Integrating the AA Framework with the DPDP Act

What’s in Today’s Article?

• India’s Consent Based Data Governance Latest News
• The AA Framework – Consent-Driven Financial Data Sharing
• The DPDP Act, 2023 – Broadening Consent Management
• Draft DPDP Rules, 2025 – Key Provisions and Recommendations
• Towards a Unified Data Ecosystem – The Way Forward
• Conclusion
• India’s Consent Based Data Governance FAQs

India’s Consent Based Data Governance Latest News

• India’s evolving data governance landscape is transitioning towards a consent-based data-sharing model that prioritizes user empowerment, transparency, and interoperability. 
• The Account Aggregator (AA) framework and the recently enacted Digital Personal Data Protection (DPDP) Act, 2023 both reflect this transformative shift.

The AA Framework – Consent-Driven Financial Data Sharing

• Key features:
  • A multi-regulatory initiative led by RBI, SEBI, Insurance Regulatory and Development Authority of India (IRDAI), Pension Fund Regulatory and Development Authority (PFRDA), and Ministry of Finance.
  • Operationalised under RBI’s NBFC-AA Master Directions, 2016, it enables secure, real-time, and machine-readable sharing of financial data (banking, loans, tax, investment, pensions).
  • It empowers users to give, manage, and withdraw data sharing consents, and currently functions at population scale, promoting efficiency, productivity, and customer-centric services.
• Significance of the framework:
  • It promotes digital economy, financial inclusion, data protection, and e-Governance.
  • It demonstrates inter-agency coordination and the move towards a data fiduciary model.

The DPDP Act, 2023 – Broadening Consent Management

• Core provisions:
  • Introduces Consent Managers (CMs) to enable individuals (Data Principals) to control their personal data across sectors.
  • Aligns with AA’s core principles – explicit, informed, and revocable consent.
  • Applicable across sectors: Health, education, employment, digital commerce, etc.
• Techno-legal architecture:
  • Emphasizes user-centric data flow.
  • Operates through intermediaries registered with the Data Protection Board (DPB).

Draft DPDP Rules, 2025 – Key Provisions and Recommendations

• Highlights of the draft rules:
  • Mandatory DPB registration: Ensures accountability and standardization across all CMs.
  • Sector-specific consent managers:
    • Supports domain-specific frameworks like the Financial Health Records (FHR) under National Health Authority (NHA).
    • Encourages innovation through interoperable APIs.
  • Commercial arrangements with data fiduciaries:
    • Allows sustainable business models for CMs.
    • Emphasizes that fiduciary duties toward Data Principals must not be compromised.
• Critical recommendations:
  • Avoid regulatory overlap with AA.
  • Ensure alignment between sectoral frameworks and the broader DPDP architecture.
  • Build a future-ready, unified consent infrastructure.

Towards a Unified Data Ecosystem – The Way Forward

• Synergy, not redundancy:
  • Leverage the maturity of the AA ecosystem to inform the rollout of the CM framework under the DPDP Act.
  • Promote interoperability and avoid parallel regulatory setups.
• Significance: This will reflect India’s approach to data sovereignty, digital empowerment, and governance reform.

Conclusion

• India stands at a crucial juncture in shaping a robust, user-centric data governance framework. 
• By integrating lessons from the AA model and ensuring coherence in implementing the DPDP Act, the country can pioneer a scalable, secure, and inclusive consent-based data-sharing infrastructure.
• This will be crucial for both digital inclusion and data protection in the 21st century.

India’s Consent Based Data Governance FAQs

Q1. What is the Account Aggregator (AA) framework and how does it empower data principals in the financial sector?

Ans. The AA framework, a multi-regulatory initiative operationalised by RBI in 2016, empowers individuals to securely give, manage, and withdraw consent for sharing their financial data in real-time with regulated entities.

Q2. How does the DPDP Act, 2023 build upon the principles of the AA ecosystem?

Ans. The DPDP Act institutionalizes a consent-manager-led regime across sectors, reinforcing explicit and informed consent mechanisms originally established by the AA framework.

‹ ›

Q3. Why is interoperability important in India’s consent manager ecosystem?

Ans. Interoperability ensures seamless, secure, and scalable data sharing across sectors and platforms, enabling innovation while safeguarding user consent and data rights.

Q4. What are the key recommendations proposed for the Draft DPDP Rules, 2025 to align them with the existing AA framework?

Ans. Key recommendations include mandatory DPB registration, sector-specific consent managers, and allowing commercial arrangements with data fiduciaries without compromising user trust.

Q5. What is the significance of integrating AA and CM frameworks for India’s data governance future?

Ans. A unified framework avoids regulatory overlap, strengthens user control over data, and lays the foundation for a robust, consent-based digital economy.

Source: TH