Lok Sabha Question No. 1655 (UNSTARRED), answered on 2025-07-30
Subject: API Checks for User Consent under DPDP
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Shri P P Chaudhary, Shri Chhatrapal Singh Gangwar, Smt. Smita Uday Wagh, Smt. Shobhanaben Mahendrasinh Baraiya

## GOVERNMENT OF INDIA

## MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 1655

TO BE ANSWERED ON: 30.07.2025

## API CHECKS FOR USER CONSENT UNDER DPDP

## 1655.   SHRI P P CHAUDHARY:

SHRI CHHATRAPAL SINGH GANGWAR:

SMT. SMITA UDAY WAGH:

SMT. SHOBHANABEN MAHENDRASINH BARAIYA:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether the Government proposes to implement a real-time Consent Application Programming Interface (API) mechanism to ensure valid user consent under the Digital Personal Data Protection (DPDP) Act, 2023;
- (b) if so, the implementation timeline for rolling out this API system for organizations handling personal data;
- (c) the manner in which the system is likely to ensure that users provide separate informed consent for each distinct data-processing purpose;
- (d) whether entities will be mandated to integrate the Consent API before initiating any processing of personal data; and
- (e) the details of the specific role and powers of the Data Protection Board of India in auditing, monitoring and enforcing compliance with consent protocols under the Act?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a) to (e): The Digital Personal Data Protection Act, 2023 ('the Act') is a technology -agnostic legislation that addresses the evolving digital landscape and its socio-economic implications with respect to the regulation of digital personal data.

It  establishes  a  rights-based,  consent-driven  framework  that  empowers  individuals  to  exercise control over their personal data.

Under the act, Data Fiduciaries must obtain informed consent before processing personal data for lawful purpose, including through APIs. The notice  to be provided by Data Fiduciaries, must clearly specify:

- What personal data is being collected
- Specific purpose for each personal data use;
- How users may exercise their rights (access, erasure, grievance redressal, nomination etc);
- Procedure  of complaints to the Data Protection Board.

The  Act  provides    Data  Fiduciaries  with  functional  flexibility  in  how  they  implement  legal obligations. This approach encourages innovation without compromising on its compliance.

In  addition  to  it,    individuals  may  give,  manage,  review,  or  withdraw  their  consent  to  Data Fiduciaries through a Consent Manager to be registered with the Data Protection Board.

The Act envisages establishing the Data Protection Board, a digital by design entity, with the following key functions:

- To give directions for remediating or mitigating data breaches
- To inquire into data breaches and complaints and impose financial penalties
- To refer complaints for Alternate Dispute Resolution and to accept Voluntary Undertakings from Data Fiduciaries; and
- To advise the Government to block the website, app etc. of a Data Fiduciary who is found to repeatedly breach the provisions of the Act.

Draft Digital Personal Data Protection Rules, 2025 (Rules), which seek to operationalize the Act have been published for public consultation.

********