1. What is the Account Aggregator framework and who regulates it?

The Account Aggregator framework is a system regulated by the Reserve Bank of India that lets a customer share financial information held by one institution with another through a registered NBFC aggregator, on the customer's explicit consent. The RBI Master Direction on NBFC Account Aggregators, issued on 2 September 2016, sets the rules for aggregators. Banks, insurers, depositories and similar institutions provide the data, and lenders regulated by a financial sector regulator request it as users. The customer can revoke consent, and the aggregator does not hold the data.

Does an Account Aggregator consent artefact count as consent under the DPDP Act?

The Act and the Rules do not state that a consent artefact serves as DPDP consent, so a lender should keep the two as separate records. The artefact authorises the data request under the RBI direction. The lender's own processing needs a notice that meets Rule 3, which applies from 13 May 2027, and consent under Section 6 or another ground the Act allows. The practical step is to use the same purpose and data wording in both documents and store them together. Counsel can confirm the position for a specific lending product.

Is an Account Aggregator the same as a Consent Manager under the DPDP Rules?

No. An Account Aggregator is an NBFC registered with the RBI under the 2016 Master Direction, while a Consent Manager is an entity registered with the Data Protection Board under Rule 4 of the DPDP Rules, which applies from 13 November 2026. Both enable consent based data sharing through a regulated intermediary, and each carries a ₹2 crore threshold, measured as Net Owned Fund for an aggregator and as net worth for a Consent Manager. A consent management platform is a third category: software that a Data Fiduciary uses to manage its own notices, consents and records.

When do the DPDP obligations apply to lenders that use Account Aggregator data?

Rule 4 on Consent Managers applies from 13 November 2026, and Rules 3 and 5 to 16, which cover notice, security safeguards and breach intimation among other duties, apply from 13 May 2027. The RBI directions for Account Aggregators remain in force throughout. The Schedule to the Act sets penalties of up to ₹250 crore for failing to maintain reasonable security safeguards and up to ₹200 crore for failing to notify a personal data breach, so lenders benefit from aligning consent records and security controls before the 2027 date.

What should a lender do when a customer withdraws consent?

The lender should stop processing for that purpose within a reasonable time and instruct its Data Processors to stop, as Section 6(6) requires. Erasure follows under Section 8(7) unless another law requires retention. When the customer revokes through the aggregator, the lender should update the same internal record that a withdrawal through the notice link would update, and it should keep the notice version, the consent event and the withdrawal time as evidence.

DPDP and the Account Aggregator Framework for Lenders

See how consent moves through the Account Aggregator framework, what the DPDP Act adds for lenders and how Rule 4 Consent Managers differ from aggregators.

Lenders in India work with two consent systems during every loan journey. The Account Aggregator (AA) framework, created by the Reserve Bank of India (RBI), lets a customer share financial records, such as bank statements, with a lender through a regulated intermediary. The Digital Personal Data Protection Act, 2023 (DPDP Act) governs how every business, lenders included, handles personal data from collection to erasure. A lender that reads DPDP and the Account Aggregator framework together can design a single consent journey for loan origination that serves the customer, the credit team and the compliance team.

Scale makes this a practical topic. Sahamati data published by the Department of Financial Services shows 179 institutions live as data providers and 989 as data users as on 31 March 2026. More than 2.88 billion accounts were enabled for sharing. For FY26, Sahamati estimated AA enabled loan disbursals of ₹3.82 lakh crore across 3.68 crore loans, about 8.4% of retail and MSME lending by value. The sections below explain how consent flows through the AA framework and what the DPDP Act adds. A comparison of an Account Aggregator with a Consent Manager under Rule 4 follows, along with the records that support DPDP compliance for NBFCs and banks.

How Does the Account Aggregator Framework Move Financial Data With Consent?

