The consent model already exists.Copy it.

Purpose, duration, frequency, revocation. The account aggregator artefact has all four.

In one line: Account aggregators operate under RBI regulation using consent artefacts that specify purpose, duration and revocation. The model closely reflects DPDPA's requirements for specific, informed and withdrawable consent.

The estate · Fintech & NBFCHover to inspect

India built the right consent once. Now build it everywhere.

The scene

The same customer used two products from the same company. In one, she shared bank statements through an account aggregator: purpose, period and expiry shown on one screen, revocable in two taps. In the other, she ticked a box beside eleven pages of terms. Same company. Same legal team.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Account aggregator consent is only for AA flows. It is the clearest working example of what DPDPA consent should look like. Use the AA consent artefact as the design pattern for all consent.
Granular consent kills conversion. Unclear consent kills defensibility; conversion built on it is borrowed. Measure conversion on consent the customer understood.

What to borrow

A stated purpose. A stated period. A stated frequency of access. An expiry. A one-step revocation. A log of all of it. That is most of Section 6 in six lines.

Monday morning

  1. 01Put your main consent screen beside an AA consent screen.
  2. 02Mark every element the AA screen has that yours lacks.
  3. 03Ship one of them this sprint.

Questions, answered plainly

How does the account aggregator framework relate to DPDPA?

Account aggregators operate under RBI regulation using consent artefacts that specify purpose, duration and revocation. The model closely reflects DPDPA's requirements for specific, informed and withdrawable consent.

Are account aggregators consent managers under DPDPA?

They are distinct concepts. Consent managers are registered with the Data Protection Board under DPDPA. The Rules set their registration conditions.

Sector · Fintech & NBFCYour onboarding takes ninety seconds. Your liability lasts years.Read → Fintech & NBFC · Deep divePermission is not consent. It is only access.Read → Fintech & NBFC · Deep diveThe model knows things the customer was never told.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner