In the booming digital economy of India, personal data collection is gaining massive scale. Be it digital onboarding, identity verification, or financial transactions – each phase generates data that businesses use to offer services, navigate risk, and make decisions. But, underneath the flow of information, lingers a core issue: when an individual permits a particular use of their data, can an organisation specifically confirm the point where that permission applies, how it is honoured, and what happens when it is withdrawn?
November brings this question into sharper focus. The registration framework for Consent Managers under the Digital Personal Data Protection (DPDP) Act, 2023, is slated to take effect this year, one year after notification of the Rules. With the broader Data Fiduciary obligations slated for May 2027 roll-out, businesses have a short window to move from the phase of processing the policy interpretation to developing operational preparedness. So, the discussion needs to shift from the compliance deadline to the infrastructure required for frictionless implementation.
Consent should become a continuous process
The DPDP framework puts consent at the centre of lawful personal data processing. This eventually makes the quality of consent as important as its collection. A tick box at the time of customer onboarding cannot ensure whether subsequent processing is in line with the original purpose.
Take, for instance, digital KYC. When an individual provides identity information to sign up for an account, that does not automatically permit the later use of the information. Actions like verification, fraud monitoring, service delivery, and sharing with partners have separate purposes and access requirements. Businesses need to develop clarity on which notice and consent supports each activity.
Therefore, the consent lifecycle spans actions such as capture, record, review, modification, and withdrawal. When an individual withdraws consent, the organisation should be in a position to identify the affected processing and propagate the change across relevant systems. Rights such as access, correction, erasure, and grievance redressal need defined workflows as well.
The accountability gap lies beyond the enterprise
The challenge compounds when personal data travels through vendors, cloud platforms, verification providers, analytics systems and business partners. A consent record can’t be sitting in one application when downstream systems continue processing the information without acknowledging a permission change.
This is where purpose mapping and data discovery come into play. Organisations must connect each category of personal data to its purpose, legal basis, processing activity, system, recipient, and retention requirement. An auditable record of when consent was obtained or withdrawn and which systems acted on that instruction is a prerequisite.
In addition, clear differentiation needs to be made between Data Fiduciaries and Data Processors. A Data Fiduciary determines the purpose and means of processing. Whereas a Data Processor handles data on its behalf. Outsourcing processing does not mean outsourcing accountability. Under the DPDP Act, Data Fiduciaries must set up appropriate contractual safeguards, monitor vendors, and ensure that processing abides by their instructions. Processors, meanwhile, need the technical controls and documented procedures to support these obligations.
One framework, different consent realities
Consent cannot be operationalised across sectors. In education and digital services used by children, businesses may require mechanisms for verifiable parental consent, alongside reliable age-related workflows and safeguards. The process is not simply about collecting a parent’s approval. It is about ensuring that the verification is credible and that the consent governs the intended processing.
Healthcare presents a different scenario. A patient’s information may move between hospitals, laboratories, specialists, caregivers, and digital health platforms. Each participant has a discrete role. Therefore, access should reflect the applicable purpose and authority. A single patient-facing consent screen is not enough to capture the entire chain.
So, there is a need for configurable, interoperable systems that accommodate sector-specific requirements without compromising the underlying principles of transparency, purpose limitation, and accountability.
From policy guidelines to working systems
The readiness gap is already visible. As per a survey of nearly 150 professionals mentioned in EY India’s January 2026 report, 77% of respondents identified adopting privacy technology in legacy environments as a challenge. On the other hand, 76.4% cited a lack of subject-matter expertise. The survey also found that 83% of organisations had not yet initiated implementation across relevant processes and systems. These findings suggest that operational compliance requires more than policy awareness.
Having said that, to set the ball rolling, businesses should initially develop a practical inventory of personal data, and mechanisms should be in place to screen where it resides, how it enters the organisation, who accesses it, which vendors receive it, and whether it crosses borders. Consent architecture, vendor assessments, retention controls, and workflows for exercising Data Principal rights need to be built. Technology can be leveraged to automate discovery, maintain consent records, and flag mismatches. But, at the end of the day, governance will determine who owns each decision and how exceptions are resolved.
The November timeline will kick off the transformation. Organisations need to use the phase to augment preparation for the May 2027 roll-out so that consent turns into enforceable controls across their data ecosystem. In a digital economy built on identity and data, a privacy notice cannot define trust. It must be demonstrable in the systems that use personal data. Businesses need to make consent work, not just at the moment it is given, but for as long as the data is processed.