The RBI issued the Master Direction on NBFC Account Aggregators on 2 September 2016, and its latest update is dated 6 September 2024. An Account Aggregator is a non banking financial company that retrieves a customer's financial information and presents it to the customer or to another authorised institution. Three participants make the arrangement work. The Financial Information Provider (FIP) holds the data. Banks, NBFCs, insurers, depositories and GSTN are among the institutions that act as providers. The Financial Information User (FIU) needs the data and must be registered with and regulated by a financial sector regulator, which covers most lenders. The Account Aggregator carries the request and the data between the two.

A typical loan assessment runs in six steps:

Account linking. The customer chooses an Account Aggregator and links the accounts to be made available for sharing.
Consent request. The lender, acting as FIU, asks for specified information for a stated purpose and period.
Customer decision. The customer approves, changes or declines the request. Approval creates the consent artefact, a digitally signed record. Paragraph 6.3 of the Master Direction specifies its contents, which cover the customer's identity, the nature and purpose of the information, the recipients and the validity dates.
Data release. The provider sends the data through the aggregator. The aggregator may not hold the data (paragraph 5.7) and may not support customer transactions (paragraph 5.3).
Use within the artefact. The lender may use the information only as the artefact specifies (paragraph 7.6.2).
Revocation. The customer can withdraw consent, including for part of the information (paragraph 6.6), and can view a record of consents given (paragraph 10).

For a credit team, the practical value is access to statements that arrive directly from the source institution, within limits the customer approved.

What Does the DPDP Act Add When a Lender Receives This Data?

The AA framework governs how data travels. The DPDP Act governs the lender from the moment personal data reaches its systems, because the lender decides why and how the data is processed and therefore acts as a Data Fiduciary, the term the Act uses for the responsible business.

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous. The individual gives it through a clear affirmative action for a specified purpose, and it covers only the personal data necessary for that purpose. Rule 3 requires the notice to itemise the personal data, state the purpose and describe the goods or services the processing enables, with a link for withdrawing consent and for exercising rights. Withdrawal must be as easy as giving consent (Section 6(4)), and processing must stop within a reasonable time once consent is withdrawn (Section 6(6)). Section 8(7) requires the lender to erase personal data, and to have its Data Processors erase it, once consent is withdrawn or the specified purpose is no longer served, unless another law requires retention. If consent is disputed, Section 6(10) places the burden of proving notice and consent on the Data Fiduciary.

Consider a lender that requests six months of savings account statements for a personal loan assessment. The artefact records the request and its validity period. The DPDP notice names the same data category and the same purpose in plain language, and the lender keeps the statements for credit assessment for as long as that purpose is served. Timing matters for planning: Rules 3 and 5 to 16 apply from 13 May 2027, and Rule 4 applies from 13 November 2026.

Account Aggregator or Consent Manager: Two Roles Under Two Rulebooks

Sections 6(7) to 6(9) of the Act create the DPDP Consent Manager role. A Data Principal, the individual whose data is processed, can give, manage, review or withdraw consent through a Consent Manager, which must register with the Data Protection Board. Consent Manager registration under DPDP follows Rule 4 and the First Schedule. The applicant must be a company incorporated in India with a net worth of at least ₹2 crore, and an independent certifier must confirm that its platform meets the standards published by the Board. Once registered, a Consent Manager must arrange sharing so that it cannot read the data, and it must keep consent records for at least seven years. The Consent Manager acts as a fiduciary toward the Data Principal and avoids conflicts of interest with the businesses it serves.

An Account Aggregator operates under the RBI. The aggregator is a registered NBFC with a minimum Net Owned Fund of ₹2 crore and a single purpose of consent based financial data sharing. Both roles share one idea: the individual controls the flow of data through a regulated intermediary. The registers differ, and so do the regulators and the measures of financial strength. Section 38 of the DPDP Act states that the Act applies in addition to other laws and prevails where a conflict exists. How the two intermediary models interact in practice is still a subject of legal commentary, so you can continue to run AA journeys under the RBI directions and follow guidance from the Board as it emerges.

