March 11, 2025

New Code of Ethics For Fantasy/Real-Money Gaming: Key Highlights

New Code Of Ethics In India’s Fantasy Gaming Industry

The fantasy gaming industry in India has reached a significant milestone with the introduction of a Code of Ethics (CoE), signaling a move towards more responsible and accountable practices. This set of guidelines prioritises user safety, fairness, and compliance with regulatory standards. Developed through a collaborative effort by key industry organisations—such as the All India Gaming Federation (AIGF), the Federation of Indian Fantasy Sports (FIFS), and the E-Gaming Federation (EGF)—the CoE aims to foster a gaming environment that is both ethical and secure. The goal is to ensure that gaming practices in India are fair, responsible, and aligned with the highest standards of integrity.

Why Is A Code Of Ethics Important For Fantasy Gaming In India?

As the gaming industry in India grows, it faces an increasing need to establish standardised regulations. The adoption of a Code of Ethics helps address several concerns related to fraud, addiction, underage gaming, and fair play. By setting clear guidelines, this code aims to foster trust in the industry and ensure the long-term sustainability of online fantasy sports platforms. The Code also sets the foundation for future regulation, helping avoid potential legal hurdles and aligning with international best practices.

Key Guidelines Of India’s Code Of Ethics For Responsible Gaming

Age Verification And Kyc For Fantasy Gaming Platforms

One of the core elements of the Code of Ethics is the strict enforcement of age verification and KYC (Know Your Customer) procedures. All fantasy gaming platforms must verify the identity and age of users before they can participate in real-money gaming. This is achieved through the submission of official documents like government-issued IDs (e.g., Aadhaar, passport, or driver’s licence). Age restrictions are essential for preventing underage gambling, a rapidly growing concern in the sector.

User Spending Limits To Encourage Responsible Gambling

In a move that prioritises financial responsibility, the Code of Ethics mandates the implementation of user-defined spending limits on gaming platforms. These limits help players control their spending habits and avoid excessive gambling. Platforms will now be required to allow users to set daily, weekly, or monthly spending caps to ensure that players do not risk more money than they can afford to lose.

Enforcing Ethical Practices Through Audits And Annual Compliance

To ensure that platforms are adhering to the new standards, the Code of Ethics introduces the requirement for regular third-party audits. These audits will help assess the compliance of platforms with key ethical standards such as KYC processes, age verification, and spending limits. Platforms with significant revenues will need to comply with these audits within six months, ensuring that both large and small operators are held accountable for maintaining ethical standards in the industry.

Advertising Standards And Transparency In Fantasy Gaming

The Code of Ethics also aims to tackle misleading advertising, an area that has come under scrutiny in the past. Advertising standards are now clearly defined, ensuring that promotions for gaming platforms are not deceptive or misleading. All ads must highlight the risks associated with fantasy gaming and ensure that they do not create unrealistic expectations. This will help to prevent the exploitation of vulnerable players and encourage responsible marketing within the sector.

Protecting Players With Self-Exclusion And Support Tools

In order to protect vulnerable users, the Code includes provisions for self-exclusion. This allows players who feel that their gaming habits are becoming problematic to voluntarily exclude themselves from platforms for a set period. Along with this, platforms must introduce support tools and responsible gaming features to detect at-risk behaviour and offer assistance to players who may be struggling with gambling addiction.

Conclusion

As the gaming sector continues to evolve, the Code of Ethics lays the groundwork for a responsible and sustainable future. By adhering to these ethical guidelines, platforms can foster a culture of fairness, transparency, and player protection. With industry bodies working together to ensure compliance, the new ethical standards are set to help India’s gaming industry thrive while safeguarding its players.

The Crucial Role Of Consent Managers Under The DPDP Act

Introduction

The introduction of the Data Protection and Digital Privacy Act (DPDP Act) in India marks a significant stride towards safeguarding personal information. Central to this new framework is the role of Consent Managers, a novel concept designed to empower individuals in managing their personal data. This article delves into the intricacies of Consent Managers, outlining their legal obligations, the penalties for non-compliance, their distinct role under the DPDP Act, and a comparative analysis with Account Aggregators. By exploring these facets, the article aims to provide a comprehensive understanding of Consent Managers’ pivotal role in the digital economy’s regulatory environment.

