Introduction
One of the interesting questions emerging from India’s Digital Personal Data Protection (DPDP) framework is whether the same company can operate as both a Data Fiduciary and a registered Consent Manager.
At first glance, there may not appear to be a problem. A technology company may already collect and process personal data for its own business while also developing a platform that allows individuals to manage consent across different organisations.
However, the two roles have fundamentally different responsibilities.
A Data Fiduciary determines the purpose and means of processing personal data. A Consent Manager, on the other hand, is intended to facilitate the individual’s control over consent.
This difference raises an important question about independence, commercial interests and conflicts of interest.
1. Understanding the two roles
Under Section 2 of the DPDP Act, 2023, a Data Fiduciary is a person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data.
For example, a bank collecting customer information to provide banking services acts as a Data Fiduciary.
Similarly, an e-commerce company collecting customer details to process orders and provide services may act as a Data Fiduciary.
A Consent Manager has a different statutory function.
It acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent.
For example, an individual may use a Consent Manager to manage consent requests received from different banks or financial service providers.
The distinction is important because a Data Fiduciary seeks consent for its processing activities, whereas a Consent Manager facilitates the individual’s management of that consent.
2. What do the DPDP Rules say about dual roles?
The answer requires careful reading of Rule 4 and the First Schedule.
The Rules do not expressly state, in a standalone provision, that a company acting as a Data Fiduciary is absolutely prohibited from applying for registration as a Consent Manager.
However, this does not mean that the same company can freely combine both functions without regulatory concerns.
Part B of the First Schedule imposes specific obligations on registered Consent Managers.
Most importantly, the Consent Manager must:
- Act in a fiduciary capacity in relation to the Data Principal.
- Avoid conflicts of interest with Data Fiduciaries, including their promoters and key managerial personnel.
- Maintain measures to prevent conflicts arising from directors, key managerial personnel and senior management having directorships, financial interests, employment, beneficial ownership or material pecuniary relationships with Data Fiduciaries.
These requirements demonstrate the importance of independence in the Consent Manager’s functioning.
3. Why is independence important?
Imagine a company operating a large digital lending platform.
It collects personal information from customers, assesses loan applications and processes customer data for its lending business.
The same company also wants to operate a Consent Manager platform.
Now consider a situation where the lending business wants to obtain consent from an individual to share financial information with another service provider.
If the same corporate entity controls both the lending business and the consent-management platform, questions may arise about whether the individual is receiving a genuinely independent consent-management service.
The individual may reasonably question whether the platform is facilitating their choices or indirectly advancing the company’s commercial interests.
This is precisely the kind of governance concern that the conflict-of-interest provisions seek to address.
4. Does the law completely prohibit common ownership?
It is important not to overstate the legal position.
The Rules specifically address conflicts arising from relationships involving directors, key managerial personnel and senior management, and require the Consent Manager to avoid conflicts with Data Fiduciaries.
They also require disclosure of specified ownership and management information.
However, the Rules do not contain a simple blanket statement that every company having a Data Fiduciary business is automatically disqualified from Consent Manager registration.
The question must therefore be examined against the actual structure, control, management, financial relationships and proposed operations of the applicant.
A corporate structure cannot be treated as compliant merely because two activities are placed in separate departments or under different brand names.
The regulatory concern is substantive independence, not simply organisational labelling.
5. Can a separate subsidiary solve the problem?
A company may consider establishing a separate subsidiary to operate the Consent Manager platform.
This may help create operational separation, but it does not automatically eliminate conflict-of-interest concerns.
For example, if the parent company controls both businesses, appoints the relevant management and has financial interests in the Data Fiduciary business, the relationship must still be examined under the First Schedule.
The Consent Manager must have appropriate measures to prevent conflicts arising from the specified management and financial relationships.
Furthermore, the applicant must satisfy the independent registration requirements, including the financial threshold, governance requirements and certification of its interoperable platform.
Simply incorporating a new company does not guarantee regulatory eligibility.
6. What should companies consider before entering this business?
Businesses considering Consent Manager registration should examine the following:
Corporate structure: Identify all group entities and their respective data-processing activities.
Management independence: Examine directors, key managerial personnel and senior management relationships with Data Fiduciaries.
Financial relationships: Review shareholding, beneficial ownership and other material pecuniary relationships.
Operational separation: Establish independent decision-making, access controls and governance procedures.
Conflict management: Adopt documented policies to identify, prevent and address actual or potential conflicts.
Regulatory disclosures: Ensure that ownership and management disclosures required by the First Schedule are accurate and accessible.
These steps are particularly important for financial institutions, digital lending platforms, technology companies and large consumer-facing businesses.
Conclusion
The DPDP framework places considerable importance on the independence of Consent Managers.
Although the Rules do not impose an express blanket prohibition on every possible dual-role corporate arrangement, their conflict-of-interest requirements make the question legally and commercially significant.
Companies considering both activities must carefully examine their corporate structure, management relationships and operational independence before proceeding.
The larger principle is straightforward: a Consent Manager must function in the interests of Data Principals, rather than becoming merely another business channel for organisations seeking to process personal data.
