Consent Manager Framework

Section 6(9) and the DPDP Rules introduce Consent Managers as a novel institutional innovation in India's data protection architecture.

These entities register with the Data Protection Board and serve as intermediaries. They enable Data Principals to provide, manage, review, and withdraw consent across multiple Data Fiduciaries through a unified interface.

This addresses consent fatigue, where individuals overwhelmed by consent requests either disengage entirely or give blanket approvals without meaningful consideration. Consent Managers must satisfy registration requirements including demonstrated technical capability, interoperability compliance, and financial stability to ensure service continuity. They operate as fiduciaries to Data Principals, creating accountability for consent management integrity.

The Rules mandate interoperability between Consent Managers and Data Fiduciaries. This requires standardised consent artefact formats that can be verified across platforms. Legacy systems may need substantial modification to interact with Consent Manager infrastructure.

Data Fiduciaries must honour consent provided through registered Consent Managers with the same validity as direct consent. They must also maintain capability to verify consent authenticity.

Consent Managers bear accountability for their platforms' integrity. This includes security of consent records and accuracy of consent status communications. The framework creates a consent marketplace where Data Principals may select Consent Managers based on service quality, interface usability, and additional features. This could introduce competitive dynamics that improve consent management experience over time.