Introduction
One of the most important features of India’s Digital Personal Data Protection (DPDP) framework is the introduction of Consent Managers.
These entities are intended to give individuals greater control over how their personal data is processed by different organisations.
But an interesting legal question arises when an individual uses a Consent Manager:
Who owns the consent record?
Does it belong to the individual who gives consent? Does the Data Fiduciary own it because it relies on that consent? Or does the Consent Manager own it because the record is maintained on its platform?
The DPDP Rules, 2025 provide important answers concerning the maintenance, accessibility and retention of consent records. However, it is equally important to distinguish between ownership of data and statutory responsibility for maintaining records.
1. What exactly is a consent record?
A consent record is evidence of the consent-related activities undertaken by a Data Principal.
It may contain information about:
- Consent given by an individual.
- Consent denied by an individual.
- Consent subsequently withdrawn.
- Notices provided before or along with consent requests.
- Sharing of personal data with another Data Fiduciary.
These records are important because they help establish the history of an individual’s consent decisions.
For example, suppose an individual uses a Consent Manager to provide consent to a financial institution to access specified financial information.
The Consent Manager maintains a record of the consent request, the accompanying notice and the resulting sharing of personal data.
If the individual subsequently withdraws consent, that withdrawal must also form part of the relevant record.
2. What do the DPDP Rules require?
Part B of the First Schedule to the DPDP Rules, 2025 specifically addresses the recordkeeping obligations of Consent Managers.
Item 3 requires a Consent Manager to maintain records on its platform relating to:
- Consents given, denied or withdrawn by the Data Principal.
- Notices preceding or accompanying requests for consent.
- Sharing of personal data with a transferee Data Fiduciary.
This is not merely an optional business practice.
It is a specific regulatory obligation.
The Rules also require the Consent Manager to provide the Data Principal access to these records.
3. Who has access to the records?
Item 4 of Part B of the First Schedule imposes three important obligations.
First, the Consent Manager must provide the Data Principal access to the relevant records.
Second, upon the Data Principal’s request and in accordance with its terms of service, the Consent Manager must make the information contained in those records available in machine-readable form.
Third, the Consent Manager must maintain the records for at least seven years.
A longer period may apply where:
- The Data Principal and Consent Manager agree to a longer period; or
- A longer retention period is required by law.
These provisions are important because they ensure that the individual is not entirely dependent on the Data Fiduciary’s internal systems to review their consent history.
4. Does the Consent Manager own the record?
This question requires a distinction between custody, control, access and legal ownership.
The DPDP Rules require the Consent Manager to maintain the consent records on its platform.
However, they do not expressly declare that the Consent Manager becomes the proprietary owner of those records.
Equally, the Rules do not establish a general proprietary ownership regime under which every consent record is automatically owned by the Data Principal.
The statutory position is more precise:
- The Consent Manager has the obligation to maintain the specified records.
- The Data Principal has a right to access those records.
- The Data Principal can request the information in machine-readable form.
- The Data Fiduciary remains responsible for its own compliance with the Act.
Therefore, maintaining a record should not be confused with acquiring unrestricted ownership rights over the information contained in it.
The contractual terms of the Consent Manager may address certain operational and intellectual property issues, but they cannot override statutory obligations.
5. What happens to the Data Fiduciary’s records?
The involvement of a Consent Manager does not remove the Data Fiduciary’s responsibilities.
Under the DPDP Act, a Data Fiduciary remains responsible for compliance with the Act in respect of processing undertaken by it or on its behalf.
Consider the following example.
An individual uses a Consent Manager to provide consent to an insurance company for processing certain personal information.
The Consent Manager records the consent and facilitates the relevant process.
The insurance company must still ensure that its processing activities are supported by the applicable legal basis and comply with its obligations under the Act.
It cannot simply argue that the Consent Manager maintained the consent record and therefore all compliance responsibility has shifted to that platform.
The two entities have distinct responsibilities.
6. Why does the seven-year retention period matter?
The minimum seven-year retention requirement has significant practical implications.
Consent disputes may arise long after the original consent was provided.
For example:
- An individual may dispute whether consent was ever given.
- An organisation may need to establish the notice accompanying a consent request.
- An individual may question whether withdrawal was properly recorded.
- A dispute may arise regarding the sharing of personal data with another organisation.
A reliable historical record can help clarify what actually happened.
However, record retention must also be considered alongside applicable data protection obligations.
The Consent Manager must maintain appropriate security safeguards and ensure that personal data is not made accessible to unauthorised parties.
7. What should organisations consider?
Businesses integrating with Consent Managers should clearly define their respective responsibilities.
Their agreements and operational arrangements should address:
- Responsibility for creating and maintaining consent records.
- Accuracy and synchronisation of consent information.
- Procedures for recording withdrawal.
- Access to records for individuals.
- Machine-readable record availability.
- Security and confidentiality.
- Incident reporting and cooperation.
- Retention and lawful deletion requirements.
These arrangements should also ensure that a Consent Manager’s technical failure does not result in an inability to establish the relevant consent history.
Conclusion
The DPDP framework does not treat the Consent Manager as the unrestricted owner of an individual’s consent history.
Instead, it places specific obligations on the Consent Manager to maintain records, provide individuals with access and preserve the records for at least seven years.
The Data Fiduciary, meanwhile, continues to remain accountable for its own processing activities.
The important legal distinction is that custody of a consent record does not automatically translate into ownership of the information or transfer of statutory responsibility.
