https://claude.ai/artifact/PdPG8Pj4y75S9nczwSPtQA#play-15dd8cd198dd
===================================================
Consent Manager :
From “Dashboard for Data Owners” to “MyConsentApp”
Context :
Full-page advertisement :
“Consent is now law” … MyConsentApp
( Skorydov Systems Pvt Ltd, Mumbai ) …
Times of India / Mumbai Mirror / 28 Oct 2026
Extract ( paraphrased from the advertisement ) :
- MyConsentApp describes itself as a proposed Consent Manager under the DPDP Act 2023 and DPDP Rules 2025. It will apply for registration with the Data Protection Board.
- Through one interoperable platform, a Data Principal can give, manage, review and withdraw consent with any Data Fiduciary.
- Every consent, notice and withdrawal goes into an append-only, hash-chained ledger kept for seven years, so that any tampering can be detected.
- The advertisement explains the system as a cricket match:
- Side One : your business ( Data Fiduciary ) asks for consent
- Side Two : your customer ( Data Principal ) decides
- Score-keeper : the Consent Manager records everything but cannot read the personal data
- Umpire : the Data Protection Board of India
- Consent Manager registration opens on 13 Nov 2026. Every Data Fiduciary must be ready by 13 May 2027.
- From that date, penalties go up to ₹ 250 crore for failing to protect data, and up to ₹ 200 crore each for not reporting a breach or for violating the rules on children’s data.
- Their offering includes:
- consent purpose-by-purpose, never pre-ticked
- notices in English and 22 Indian languages
- works with other Consent Managers
- withdrawal reaches the business’s systems at once
- a dashboard for DPOs
- a mobile app for customers ( “coming soon” )
- free for individuals
- A business cannot be its own Consent Manager. The Consent Manager must have no conflict of interest [ s.6(9), Sch.1 Pt B ].
My Take :
Dear Shri Ashwini Vaishnawji,
On 04 Aug 2023, a day after the DPDP Bill was tabled in the Lok Sabha, I wrote to you ( Dashboard for Data Owners ). The next day I followed up with Consent Forms for Personal Data.
Three years later, that architecture is no longer a blog. It is a full-page newspaper advertisement, and a law with a deadline.
Let me compare what I suggested then with what is arriving now.
| My suggestion ( Aug 2023 ) | What has arrived ( Oct 2026 ) |
|---|---|
| A “USER DASHBOARD” link, prominently displayed, where a Data Owner can grant or revoke consent and correct, update or erase her data | Consent Managers give one place to give, review and withdraw consent. Erasure and correction requests are routed through it. A customer mobile app is “coming soon” |
| A Data Owner should fill her forms on only ONE portal ( that of a Consent Manager ) instead of thousands of websites | “One interoperable platform” to manage consent with any Data Fiduciary |
| I asked: if she switches Consent Managers, will she have to re-enter everything, or will the Board direct a transfer? | “Works with other Consent Managers.” Interoperability is now built into the Rules |
| A clear write-up below each form on how the data will be processed and used, and what service she gets in return | Purpose-by-purpose consent, never pre-ticked, with clear notices in 22 languages |
| The write-up cannot be changed without the Board’s prior permission | Every notice and consent version sits in a tamper-evident ledger for seven years. A change cannot happen silently |
| I presumed the Data Owner would pay a small fee | Free for individuals. The Fiduciaries pay |
I feel happy, but not yet satisfied. Some of my suggestions remain unaddressed.
( 1 ) Standardised Data Forms — still missing
In Aug 2023 I listed 10 Data Forms: Personal, Contact, Family, Social Media, Cultural Exposure, Education, Languages, Job Experience, Wealth & Income, and Medical History. I urged the Data Protection Board to design and mandate them.
Today each Data Fiduciary still decides what fields to ask. Each Consent Manager still decides how to present them. Purpose-by-purpose consent is good. But unless the data fields themselves are standardised, a shopping app can still ask for my date of birth “for a better experience”.
👉 The Board should notify a Standard Data Dictionary. For each category of Fiduciary ( bank, hospital, school, e-commerce, cab app, housing society ), it should specify the maximum set of fields it may request for a given purpose. Anything beyond that would need a separate, explicit, justified consent.
( 2 ) One Dashboard across ALL Consent Managers
Interoperability between Consent Managers is welcome. But a citizen may end up with consents spread across three or four Consent Managers.
👉 India already built the Account Aggregator rails for financial data, and DigiLocker for documents. Let the Board host ( or mandate ) a single Citizen Consent View: one screen, reachable through DigiLocker or UMANG, which shows every consent I have ever given, through any Consent Manager, to any Fiduciary. Each entry would carry a single “Withdraw” button.
That is the “Dashboard for Data Owners” I dreamt of: not one per company, but one per citizen.
( 3 ) The Paper Register Loophole
The advertisement honestly points out that the Act covers personal data collected digitally, or written on paper and later digitised. A paper visitor register is not covered.
In a country where every housing society, clinic and coaching class still runs on paper registers, and photographs them on a mobile phone, this is a grey zone that will be exploited.
👉 The Board should clarify that a photograph or scan of a paper register is “digitised”, and therefore covered.
( 4 ) What about the Data Owner’s DIVIDEND ?
In Released : Govt Policy for Selling Personal Data ( 05 Sept 2020 ) and Digital Dividend from Demographic Data – 4D ( 14 Feb 2019 ), I argued something simple. If my data has value to a Fiduciary, I should be able to license it, and not merely permit it.
The Consent Manager is now the perfect pipe for this. It knows exactly who asked for what data, for what purpose, and when. Today it records a “Yes / No”.
👉 Tomorrow it could record a “Yes, at this price”. Let the Board allow Consent Managers to offer an opt-in, voluntary data-licensing tier, where the citizen, and not just the platform, earns from her own data.
( 5 ) Voice for those who cannot read
Notices in 22 languages are excellent. But tens of crores of Indians cannot read any of them.
👉 Every consent notice should have a voice version in the citizen’s language. Consent by voice confirmation should also be valid, and recorded on the same hash-chained ledger.
Dear Ashwiniji,
When I wrote in 2023, I wondered whether hundreds of Consent Managers would crop up. Since then, TCS has sought a Consent Manager permit ( Jan 2026 ). Now a Mumbai start-up is taking full-page newspaper ads, three weeks before registration even opens.
The market has arrived. Before 13 Nov 2026, I urge the Board to consider:
- A Standard Data Dictionary for each category of Fiduciary
- A single Citizen Consent View across all Consent Managers, via DigiLocker / UMANG
- Clarifying that photographed or scanned paper registers are covered
- An opt-in data-licensing tier through Consent Managers
- Voice-based notices and consent for non-literate citizens
The score-keeper and the umpire are now in place. Let us make sure the batsman, the common citizen, also knows the score.
With regards,
Hemen Parekh
www.HemenParekh.ai / www.IndiaAGI.ai / 28 Oct 2026
Related Readings :
- Only Answer : a Statutory Warning … 10 Nov 2018
- SARAL ( Single Authentic Registration for Anywhere Login ) … 10 Feb 2019
- Digital Dividend from Demographic Data [ 4D ] … 14 Feb 2019
- Released : Govt Policy for Selling Personal Data … 05 Sept 2020
- Erasing Personal Data ? … 21 Apr 2023
- Dashboard for Data Owners … 04 Aug 2023
- Consent Forms for Personal Data … 05 Aug 2023
- Digital Consent Pilot : Vision Ahead … 26 Dec 2025
- TCS Seeks Consent Manager Permit … Jan 2026
No comments:
Post a Comment