Consent Artefact
A machine-readable record of a consent: who gave it, to whom, for what purpose and for how long.
A consent artefact is a digital record of a single consent: who gave it, to whom, for what purpose, which data and for how long. It lets everyone, including the person, check later exactly what was agreed.
Meaning of Consent Artefact
The term comes from India's data-sharing frameworks such as the Account Aggregator system. The DPDP Act does not use the term, but the idea is useful: a verifiable record of each consent that can be shown if challenged.
The term comes from India's data-empowerment architecture, especially the Account Aggregator framework regulated by the RBI for financial data, where a consent artefact is a structured, digitally signed, machine-readable document. It specifies the data requester, the data provider, the type and date range of data, the purpose, the duration, and rules about further use. The DPDP Act does not use the phrase, but the same idea sits behind the requirements of Section 6.
Why it fits: Section 6(1) requires consent to be specific and limited to the data necessary for the specified purpose, and Section 6(10) puts on the Fiduciary the burden of proving that a notice was given and consent was obtained properly. A consent artefact is a way to make that proof concrete. It should link to the notice version, the purpose, the action taken, a timestamp, the channel and the current status: active, expired or withdrawn.
The Rules also expect records. For a Consent Manager registered under Rule 4, the First Schedule requires keeping records of consents given, denied or withdrawn, and notices, for at least seven years. Organisations without a Consent Manager are not told a specific format, but they will need an equivalent evidence trail to meet Section 6(10) and to answer rights requests and complaints under Sections 11 to 13.
A consent artefact is not the same as a consent form or a banner. The form or banner is how consent is requested; the artefact is the durable record created when the person says yes. It is also different from a consent log entry that merely says "opted in": a good artefact captures enough detail to be read by another system, to be shared with the person and to be tested for validity.
Examples of Consent Artefact
A lender stores a record showing the borrower consented on a specific date to share bank statements for loan assessment for 90 days.
A borrower agrees to share six months of bank statements for a loan assessment valid for 90 days. The lender stores an artefact with those terms. After 90 days the status flips to expired, and the system blocks further pulls.
A patient approves sharing her lab report with a named specialist for a single consultation. The artefact records the report type, the doctor, the purpose and the date. The platform denies a second doctor's request that has no matching artefact.
A customer gives separate consents for quote comparison and for renewal reminders. The broker stores two artefacts. When she withdraws the reminders, only that artefact changes, and quote-related processing continues as before.
Why Consent Artefact matters
When consent is challenged, the first question is what the person actually agreed to. Without detailed artefacts, organisations rely on memory or on a generic database flag, which rarely survives scrutiny. Because Section 6(10) puts the burden on the Fiduciary, inability to produce records can lead to a finding that consent was not obtained, with a penalty exposure of up to ₹50 crore.
Artefacts also enable good operations: downstream systems can check scope and expiry before using data, withdrawals can be propagated to processors, and consent can be tied to automatic deletion when the purpose period ends under Section 8(7). For people, a readable record is a practical route to review and withdraw what they have allowed.
How it works in practice
- 1Define a standard record format with fields for person ID, Fiduciary, purpose, data categories, notice version, timestamp, channel, expiry, status, and evidence reference, and use it across all channels.
- 2Create the artefact at the moment of the clear affirmative action, not afterwards in a batch, and sign or hash it so that later tampering would be detectable.
- 3Have each data-using system check the artefact, or a status API, before processing: is the purpose in scope, is the consent live, has it expired.
- 4Update the status on withdrawal, expiry or purpose change, but keep the history. A withdrawn artefact is still evidence of what happened before.
- 5Set retention and access rules for artefacts, protect them with encryption and logs under Rule 6, and let the person view her own records through a self-service page.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Keeping only a yes or no flag. Record the purpose, notice version, time and channel as well, or you cannot show what the person saw.
One artefact for all purposes. Granular records let a person withdraw one purpose without losing the rest.
Overwriting records on change. Keep history, with a new entry or status event for each update.
Leaving artefacts unprotected. They link people to their choices and sometimes to sensitive services, so they need real security.
Compliance tips
Pick a schema early and keep it stable; rebuilding records across systems later is slow and error-prone.
Make artefacts readable by humans as well as machines, with a plain summary line next to the technical fields.
Test restore and retrieval: ask for the full record of five random users and time how long it takes.
If you plan to work with a registered Consent Manager, check which format it uses, so your records can interoperate.
Common questions about Consent Artefact
Is a consent artefact required by the DPDP Act?
The Act does not use the term or prescribe a format. It does require valid consent and puts the burden of proof on the Fiduciary under Section 6(10), so a reliable, detailed record of each consent is the practical way to meet that duty.
Where does the idea of a consent artefact come from?
It comes from India's data-sharing frameworks, notably the Account Aggregator system for financial data regulated by the RBI, where a digitally signed, machine-readable record sets out who may access which data, for what purpose and for how long.
How long should consent records be kept?
The Act has no single period for ordinary Fiduciaries. For registered Consent Managers, the Rules require records for at least seven years. Other organisations should choose a period that covers likely disputes, audits and limitation periods, document the reasoning, and delete records once that need ends.