Decoding consent managers under the Digital Personal Data Protection Act, 2023 : Empowerment architecture, business models and incentive alignment
Abstract
The Digital Personal Data Protection Act, 2023 (DPDP Act) represents a pivotal shift in India’s data governance framework, emphasising consent as the foundation of personal data processing. Within this landscape, consent managers emerge as critical intermediaries, addressing structural inefficiencies in data sharing, mitigating consent fatigue and enabling data portability. While earlier conceptualisations, such as Justice Srikrishna’s ‘dashboard model’, envisioned consent managers as passive facilitators of consent tracking, the Data Empowerment and Protection Architecture (DEPA) framework expands their role significantly. Under DEPA, consent managers function as intermediaries that facilitate seamless, interoperable data exchange between fiduciaries, thereby dismantling monopolistic data silos and fostering competitive innovation. Their viability, however, hinges on overcoming several economic and operational challenges, including the sustainability of business models, the resolution of the fee dilemma, and the incentivisation of fiduciary participation. This paper critically examines the consent manager ecosystem, exploring its potential to empower data principals through personalised consent management, behavioural nudges and privacy-preserving mechanisms. It further evaluates how reciprocity, cost savings and exemptions for inferred data could encourage large fiduciaries to engage in this ecosystem voluntarily. The analysis in this paper situates consent managers within the broader context of India’s Digital Public Infrastructure (DPI), arguing that their successful implementation could set a global precedent for decentralised, user-centric data governance. Achieving this requires regulatory clarity, standardised technical frameworks and robust market-driven solutions. By addressing these challenges, consent managers could serve as the keystone of India’s digital economy, balancing individual autonomy with technological innovation in an increasingly data-driven world. This paper is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
The full article is available to subscribers to the journal.
Author's Biography
Aditya Sushant Jain is a law student at Jindal Global Law School, India, specialising in the intersection of law, finance and technology. His expertise includes fintech regulations, data privacy and emerging technologies. Aditya has presented his research on global platforms such as the Global Fintech Fest and was the youngest scholar invited to advise government officials on digital competition at the 9th National Conference on the Economics of Competition Law, hosted by the Competition Commission of India. He is also involved in the technology-policy landscape of India and actively collaborates with think tanks.
