Tech-Enabled Consent: India’s New Model for Digital Data Governance

Context

India is undergoing a paradigm shift in how personal and financial data is managed, with a growing emphasis on user consent, data protection, and interoperable digital ecosystems. The Account Aggregator (AA) framework and the Digital Personal Data Protection (DPDP) Act, 2023 mark two significant pillars in this evolving data governance architecture.

1. Account Aggregator (AA) Framework: Consent-Driven Financial Data Sharing

Overview

The Account Aggregator framework enables individuals to control and securely share their financial data across institutions. It functions under the regulatory oversight of the Reserve Bank of India (RBI) and is also backed by multiple other regulators.

Key Features

• Multi-regulatory initiative involving RBI, SEBI, IRDAI, PFRDA, and Ministry of Finance.

• Enacted through RBI’s NBFC-AA Master Directions, 2016.

• Facilitates real-time, secure, and machine-readable data sharing between financial institutions such as banks, mutual funds, tax authorities, pension funds, and more.

• Empowers users to give, manage, and revoke data-sharing consent.

Significance

• Enhances financial inclusion, digital empowerment, and citizen-centric governance.

• Improves efficiency and transparency in lending and financial services.

• Demonstrates a model for inter-agency cooperation and data fiduciary accountability.

2. Digital Personal Data Protection (DPDP) Act, 2023: Broadening Consent-Based Governance

Core Provisions

• Recognizes individuals as Data Principals and introduces Consent Managers (CMs) who facilitate the management of personal data across sectors.

• Enshrines the principle of explicit, informed, and revocable consent.

• Applicable across sectors beyond finance, such as healthcare, education, employment, and e-commerce.

• Promotes a techno-legal approach to data governance.

Institutional Structure

• Operates under the supervision of the Data Protection Board (DPB).

• Consent Managers are registered intermediaries accountable for managing personal data flow in line with the DPDP Act.

3. Draft DPDP Rules, 2025: Emerging Regulatory Directions

Key Provisions

• Mandatory registration of Consent Managers with the DPB to ensure transparency, compliance, and standardization.

• Encouragement of sector-specific consent frameworks, such as:

  • Financial Health Records (FHR) under the National Health Authority (NHA).

• Promotion of interoperable Application Programming Interfaces (APIs) to enable seamless data sharing.

• Allows commercial agreements between Consent Managers and data fiduciaries, while maintaining user data rights and fiduciary responsibility.

Critical Recommendations

• Avoid regulatory overlap with the existing AA ecosystem.

• Promote synergy between sector-specific systems and the DPDP Act's broader consent architecture.

• Lay the foundation for a future-ready, unified consent infrastructure.

4. Towards a Unified Data Ecosystem

India’s vision for a consent-based data governance system must prioritize:

• Interoperability over fragmentation.

• Harmonization between sectoral and national data-sharing mechanisms.

• Leveraging mature ecosystems like the AA framework to guide the rollout of new initiatives like the DPDP Consent Managers.

This approach will serve as a foundation for:

• Data sovereignty

• Digital inclusion

• Public trust in data governance

• Efficient delivery of digital services

Conclusion

India is at a transformative stage in building a user-centric, secure, and scalable data-sharing ecosystem. By integrating best practices from the Account Aggregator model and ensuring the cohesive implementation of the DPDP Act, the country can lead globally in creating a robust consent-based data infrastructure.

Such a framework is essential to achieving the goals of data empowerment, individual autonomy, and trust in the digital economy in the 21st century.