OBL-05: Consent Capture, Withdrawal & CM Registry
Governs affirmative consent lifecycles, withdrawal requests, and Consent Manager registration.
Statutory scope: Section 6; (9) CM registration; (10) fiduciary proof · Assigned to Product / privacy engineering · Systems: Consent Ledger & Policy Decision Point (SYS-010); Processor Orchestration Gateway & Queue (SYS-013)
Recommended interface: Replay an older grant after withdrawal; expected outcome is no reopening of the withdrawn purpose. CM registration remains a separately scoped actor condition.
Replay an older grant after withdrawal; expected outcome is no reopening of the withdrawn purpose. CM registration remains a separately scoped actor condition.
Governance & Architecture
Verification Specification & Workpaper
proposed per-row review/acceptance specification; not a claim of executed statutory coverage
populated hypothetical decision/specimen; not actual enterprise execution
Canonical Statutory Grounding
Source references verified against the official Gazette of India publication baseline.
Data Principal; Data Fiduciary; Consent Manager
Consent-based processing, withdrawal, CM registration, or disputed consent
Specific informed affirmative necessary-data consent; comparable ease of withdrawal; reasonable-time cessation with lawful exceptions; separate registration and burden of proof.
Invalid consent parts ineffective; prior processing remains lawful; s6(6) permits required/authorised non-consent processing.
Consent Manager
Seeking/holding statutory CM status
Every Consent Manager registered with Board under prescribed conditions.
Registration and rights-channel tranches differ.
Data Fiduciary
Consent basis questioned in a proceeding
Prove notice and consent in accordance with Act/Rules.
Not universally imposed on SDF alone.