You're Probably Already Breaking India's New Data Law - And You Don't Even Know It

Think about the latest campaign you ran.

The WhatsApp blast before Mother's Day. The CRM full of leads from that trade fair two years ago. Or a website that tracks every visitor before they've clicked a single button.

None of this raised concerns earlier. These practices have been common for years. But under India's new Digital Personal Data Protection (DPDP) Act, much of this could now become a legal and operational liability.

A recent PwC survey found that many Indian businesses still feel underprepared for upcoming privacy and compliance expectations.

And honestly, that's not surprising. For years, customer data collection in India operated on habit, speed, and growth pressure, not structured consent systems.

Now the rules are changing fast. Nearly 70% of business leaders still don't fully understand what the law actually requires.

That festive season email you sent to 80,000 people, did those recipients explicitly consent to receiving promotional communication from you?

Be honest for a moment.

That massive marketing list you've built over the years, where did those contacts actually come from? A purchase here. An account sign-up there. Maybe a form filled at an event.

At the time, it all felt normal. That's how marketing worked. Collect first. Organize later. Ask fewer questions.

Most brands weren't trying to misuse customer data. They were simply operating in a system that rewarded scale over governance.

What the DPDP Act Changes

The fact that someone shared their email to create an account does not automatically mean they consented to receive promotional emails.

These are separate purposes. And the law increasingly expects separate, explicit consent for each purpose.

Consent under DPDP must be:

• specific
• informed
• purpose-based
• and withdrawable

A pre-ticked checkbox buried in a sign-up form? Not enough.

A terms-and-conditions paragraph that vaguely mentions marketing? Also unlikely to meet evolving consent expectations.

"Every marketing list built without a clear, purpose-specific opt-in is a liability sitting in your inbox right now."

The Good News - This Is Fixable

But businesses do need to stop treating consent collection as a tiny checkbox handled once during onboarding.

Go back to your database and ask: Does every contact have a documented record showing they opted in to receive marketing communication?

If the answer is "no," or even "I think so," it's time to revisit how customer consent is being collected and managed.

Because under the DPDP Act, consent is no longer a formality hidden inside sign-up flows or legal text. It needs to be clear, purpose-specific, trackable, and easy to withdraw. This shift is pushing businesses to rethink how they handle customer data across websites, apps, WhatsApp, loyalty programs, and marketing platforms.

Solutions like OneConsent are helping brands bring structure to this process by centralizing consent collection, maintaining audit-ready records, and enabling purpose-based preference management across channels.

The brands that act early won't just reduce compliance risk. They'll build stronger customer trust in a market where transparency is quickly becoming a competitive advantage.

Because going forward, the real question will not be how much customer data a business has. It will be whether the business can prove that customers knowingly agreed to share it.

WRITTEN BY

Megha Prasad

Product Manager, Easyrewardz

Megha Prasad is a Product Manager at Easyrewardz, working on OneConsent - the company's CDP-integrated consent management platform built for India's DPDP era. A CSPO® and ECBA certified product professional, Megha brings 4+ years of experience across CRM, BGV, insurance and e-commerce, having previously built products at AuthBridge and Oodles Technologies. She holds an MBA in Marketing from Savitribai Phule Pune University and a BBA in Finance from the University of Burdwan. Her work focuses on translating complex regulatory requirements into intuitive product experiences that help enterprises build trust with their customers.

See all articles by Megha