The Ministry of Electronics and Information Technology has formally launched an online platform for registering consent managers within India’s data protection framework. The move follows the formal implementation of the registration regime required by the Digital Personal Data Protection Act. The portal has been recently launched, which allows the corporate entities intending to become consent intermediaries to apply electronically. This regulatory process has seen several administrative questions, mainly because the Data Protection Board of India, which is set up as a statutory authority to approve these applications, has not yet fully launched operations.
Role and function of consent managers
Consent managers are seen as registered intermediaries that would allow data principals to grant, control, contemplate, and retract their consent throughout a variety of platforms by means of a single interface.
These entities function much like a centralized consent protocol but are meant to fill the gap between users and data fiduciaries, and promote clear and user-controlled service.
Those seeking registration will be required to meet certain requirements, such as incorporation as a company under Indian law, as well as a threshold of net worth, and pledging not to store or access the underlying personal data in use of its system or services.
Institutional delays and strategic preparation for stakeholders
The Ministry of Electronics and Information Technology has taken a significant step towards this process by announcing the creation of the digital registration gateway, but the Data Protection Board of India as an institutional framework is one of the most pressing procedural hurdles.
The statutory body which is responsible for considering, accepting, or rejecting such applications for registration is not yet in full force of membership, nor is the Permanent Chair fully established.
Prospective companies can use the portal to check eligibility checklists, gather required documentation, and submit their applications; however, the non-active board means that the process is not yet properly adjudicated, meaning the companies can only wait and see what happens when the opportunity becomes available.
At the same time the portal was released, and it was not accompanied by a functioning regulatory board, technology companies and compliance officers find themselves navigating a complicated operating space.
To comply with the rigorous standards outlined in the regulations, enterprises must develop detailed technical architecture documents, financial statements, and governance policies in advance to be considered for participation in the consent management ecosystem.
Businesses may conduct readiness reviews internally and be able to compile the necessary documentation, but the absence of an operational adjudicatory or appellate board will likely delay final approvals until the regulatory board is full and says it is ready.
Conclusion
The Ministry of Electronics and Information Technology has launched a registration portal for the consent manager, which is a significant milestone in the implementation of India’s Data Protection regime. The establishment of the fully functional Data Protection Board of India has been delayed, marking a transition hurdle in regulatory implementation. While the process begins with potential entities lining up to submit applications and preparing compliance plans, maintaining a fully functional adjudicatory board is critical, as it offers clarity, streamlines application processing, and enables effective implementation of the country’s digital privacy laws.
Read the full article here