OneConsent and PHDCCI Launch DPDP Readiness Initiative for Indian Businesses

What happened

On October 16, 2026, OneConsent and the PHD Chamber of Commerce and Industry held the DPDP Readiness Forum at PHD House in New Delhi. The Tribune reported that this event formally launched a partnership to prepare Indian businesses for the Digital Personal Data Protection Act, 2023. OneConsent, a consent management platform, sponsored the forum.

The joint initiative focuses on compliance practices, consent management, and data governance. PHDCCI Assistant Secretary General Mohit Luthra stated that industries must treat data protection as a core business priority as implementation nears. The partnership connects practitioners and experts to guide organisations through their impending legal obligations.

Does the DPDP Act apply here?

The Act regulates the processing of digital personal data. Consent management platforms process this data directly to manage user choices. Section 3 applies to personal data collected in digital form or digitised subsequently. Fintech operators use these platforms extensively to gather user data for payments and loan origination.

Account-aggregator APIs rely on these consent flows to function properly. Legal review is necessary when integrating third-party platforms to handle onboarding data. The Act excludes data processed for personal or domestic purposes. Financial services processing falls squarely under the regulatory scope.

Legal implications under DPDP

Under Section 4, consent is the primary basis for processing, except where Section 7 legitimate uses apply. The DPDP Rules, 2025 dictate that fiduciaries must provide itemised notices before obtaining this consent. A data fiduciary remains legally responsible for the personal data it collects.

Delegating consent collection to a third-party platform requires data processor contracts. General counsel must allocate liability carefully to protect the enterprise. If the platform fails to record a withdrawal of consent, the fiduciary faces the regulatory consequence. The Rules, 2025 also set specific mechanics for verifiable parental consent if the platform processes data of minors.

Could this happen to you

Fintech general counsel deal with rapid product cycles that often outpace legal review. RBI digital lending guidelines already demand strict data governance and transparency. If a consent platform suffers an outage or drops records, your regulatory defensibility vanishes. The Data Protection Board of India expects verifiable evidence of consent upon demand.

You need to know if your current onboarding sprint includes these mandated data trails. Indemnity clauses in vendor contracts protect the balance sheet, but they do not prevent an initial DPBI inquiry. Missing documentation exposes the firm to maximum penalties of Rs 250 crore. Relying on untested consent flows creates severe regulatory risk.

What companies should do in the next 30 days

1. Review all user onboarding flows for compliance with the DPDP Rules, 2025 itemised notice requirements.

2. Audit data processor agreements with consent management platforms to ensure strict liability limits and indemnity clauses.

3. Test the consent withdrawal mechanisms in current sprint cycles to confirm they halt data processing immediately.

4. Establish a secure audit trail for consent records that outside counsel can defend before the DPBI.

What to watch

Regulator engagement will increase as the DPBI issues further operational directives. Outside counsel spend will likely rise as enterprises test their safe harbour arguments regarding third-party processors. Legal heads should monitor how early enforcement actions treat consent platforms.

193 days remain until the DPDP hard compliance deadline of 13 May 2027. Test your onboarding flow defensibility and identify legal gaps with a free scan at https://www.complydp.com/audit-preview before the deadline.