Consent Manager (India DPDP) — India DPDP Act
Was ist Consent Manager (India DPDP)?
Dieser Eintrag liegt derzeit nur auf Englisch vor.
A Consent Manager is the registered intermediary defined by India's DPDP Act 2023 through which a data principal gives, manages, and revokes consent. It issues tamper-evident, Kantara-style signed Consent Receipts — ECDSA P-256 signatures over canonical JSON. Orbit verifies each receipt's signature against the manager's registered public key before anything persists; a failed check returns 422 CONSENT_RECEIPT_INVALID, while structurally degenerate receipts fail earlier as 422 VALIDATION_ERROR.
More detail
Orbit models the Consent Manager directly in your tenant-owned consent registry — you register the manager and its public key, and the platform verifies each receipt's signature before it stores anything. That register-first check is what makes a failed verification a tenant-resolvable signing-mismatch rather than a platform bug.
India's DLT regime uses a 'Consent Manager' concept of its own for sender and entity registration on the per-carrier ledger — a different thing entirely. The DPDP meaning here is the data-protection intermediary issuing signed receipts, so keep the two regimes distinct when wiring India compliance.
Häufige Fragen
- Is a Consent Manager the same as DLT?
- No. DLT is India's telemarketing registration framework (entity, header, and template records on a per-carrier ledger); a DPDP Consent Manager is the data-protection intermediary that issues signed Consent Receipts. Both matter for India, but they govern different regimes and both are registered as tenant-owned controls in Orbit.
- Why do receipts need register-first verification?
- Orbit keeps each receipt untrusted until it checks the ECDSA P-256 signature against the manager's public key in your tenant-owned registry. Only receipts that verify are stored as consent; the rejected ones return 422 CONSENT_RECEIPT_INVALID, so you resolve the signing mismatch instead of getting silent bad data.
- What does 'structurally degenerate' mean?
- A receipt missing required fields or carrying malformed JSON fails the payload-shape validation before any signature check runs, and Orbit returns 422 VALIDATION_ERROR. Signature verification only runs on a receipt that passed shape validation, so 422 CONSENT_RECEIPT_INVALID means the receipt was well-formed but the signed bytes did not match the registered public key.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.