TCS is all set to seek ‘consent manager’ permit under DPDP

Tata Consultancy Services (TCS) is preparing to apply for a ‘consent manager’ permit under India’s Digital Personal Data Protection (DPDP) rules, people aware of the development told ET.

Reliance’s Jio Platforms is already in the race for what is emerging as one of the country’s largest data-governance opportunities.

India’s new data protection regime is expected to create a Rs 10,000-crore compliance-as-a-service market over the next three years as businesses allocate resources towards privacy automation and services to comply with the norms, according to consulting firm EY India.


Of this, consent management alone could represent about 10%, or Rs 1,000 crore.

For TCS, consent management could be a scalable new revenue stream as enterprises look for end-to-end data governance solutions for data discovery, data mapping, compliance reporting, audit trails, breach management, etc.

TCS and Jio did not respond to ET’s queries till press time on Sunday.

According to Mini Gupta, partner, cybersecurity consulting, at EY India, there are two distinct opportunities – consent management technology providers and government-empanelled consent managers.

“One is a consent management technology for which we have had players globally…that data controllers, or now data fiduciaries in India, can procure and opt for, to manage consents,” she said, adding that this alone represents a large addressable market, given the volume of data fiduciaries in India.

The second model is for empanelled consent managers, which will operate as neutral intermediaries between individuals and companies. “Albeit with associated risks, there is a great opportunity here, given that this will be backed by the government and act as an independent layer for trust and transparency. Early players stand to gain more market penetration,” she said.

Under the DPDP Act, a consent manager is a registered entity operating a neutral, interoperable, privacy-enabled platform that allows users to give, review, modify or withdraw consent for data fiduciaries.

As per Data Protection Board norms, applicants must be companies incorporated in India with a minimum net worth of Rs 2 crore to qualify as consent managers.

The IT ministry has shortlisted six Indian firms under its ‘Code for Consent’ challenge to demonstrate proof-of-concept solutions: Jio Platforms, Baldor Technologies (IDfy), VertexTech Labs (Redacto), Quagga Tech (Zoop), Concur, and Aurelion Future Forge.

EY’s Gupta explained that the interoperable nature of consent managers could allow them to operate across industries. “This will get them access to identity tokens of users across sectors (such as) BFSI, health and telco platforms.”

On the commercial side, Gupta said pricing is likely to be hybrid, especially for large enterprises. “It can be a base fee for platform access, consent lifecycle management and bare minimum dashboards,” she said. “Then a usage-based fee per consent transaction, for enabling consent-based data sharing between multiple fiduciaries, and for any value-added services.”

She cautioned that DPDP rules do not allow consent managers to freely monetise personal data. But the law does not prohibit aggregated, anonymised insights or monetisable services built on metadata.