Data Empowerment and Protection Architecture
Also called: DEPA · Topic: Transparency, Accountability and e-Governance · NCERT: Beyond NCERT
Meaning
The Data Empowerment and Protection Architecture (DEPA) is India's design for sharing personal data only with the person's consent. It places a consent manager in the middle. A consent manager is a go-between that lets you give, check and take back permission before your data moves from one body to another. Because every consent follows one standard digital format, different platforms can read each other's requests. This is called being interoperable. DEPA is the consent layer of India Stack, and it matters because it aims to put individuals, not companies, in control of their data.
Example
The RBI's Account Aggregator system, run under its 2016 Directions, puts DEPA into practice. A loan applicant can let a lender pull their statements from another bank. The data moves only after the applicant gives explicit consent through a standard "consent artefact", which is a digital record of what is shared, with whom and for how long.
Don't confuse with
- Consent manager under the DPDP Act 2023: this is a legal entity that must be registered with the Data Protection Board of India and works across all sectors. DEPA is the design idea behind such systems, not a body or a law.
- Digital Personal Data Protection Act 2023: this is the law that sets data rights, duties and penalties. DEPA is a technical design for consent-based sharing, not a law.