Archive · 19 May 2025
India's Account Aggregator Framework and Consent Managers
Imagine you want to share your financial data with different companies, like banks or investment firms.
Account Aggregators (AAs) are like your helpers, making sure you control who sees your data.
Under India’s new data law (DPDP Act), consent managers will do the same thing for all kinds of data, not just financial.
They'll help you give, change, or stop sharing your data.
The government is creating rules for these consent managers, and some experts suggest the rules should build on the successful AA system to make sure everything works well together.
This will help keep your data safe and give you more control.
India's Account Aggregator (AA) framework enables consent-based financial data sharing.
The AA framework is a multi-regulatory initiative led by RBI, SEBI, IRDAI, PFRDA, and the Ministry of Finance.
The Digital Personal Data Protection (DPDP) Act, 2023, introduces consent managers for data governance.
Draft DPDP Rules, 2025, outline the registration process and obligations of consent managers.
Industry experts propose revisions to the Draft Rules to ensure the effective implementation of the CM framework.
- Who
- The article discusses Account Aggregators (AAs), Consent Managers, and Data Principals.
- What
- The article discusses the Account Aggregator (AA) framework and its potential as a blueprint for Consent Managers under the DPDP Act.
- When
- The DPDP Act was enacted in 2023; draft rules were released in 2025.
- Where
- India
- Why
- To build a user-centric data governance regime and enable secure data sharing.
Industry Recommendations
Government Regulations
Sector-Specific Consent Managers
Industry Recommendations
Allow sector-specific consent managers with common APIs.
Government Regulations
Mandatory registration with the Data Protection Board (DPB).
Commercial Arrangements
Industry Recommendations
Permit commercial agreements with data fiduciaries to ensure healthy adoption and sustainable growth of an ecosystem of consent managers.
Government Regulations
Consent managers must operate in a fiduciary capacity in relation to data principals.
- AA Framework
- Multi-regulatory initiative
- AA Functionality
- Enables secure and real-time management of consents for financial information
- Consent Manager Role
- Data Principals give, manage, review, and withdraw consent
- DPDP Act
- Digital Personal Data Protection Act, 2023
- Draft DPDP Rules Authority
- Ministry of Electronics and Information Technology (MeitY)