☐ Has the proposed sharing been mapped to clauses (a), (b), or (c) of sub-s. (1)? ☐ Has the receiving system's notification status been verified? ☐ Is the consent instrument in the prescribed form (or best-practice equivalent pending…
158A
☐ Has the proposed sharing been mapped to clauses (a), (b), or (c) of sub-s. (1)? ☐ Has the receiving system's notification status been verified? ☐ Is the consent instrument in the prescribed form (or best-practice equivalent pending…
Section 158A consent-based sharing — checklist (19 items)
Section 158A consent — based sharing — checklist (19 items)
☐ Has the proposed sharing been mapped to clauses (a), (b), or (c) of sub-s. (1)?
☐ Has the receiving system's notification status been verified?
☐ Is the consent instrument in the prescribed form (or best-practice equivalent pending Rules)?
☐ Has supplier consent been obtained for the specific clauses?
☐ Has recipient consent been obtained where required (clause (b); clause (c) with recipient identity)?
☐ Does the consent specify data points, receiving system, purpose, duration, withdrawal rights?
☐ Is the data flow strictly calibrated to consent scope (no over-disclosure)?
☐ Has the receiving system executed a contractual data-use limitation undertaking?
☐ Is the consent register maintained with audit-trail discipline?
☐ Has DPDP Act 2023 compliance been overlaid for natural-person data subjects?
☐ For Account Aggregator pathway — has RBI AA Master Direction been satisfied?
☐ Has the proportionality test (Puttaswamy / Modern Dental) been documented for the sharing?
☐ Has consent withdrawal handling been operationalised?
☐ Has the receiving system's breach-notification commitment been documented?
☐ Has tax liability been insulated from information-flow decisions (sub-s. (3) tail clause)?
☐ Have parallel automatic disclosures under s. 158(3) been distinguished in compliance manuals?
☐ Has Joint Commissioner / Compliance Head reviewed any sensitive consent (high-volume / multi-recipient)?
☐ Has the consent expiry / renewal cycle been scheduled?
☐ Has the entire sharing event been audited for Article 21 / Mafatlal procedural fairness?
Worked examples — five live scenarios
Example 1 — Account Aggregator-mediated lending
Facts: A registered taxable person — manufacturer — seeks a working-capital line from a bank. The bank requires GST turnover and tax-payment regularity assessment. The bank is partnered with a RBI-licensed Account Aggregator notified under s. 158A.
Analysis: Taxable person executes consent under s. 158A — clauses (a) registration / return data + (b) outward supplies — to flow to the AA, which transmits to the bank. Consent specifies 6-month duration, restricted to credit assessment, with audit trail. Bank receives only the consented data points. Sub-s. (3) shields Government and portal. Bank's downstream use is governed by the consent contract and RBI's AA framework.
Result: Lawful sharing under s. 158A. Taxable person receives credit; bank receives risk-graded data.
Example 2 — Recipient identity in clause (b) sharing
Facts: A supplier wishes to share its e-invoice records (clause (b)) with a notified analytics platform for supply-chain optimisation. The records contain recipient names, GSTINs, and supply quantities.
Analysis: Sub-s. (2)(b) requires recipient consent for clause (b) sharing. Supplier must obtain consent from each recipient before sharing the data that identifies them. If recipients refuse, supplier must mask / aggregate the recipient-identifying particulars. Alternative — supplier may share aggregated transaction data not identifying recipients (outside the consent-mandatory scope).
Result: Recipient consent essential before raw clause (b) sharing. Aggregation is the privacy-preserving alternative where consent is unavailable.
Example 3 — Consent withdrawal mid-cycle
Facts: A taxable person initially consented to share GSTR-1 with an analytics platform for 12 months. After 4 months, the taxable person withdraws consent due to concerns about data resale by the analytics platform.
Analysis: Withdrawal is effective from the withdrawal date. Data shared during months 1-4 remains governed by the original consent (subject to the analytics platform's contractual obligations). Data of months 5-12 is excluded from sharing. Analytics platform must cease ingestion and may face contractual breach claim if it continues to use months 1-4 data beyond the consented purpose. Notification to the analytics platform within prescribed timeline.
Result: Prospective withdrawal effective. Retrospective protection limited — past-shared data remains under the original consent's scope and the receiving system's contractual obligations.
Example 4 — Sharing of non-enumerated data — outside s. 158A
Facts: A taxable person attempts to authorise sharing of departmental audit findings (under s. 65) with a credit-rating agency. The audit report contains officer observations on the taxpayer's compliance posture.
Analysis: Audit findings are NOT enumerated in clauses (a), (b), or (c) of sub-s. (1). They are outside the s. 158A sharing universe. The structural confidentiality of s. 158 continues to apply. Sharing would breach s. 158, attracting officer liability under s. 133 and taxable person's exposure to disciplinary action by the receiving regulator. Practitioner advice — limit s. 158A sharing strictly to the enumerated data points; seek other lawful channels for non-enumerated data.
Result: Proposed sharing outside s. 158A. Prohibited.
Example 5 — Tax liability untouched by sharing
Facts: A taxable person shares GSTR-3B data under s. 158A with a notified credit-rating agency. The rating agency assigns a low rating citing payment irregularities. The taxable person argues that the data sharing exposed errors that should be set off against tax liability.
Analysis: Sub-s. (3) tail clause — sharing has 'no impact on the liability to pay tax on the supply'. The information-flow framework and the tax-assessment framework are independent. The rating agency's analysis cannot displace the taxable person's substantive tax liability. The taxable person's remedies for any incorrect tax position lie through s. 161 rectification, s. 107 appeal, etc., not through the information-sharing channel.
Result: Tax liability untouched by sharing. Taxable person must pursue separate tax-remedies framework.
Planning and litigation strategy
Litigation defence
Cross-references