Obligations of Consent Managers under the DPDP Act

The Data Protection and Digital Privacy Act (DPDP Act) introduces specific obligations for Consent Managers, who are entrusted with the responsibility of ensuring that individuals’ data is handled transparently and with due consent. As intermediaries between data principals (individuals) and data fiduciaries (entities that process data), Consent Managers play a crucial role in the data ecosystem.

Ensuring Informed Consent

Consent Managers are required to ensure that the consent they manage is informed, specific, and clear. This means that data principals are made fully aware of the nature of the data being collected, the purpose of its collection, and how it will be used. Consent Managers must provide a platform that allows individuals to easily grant, manage, and revoke consent at any time, ensuring that these processes are user-friendly and accessible.

Maintaining Data Privacy

Another critical obligation is the maintenance of privacy and security of the data processed. Consent Managers must employ state-of-the-art security measures to protect data from unauthorized access, breaches, and leaks. This includes implementing robust encryption practices, secure data storage solutions, and regular audits to ensure compliance with the highest standards of data protection.

Transparency and Accountability

Transparency is fundamental to the role of Consent Managers. They are obliged to keep detailed records of all consent transactions and make them available to data principals upon request. Furthermore, they must provide regular updates about any changes in data processing practices and ensure that data principals are always aware of who has access to their data and for what purpose.

These obligations are designed to create a more trusted and transparent environment for personal data management, aligning with global data protection standards and fostering a culture of privacy by design and default.

Fines for Non-Compliance Under the DPDP Act

The Data Protection and Digital Privacy Act (DPDP Act) establishes severe penalties for breaches of its mandates, especially in the management of personal data by Consent Managers. These penalties are essential to ensure compliance and to emphasize the significance of personal data protection.

Scale of Penalties

The DPDP Act introduces hefty fines that can significantly impact an organization’s financial standing. Penalties for non-compliance can reach up to ₹250 crore, depending on the nature and extent of the violation. This high ceiling for fines serves to underline the critical importance the law places on data privacy and the responsibilities of those handling personal data.

Criteria for Determining Fines

Fines are assessed based on the seriousness, duration, and nature of the infringement. Other considerations include whether the infringement was intentional or negligent, the measures taken to mitigate the damage, the degree of cooperation with regulatory authorities, and any history of previous violations by the entity.

Impact of Fines

The potential for such significant financial penalties acts as a strong deterrent against non-compliance. Beyond the direct financial impact, companies facing such fines also risk serious reputational damage, which can affect customer trust and business sustainability. This risk reinforces the need for robust data protection practices and compliance with the DPDP Act’s provisions.

The substantial fines highlighted in the DPDP Act signify the law’s intent to enforce strict compliance and protect individual privacy rights effectively.

Overview of the DPDP Act

The Data Protection and Digital Privacy Act (DPDP Act) serves as a cornerstone in the framework of digital privacy and data protection in India. Its development is a response to the increasing need for a comprehensive legal framework that safeguards personal information while balancing the requirements of the digital economy.

Purpose of the DPDP Act

The primary aim of the DPDP Act is to protect individual privacy concerning personal data. It ensures that data processing is fair, transparent, and respects the rights of individuals. The Act establishes clear guidelines and practices for data collection, processing, and storage, ensuring that personal data is handled securely and with respect for the individual’s privacy.

Key Provisions

Consent Framework: The Act introduces a robust consent framework that requires explicit consent for data collection and processing, ensuring that individuals are aware of how their data is used.
Rights of Individuals: It empowers individuals with several rights, including the right to access their data, correct inaccuracies, and erase data under specific circumstances.
Regulatory Authority: The establishment of a regulatory authority to enforce the provisions of the Act, provide guidance to entities handling data, and address complaints from individuals about data misuse.

Compliance Requirements

Entities that handle personal data must comply with the DPDP Act by implementing adequate security practices and procedures. They are also required to report data breaches, which involve personal data, to the authority promptly.

