The Ministry of Electronics and Information Technology (‘MeitY’) has released a ‘Business Requirement Document for Consent Management under the DPDP Act, 2023’ (‘BRD’), detailing its proposed outline of the functional and technical requirements of consent management systems that align with the requirements of the Digital Personal Data Protection Act, 2023 (‘DPDP Act’).

The BRD sets out the entire lifecycle of user consent management – collection, validation, updating, renewal, and withdrawal. Key features under the BRD include real-time consent notifications, a user dashboard for tracking and modifying consents, comprehensive logging for auditability, and a grievance redressal mechanism with real-time status updates.

For stakeholders, the BRD is relevant as it provides a blueprint for establishing consent management systems. While integrating and utilising consent managers as envisaged under the BRD will simplify compliance obligations for data fiduciaries, the ultimate legal responsibility may still rest with the data fiduciary, and further clarity on the attribution of liability will need to be provided prior to implementation.