As digital financial services (DFS) gain popularity in developing countries, it’s becoming more important than ever for data protection legislation to protect consumers’ rights. Simply obtaining consent is not an effective way to protect data rights. We outline three legal approaches to data protection for the 21st century that go beyond consent: 1) Limiting data use to legitimate purposes; 2) Establishing a fiduciary relationship between providers and consumers; and 3) Appointing learned intermediaries to help consumers. By taking one or more of these approaches, policy makers can avoid the shortcomings of the notice and consent model, protect citizens’ personal data, promote trust and confidence in DFS and still leave plenty of room for DFS providers to innovate.