CONSENT MANAGEMENT UNDER DPDP ACT

Consent has always been treated as a procedural formality in the digital world, rather than a legal safeguard, leading to the enactment of the Digital Personal Data Protection Act (DPDP Act), 2023, which has made consent as its core regime. This paper assesses the legal architecture of consent under the DPDP Act, while examining the requirements of notice and consent under Section 5 and 6 of the Act. It also explores the concept of ‘Consent Managers’ which was introduced under Rule 4 of the DPDP Rules, which act as intermediaries between the data fiduciary and data principal. The paper also makes a comparative analysis with other countries, comparing consent standards around the world. The paper also identifies the overlap between the DPDP Act and the Consumer Protection Act, 2019 that concerns the manipulative consent practices. It concludes that the while the DPDP Act has a rigorous consent-based regime, it remains to be seen whether it can be executed and implemented efficiently in the real-world.