Role of Consent Manager Under the DPDP Act

Definition and Functionality

A Consent Manager, as defined by the DPDP Act, is an entity that acts as an intermediary between data principals (individuals) and data fiduciaries (entities that process data). Their primary role is to enable individuals to exercise their data protection rights, such as granting, withdrawing, and managing consent for data usage.

Responsibilities of a Consent Manager

Facilitate Consent Transactions: Consent Managers are responsible for obtaining and recording explicit consent from data principals for the processing of their personal data.
Privacy by Design: They must ensure that their systems and processes are designed to uphold data privacy, incorporating necessary technical and organizational measures to secure personal data.
Transparency and Accountability: Consent Managers are required to maintain transparent records of all consent transactions and provide data principals with access to these records upon request.

Benefits to Data Principals

Empowerment: Consent Managers empower users by providing them with control over their personal data.
Simplified Data Management: They simplify the process of managing consents across multiple platforms, making it easier for individuals to track where and how their data is being used.
Enhanced Privacy Control: By facilitating informed consent, they enhance the individual’s ability to control their data privacy and the extent of their data’s usage.

The role of Consent Managers is vital in enforcing the principles of the DPDP Act by bridging the gap between data principals and fiduciaries, thus enhancing the overall trust in digital ecosystems.

Comparison: Account Aggregator vs Consent Manager

Account Aggregators

Account Aggregators (AAs) are a type of financial data fiduciary under India’s financial data sharing system, primarily regulated by the Reserve Bank of India (RBI). They facilitate the sharing of financial data between financial information providers (FIPs) and financial information users (FIUs) with the explicit consent of the customer. This system aims to improve the availability of financial services like loans and investments by ensuring secure and efficient data sharing.

Consent Managers

In contrast, Consent Managers under the DPDP Act have a broader mandate that extends beyond financial data. They help manage consent for any personal data handling by businesses across various sectors. This includes health, education, e-commerce, and more, making their role crucial in protecting data privacy beyond just financial transactions.

Key Differences

Regulatory Body: Account Aggregators are regulated by the RBI, whereas Consent Managers are governed under the DPDP Act, showing a varied scope of authority and specialization.
Scope of Data: Account Aggregators’ operations are limited to financial data, while Consent Managers deal with a wide range of personal data across different sectors.
Purpose: The primary purpose of Account Aggregators is to streamline financial services, enhancing customer experience and service accessibility. Consent Managers focus on the broader aspect of data privacy management, empowering individuals to control how their data is used across any platform.

These distinctions highlight the specialized functions of both roles in managing data privacy and consent in their respective domains, with Consent Managers offering a more comprehensive approach across multiple sectors.

Frequently Asked Questions (FAQs) about Consent Managers under the DPDP Act

What is a Consent Manager under the DPDP Act?

A Consent Manager under the Digital Personal Data Protection (DPDP) Act is an entity that assists individuals in managing their consent for the use of their personal data by various data fiduciaries. These managers provide a mechanism for individuals to grant, manage, and revoke consent in a transparent and accessible manner, ensuring greater control over personal data.

How does a Consent Manager differ from a Data Protection Officer?

While both roles aim to protect personal data, a Consent Manager specifically facilitates the consent management process between individuals and data fiduciaries, while a Data Protection Officer (DPO) oversees an organization’s overall data protection strategy, compliance with the DPDP Act, and acts as a point of contact with regulatory authorities.

What are the penalties for non-compliance with the DPDP Act regarding consent management?

Non-compliance with the provisions related to consent management under the DPDP Act can result in significant penalties. Organizations may face fines of up to Rs. 250 crore or higher, depending on the severity of the violation and the discretion of the regulatory authority. This underscores the importance of having robust consent management processes in place.

Can individuals directly interact with Consent Managers?

Yes, individuals can directly interact with Consent Managers to manage their consent preferences. Consent Managers are required to provide easy-to-use tools that allow individuals to grant, modify, or withdraw consent at any time, giving them full control over how their personal data is handled.

Employee Screening

Risk & Compliance

Financial Intelligence

Identity Verification

Utilities

Entity/Business Level

Employment

Banking & Payments

Fraud Detection

Professional

Background Verification

Due-Diligence

Title Menu Three

What's New

iBRIDGE 2.0 – The Next-Gen Background Verification Platform

Resource Library

Featured Resource