Lesson 4 · Practitioner · Both · 20 min
Consent, Data Access vs Payment Initiation
Design consents users understand—and keep data products cleanly separated from money-moving powers.
Objectives
- ▸Write purpose-limited consent copy
- ▸Separate AIS-like and PIS-like privileges in UX and architecture
- ▸Define retention, revocation, and audit requirements
- ▸Avoid dark patterns that create regulatory and trust debt
Consent is not a checkbox buried in terms. It should state who receives data, why, what fields, for how long, and how to revoke. Store consent IDs with every downstream decision (e.g., credit file) for auditability.
Key terms
Purpose limitationRevocationLeast privilegeUPI AutopayConsent scope