Account Aggregator × DPDPA

No. An Account Aggregator is a non banking financial company registered with the Reserve Bank of India under the Master Direction on NBFC Account Aggregator, 2016, and it is confined to financial information from notified financial sector regulators. A Consent Manager is registered with the Data Protection Board under Rule 4 of the DPDP Rules, 2025 and is not confined to any sector. Two regulators, two registrations, two tests. Holding one confers nothing under the other.

Not automatically. The artefact is a machine readable structure carrying the user identity, a purpose code, the data range, the fetch frequency and a validity period. Section 6 requires consent that is free, specific, informed, unconditional and unambiguous through clear affirmative action, preceded by an itemised notice under Section 5. Where the purpose code is generic, where the notice does not itemise the personal data, or where withdrawal is not as easy as giving, the artefact will not carry Section 6 on its own.

The Financial Information Provider and the Financial Information User each determine the purpose and means of their own processing and are each a Data Fiduciary for that processing. The aggregator is data blind by regulatory design and does not read the financial information it routes. That narrows its fiduciary position but does not remove it, because it processes the customer's own registration and consent data in its own right.

Withdrawal stops further flow. It does not by itself erase data already delivered to the Financial Information User. Section 6(6) requires withdrawal to be as easy as giving. Section 8(7) with Rule 8 requires erasure once the purpose is no longer served, unless retention is required by law. Because lending records carry independent retention obligations, the defensible answer is a documented retention justification rather than reflex deletion.

In most cases yes, for consent taken before the notice standard existed. Section 5 requires the itemised notice, and where consent was obtained before commencement the Act contemplates that the Data Fiduciary give the notice as soon as reasonably practicable and continue processing until the Data Principal withdraws. The practical question is whether the existing record can evidence a Section 6 quality consent at all. Most cannot.

Section 7 covers specified legitimate uses including compliance with law and certain employment and public interest situations. Statutory KYC obligations can sit there. Credit profiling, risk scoring, cross selling and portfolio analytics generally cannot, because they are commercial purposes chosen by the lender rather than obligations imposed on it. The segregation of statutory processing from commercial processing of the same data is the core drafting exercise.

It depends on who decides the purpose and means. A lending service provider operating under a lender's instructions is a processor and must be bound by contract under Section 8(2). A platform that decides its own targeting, retention or product logic is determining means and is a Data Fiduciary in its own right regardless of what the contract calls it. Labels do not decide status. Control does.

We map every consent taken across the customer journey, identify the lawful basis for each processing operation, redraft the notice and consent layer to satisfy Section 5 and Section 6 without breaking the aggregator flow, and paper the processor chain under Section 8(2). Where the client is preparing for Rule 4, we run the eligibility and conflict of interest analysis separately.