is not less than two crore rupees. 5. The volume of business likely to be available to and the capital structure and earning prospects of the applicant are adequate. 6. The directors, key managerial personnel and senior management of the applicant company are individuals with a general reputation and record of fairness and integrity. 7. The memorandum of association and articles of association of the applicant company contain provisions requiring that the obligations under items 9 and 10 of Part B are adhered to, that policies and procedures are in place to ensure such adherence, and that such provisions may be amended only with the previous approval of the Board. 8. The operations proposed to be undertaken by the applicant are in the interests of Data Principals. 9. It is independently certified that— (a) the interoperable platform of the applicant to enable the Data Principal to give, manage, review and withdraw her consent is consistent with such data protection standards and assurance framework as may be published by the Board on its website from time to time; and (b) appropriate technical and organisational measures are in place to ensure adherence to such standards and framework and effective observance of the obligations under item 11 of Part B. PART B Obligations of Consent Manager 1. The Consent Manager shall enable a Data Principal using its platform to give consent to the processing of her personal data by a Data Fiduciary onboarded onto such platform either directly to such Data Fiduciary or through another Data Fiduciary onboarded onto such platform, who maintains such personal data with the consent of that Data Principal. Illustration. Individuals are enabled to give, manage, review and withdraw their consent to the processing of their personal data through P, a platform maintained by a Consent Manager. X, an individual, is a registered user on P. B1 and B2 are banks onboarded onto P. Case 1:B1 sends a request on P to X for consent to process personal data contained in her bank account statement. X maintains the bank account statement as a digital record in her digital locker. X uses P to directly give her consent to B1, and proceeds to give B1 access to her bank account statement. Case 2:B1 sends a request on P to X for consent to process personal data contained in her bank account statement. X maintains her bank account with B2. X uses P to route her consent through B2 to B1, while also digitally instructing B2 to send her bank account statement to B1. B2 proceeds to send the bank account statement to B1. 2. The Consent Manager shall ensure that the manner of making available the personal data or its sharing is such that the contents thereof are not readable by it. 3. The Consent Manager shall maintain on its platform a record of the following, namely:—