One distinction helps in vendor discussions. A registered Consent Manager is a regulated entity. A consent management platform is software that a Data Fiduciary uses to run its own notices, consents and records.

A Consent Field Map for AA Led Lending Journeys

A field map links each element of the AA consent to a DPDP duty and a named owner. Your own review can use the seven rows that the OneConsent team applies to a lending journey:

Purpose. The artefact request and the DPDP notice carry the same purpose wording, for example "income assessment for a personal loan".
Data categories. The notice lists the categories requested through the AA, such as bank statements and deposit balances, so both documents describe the same data.
Duration. The artefact expiry date matches the retention rule in the lender's policy, with the Section 8(7) erasure trigger recorded beside it.
Withdrawal route. A customer can withdraw through the link in the notice or revoke through the aggregator, and both routes update one internal record and stop the processing.
Owner. Credit operations owns the purpose, compliance owns the notice and technology owns the logs.
Processors. An underwriting or analytics vendor that handles statements works under a valid contract (Section 8(2)), while the lender remains responsible (Section 8(1)) and passes erasure instructions down.
Evidence. Each record stores the notice version, the consent event and the artefact identifier with a time stamp, which gives the lender proof for the Section 6(10) burden.

Questions Lending Teams Raise During Reviews

Does the artefact replace DPDP consent? The Act and the Rules do not state that a consent artefact serves as DPDP consent. The artefact authorises a data request under the RBI direction. The lender's own use of the data needs a Rule 3 notice and a valid ground for processing, and recording both gives a complete trail. Counsel can confirm the position for your product.

What happens after the data is fetched? The lender holds the data as a Data Fiduciary, so retention and erasure follow the purpose limit and Section 8(7). Any other law that requires a lender to keep records is noted next to the field it affects.

Can the data support a second use? The artefact limits use to its stated purpose, and Section 6(1) requires consent for a specified purpose. A cross sell or a model training exercise is a separate purpose that needs its own notice and ground for processing.

A Readiness Checklist for Lending Teams

Your team can work through six checks before an internal or external review:

Journey inventory. List every point where the lender receives financial data, including AA requests, bureau pulls and uploads.
Purpose register. Record one specified purpose for each data category and name the owning team.
Notice alignment. Compare the notice text with the artefact request for each journey.
Withdrawal test. Run a withdrawal through the notice link and through the aggregator, and confirm that downstream systems stop within the lender's stated time.
Processor review. Check contracts and erasure instructions for every vendor that touches statements.
Evidence sample. Pull the record for one loan file and confirm it shows notice, consent, artefact and withdrawal history.

Technology That Supports DPDP Compliance for AA Led Lending

Spreadsheets handle a single journey, but a lender with several products, channels and partners needs a system that holds notices, consent events and withdrawals in one place. DPDP compliance software can store each notice version, link it to the consent given and pass withdrawal signals to loan origination, collections and marketing systems. A consent management platform built for DPDP can support multilingual notices, which matters for a customer base across states. OneConsent's consent audit trail module is designed to keep time stamped consent records that a compliance team can retrieve during an audit or a customer query. DPDP compliance solutions work best when your field map is complete, because the platform then enforces decisions that the business has already made. Technology supports compliance, and the organisation remains responsible for its duties under the Act.

Bringing AA Consent and DPDP Duties Into One Lending Journey

The DPDP Act and the Account Aggregator framework cover different stages of the same customer relationship. The AA framework gives the customer control over the transfer of financial data, and the DPDP Act gives the customer control over how the lender uses it. A lender that maps one to the other, row by row, ends up with a consent journey that is easier to explain to customers and easier to evidence to auditors. The OneConsent team works with lending, compliance and technology teams to map each AA consent point to a DPDP notice, a processing purpose and a retention rule. You can explore the OneConsent platform to see how consent records, withdrawals and audit evidence come together for BFSI teams, including banks, NBFCs and fintech lenders. A OneConsent demo session lets the team review your own origination journey with you.

DPDP and the Account Aggregator Framework: How Financial Consent Works for Lenders