Edition 2 | Lender's DPDP Digest

Hi there,

The second edition of the Lender’s DPDP Digest is here!

On 13 November (tomorrow!), Rule 4 of the DPDP Rules, which governs the registration of consent managers, comes into force.

There are a lot of misconceptions around what a consent manager does. In this edition, we’ll clarify how they work - purely based on what the DPDP Act envisages.

1. Your customer picks the consent manager, not you

Most lenders think that a “consent manager” is a software/entity that the lender must onboard, implement and purchase.

When you look at the DPDP Act closely, this does not seem to be the case.

The DPDP Act defines a consent manager as:

“A person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review or withdraw her consent through an accessible, interoperable platform”

The DPDP Act essentially casts a consent manager as an entity acting on behalf of the Data Principal i.e the borrower - and not the Data Fiduciary i.e the lender.

The platform itself must be interoperable.

So, the consent manager is chosen by the Data Principal. You do not select a provider and move your customers onto it. Your job is to support the one your borrower uses.

2. Practically, it will probably work something like an Account Aggregator

Practically, an interoperable platform chosen by the customer -  which the DPDP Act casts consent managers as - can happen via one of two ways:

1. Via a strong centralized public infrastructure rail which multiple entities can build upon - this is how UPI works
2. Via a shared set of protocols and API specifications which every software operating must follow - this is how Account Aggregators work

Since there is currently no centralized “UPI for consent”, the only way consent managers will work properly is via the second model - similar to Account Aggregators.

3. Account Aggregators are not consent managers

The previous insight gives rise to a common assumption that existing account aggregators will act as consent managers for lending operations.

This is not true for 2 reasons:

• An AA is limited to sharing of financial information while a consent manager needs to track consent across multiple categories of personal data.
• An AA is licensed by the RBI and works only between regulated financial entities (banks, NBFCs, insurers and others) while a consent manager is registered with the Data Protection Board and lets an individual manage their consent preferences across any company that processes their personal data.

4. Your borrower does not have to use a consent manager at all

The DPDP Act says a Data Principal may give, manage, review or withdraw her consent through a consent manager. It is an option for the borrower - not a requirement.

So most borrowers will likely keep giving consent directly to you - in your app, on your website or at your branch - just like they do today.

In practice, this means you will receive consent through two channels:

• Directly from the borrower, through your own consent journeys
• Through a consent manager, if the borrower chooses to use one

You need to collect, record and honour consent across both.

5. What a consent manager cannot do for you

A lot of lenders are making registration as a consent manager a mandatory condition for their DPDP Compliance vendors.

This does not make full sense because - as a Data Fiduciary - you have a lot of DPDP obligations that go beyond the remit of a consent manager:

• You have to actually take deletion/retention/withdrawal actions in your systems once a consent withdrawal/modification request is received. A consent manager cannot do this for you
• You have to retain data to meet regulatory requirements - but ensure such data does not get misused for other purposes. A consent manager cannot do this for you
• You need to report breaches within a specified timeline. A consent manager cannot do this for you
• You need to collect and store consent at the point of data collection. A consent manager cannot do this for you

So instead of asking your DPDP Compliance vendor whether they are a registered consent manager, ask them this:

Can your platform accept consents and withdrawals that come through any registered consent manager - and act on them across all our systems?

Your borrower - not you - decides which consent manager these requests come from. So your platform needs to work with all of them.

If you want to know more about what the Rules say about registration of consent managers, read our blog: https://www.consent.in/blog/consent-manager

See you next Thursday!