ACCOUNT AGGREGATORS: THE BLUEPRINT FOR CONSENT MANAGERS UNDER INDIA'S DPDP ACT

With the passage of the Digital Personal Data Protection (DPDP) Act, 2023, and the release of the Draft DPDP Rules, 2025, the time is right to expand the AA framework to a broader data governance ecosystem by introducing Consent Managers (CMs).

- 

The techno-legal architecture of the consent manager regime aligns closely with the AA model, reinforcing the primacy of explicit and informed consent.

India's pioneering Account Aggregator (AA) framework has already demonstrated the transformative potential of consent-driven data-sharing in the financial sector.

Consent managers are envisaged as accessible, transparent, and interoperable platforms that act as a single point of contact for Data Principals (individuals) to give, manage, review, and withdraw their consents across a range of Data Fiduciaries. Drawing on our learnings from the AA ecosystem, we believe a collaborative and interoperable approach is required while designing and operationalising the consent manager framework under the DPDP Act.

The AA Framework: Enabling consent-based financial data sharing

The Account Aggregator (AA) framework is a multi-regulatory initiative led by the Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Authority of India (IRDAI), Pension Fund Regulatory and Development Authority (PFRDA), and the Ministry of Finance.

Operationalised through the RBI's NBFC-AA Master Directions in 2016, this framework empowers individuals to provide, review, manage, and withdraw consent for sharing their financial data.