A dashboard can look impressive when a product is shown. It might show thousands of users consent requests, withdrawal statistics and data‑sharing transactions.
There is a more important question that a regulator, auditor or compliance professional would ask:
Can the Consent Manager prove that the consent‑management process actually worked?
Under India’s Digital Personal Data Protection Rules, 2025 a Consent Manager is not expected to give people an interface. The rules also give a lot of importance to record keeping, transparency, security, independence and audit mechanisms.
This means that a dashboard should be built as an evidence‑management system, not a reporting tool.
- Proof of registration and regulatory eligibility
The first thing an audit should check is whether the entity is legally allowed to operate as a Consent Manager.
The dashboard or its associated compliance repository should enable the organisation to demonstrate:
- Its registration status with the Data Protection Board of India.
- Its eligibility under Part A of the First Schedule.
- Its minimum net worth requirement of ₹2 crore.
- Its financial and operational capacity.
- The certification of its platform.
- The relevant corporate and management disclosures.
An organisation should not rely on a presentation or an internal declaration for proof of registration.
The underlying registration and supporting documents should be easily accessible.
- Proof of consent transactions
The important operational evidence is about consent itself.
Consider a customer who gives consent to a healthcare platform to process data for a specific purpose.
An auditor should be able to establish:
- Which Data Principal gave consent?
- Which Data Fiduciary received it?
- What was the purpose?
- When was the consent given?
- Through which platform was it communicated?
- What action did the take?
- Was the consent subsequently modified or withdrawn?
The system should keep a chronological record of these events.
A simple entry that says “Consent received: Yes” is not enough to show the whole transaction history.
The record should let an auditor rebuild what happened.
- Proof of consent withdrawal
Withdrawal is one of the important features of a Consent Manager.
Suppose an individual withdraws consent through the Consent Manager. The related Data Fiduciary keeps processing personal data for the same consent‑based purpose.
A dashboard that only records the withdrawal request cannot prove that the process finished successfully.
The audit should examine:
- When the withdrawal request was initiated.
- Whether the request was. Recorded.
- When it was transmitted to the Data Fiduciary.
- Whether acknowledgement was received.
- Whether the Data Fiduciary updated its records.
- Whether any technical or operational failure occurred.
- Whether the matter remained unresolved.
It is important to distinguish between the Consent Manager’s responsibility to facilitate withdrawal and the Data Fiduciary’s responsibility under the Act to stop consent‑based processing within a time subject to applicable legal exceptions.
- Proof of data‑sharing records
The First Schedule requires Consent Managers to keep records about consent and sharing of data through their platforms.
An audit should therefore check whether the organisation can find the parties, the nature of the recorded transaction its purpose and the related timestamps.
A useful dashboard should also allow you to trace a transaction without looking through thousands of unrelated entries.
The goal is traceability.
- Proof of access
Can an individual access their consent records?
Can they get the information in a form when asked following the applicable terms of service?
These are questions under Part B of the First Schedule.
The dashboard should demonstrate:
- Record‑access requests received.
- Requests successfully fulfilled.
- Requests pending.
- Machine‑readable exports generated.
- Failures and reasons, for failure.
A system that keeps records but cannot give access to them defeats an important purpose of the framework.
- Proof of security safeguards
Consent Managers must take security safeguards to stop personal data breaches.
An audit should not stop at checking whether the organisation has an information‑security policy.
It should examine evidence of implementation including:
- Access‑control arrangements.
- Authentication mechanisms.
- Security monitoring.
- Incident records.
- Vulnerability management.
- Backup and recovery arrangements.
- Security. Remediation.
I think the organisation must show not what its security policy states but also how those controls actually work.
- Proof of independence and conflict management
I believe a Consent Manager must act in a capacity towards the Data Principal and must avoid conflicts of interest with Data Fiduciaries.
This requires more than a declaration signed by the directors.
The audit should examine ownership disclosures, management relationships, financial interests, employment arrangements and other relevant relationships.
The dashboard or compliance repository should identify conflicts the review undertaken and the action taken to address them.
- Proof of audit and corrective action
I feel Part B of the First Schedule requires audit mechanisms that review, monitor evaluate and report audit outcomes to the Board on a basis and whenever directed.
The organisation should maintain an audit trail containing:
- Audit scope and methodology.
-. Observations.
- Risk classification.
- Corrective action plans.
- Persons.
- Target dates.
- Closure evidence.
An audit finding should not simply vanish just because someone marks it as “closed”.
There must be supporting evidence.
Conclusion
I ask that a Consent Manager dashboard must answer one question: can the organisation prove that every important obligation is being carried out?
I think an attractive dashboard may impress management but an evidence‑based dashboard can stand up to regulatory scrutiny.
For Consent Managers the difference, between displaying compliance and proving compliance will become increasingly important.
I believe the strongest compliance dashboard is not the one that shows the metrics. It is the one from which an auditor can independently piece together what happened, when it happened, who was responsible and what was done when something went wrong.
