Question 1

What is a consent management platform?

Accepted Answer

A consent management platform lets organizations capture, store and honor the choices people make about how their personal data is collected and used. OneConsent captures purpose-based consent across web, mobile, WhatsApp and other channels, keeps a lifecycle record of every consent and withdrawal, and syncs that record to the systems that need to respect it.

Question 2

How does OneConsent help organizations manage consent under the DPDP Act?

Accepted Answer

The DPDP Act requires clear notice, purpose-specific consent, and the ability to withdraw consent as easily as it was given. OneConsent operationalizes this with purpose-based consent capture, a customer-facing preference centre, consent withdrawal workflows, and a timestamped evidence trail for every consent event.

Question 3

What products does OneConsent offer?

Accepted Answer

OneConsent offers five connected products: Consent & Preferences, Privacy Center, Cookie Consent Management (CCMC), Data Principal Access Rights (DPAR), and Third-Party Governance Platform (TPGP).

Question 4

Can OneConsent manage consent across web, mobile and WhatsApp?

Accepted Answer

Yes. OneConsent captures and synchronizes consent across web, mobile apps, WhatsApp, call centres and in-store touchpoints, so a customer's choice made in one channel is respected everywhere else.

Question 5

What is the difference between consent management and cookie consent management?

Accepted Answer

Consent management covers every purpose for which an organization processes personal data, across every channel. Cookie consent management is a specific application of it, focused on discovering, classifying and capturing consent for cookies and trackers on websites and apps.

Question 6

What are Data Principal rights under the DPDP Act?

Accepted Answer

Data Principals have the right to access, correct and request deletion of their personal data, to withdraw consent, and to file grievances. OneConsent's DPAR product manages these requests from intake through verification, processing and resolution.

Question 7

How does OneConsent help organizations manage access, correction and deletion requests?

Accepted Answer

Requests are logged, the requester's identity is verified, relevant personal data is located through data discovery, and the request is routed to the right team with an SLA. Every step, including the final response, is recorded in an audit trail.

Question 8

What is vendor risk management, and why does it matter for privacy?

Accepted Answer

Vendor risk management is the process of identifying, assessing and monitoring third parties that process personal data on an organization's behalf. OneConsent's TPGP maps what data each vendor processes, scores their risk, and tracks data processing agreements and remediation over time.

Question 9

What is ROPA, and how does OneConsent support it?

Accepted Answer

A Record of Processing Activities (ROPA) documents what personal data an organization processes, for what purpose, and through which systems and vendors. OneConsent maintains ROPA inside Privacy Center, connected to the same purpose and processing data used for consent and vendor risk.

Question 10

How does OneConsent support audit evidence?

Accepted Answer

Every consent event, processing activity, privacy request and vendor assessment is timestamped and stored, so privacy and compliance teams can produce evidence for an audit or regulatory inquiry without reconstructing records after the fact.

Question 11

We collect customer data through our website forms, CRM, and WhatsApp campaigns — does DPDP apply to all these touchpoints or only specific systems?

Accepted Answer

DPDP applies to every touchpoint where personal data is collected or processed, including websites, CRM tools, apps, WhatsApp, and even offline data that gets digitized later.

From a business perspective, you cannot treat channels differently — compliance must be consistent across your entire data ecosystem. This is where most companies fail due to fragmented systems.

Question 12

As a brand using CRM, loyalty platforms, and marketing tools, who is responsible if there is a compliance failure?

Accepted Answer

Your organization is the Data Fiduciary, meaning you are responsible for determining how and why data is used. Even if vendors process data, the liability remains with you.

This means you must actively manage vendors, internal teams, and systems to ensure compliance — responsibility cannot be outsourced.

Question 13

We have historical customer data collected over many years — can we continue using it for campaigns?

Accepted Answer

Yes, but only if the data aligns with DPDP requirements. You must ensure users are informed about usage and given control (like withdrawal options).

Legacy data without proper consent tracking is a major compliance risk, and businesses may need to re-notify or re-consent users before using it.

Question 14

Does DPDP apply only to paying customers, or also to leads and employees?

Accepted Answer

DPDP applies to all individuals whose data you process, including customers, leads, employees, and even website visitors.

From a business standpoint, this means your HR systems, CRM, and marketing tools all fall under compliance — not just customer-facing platforms.

Question 15

What type of data in our business is considered personal data under DPDP?

Accepted Answer

Any data that can identify an individual directly or indirectly is considered personal data. This includes basic details like name and phone number, as well as behavioral or transactional data.

Businesses often underestimate this — even purchase history, app usage, and preferences are covered under DPDP.

Question 16

When a user fills a form on our website or app, can we automatically use that data for marketing campaigns?

Accepted Answer

No, form submission does not automatically grant marketing permission. You must take explicit and purpose-specific consent for marketing communication.

In practice, this means having a separate opt-in checkbox for marketing that is not pre-selected. Without this, marketing usage becomes non-compliant.

Question 17

Can we take a single consent for marketing, analytics, and service communication to simplify the user experience?

Accepted Answer

No, DPDP requires granular consent, meaning each purpose must be clearly separated. Users should know exactly what they are agreeing to.

From a product perspective, this means designing consent flows with multiple options instead of bundled consent, which is a common compliance mistake.

Question 18

If a customer withdraws consent for marketing, can we still send transactional messages like OTPs or order updates?

Accepted Answer

Yes, transactional messages can continue because they are necessary to deliver the service requested by the user. These fall under legitimate use.

However, all marketing communication must stop immediately, which requires proper separation of communication types in your systems.

Question 19

Is having a privacy policy on our website enough to meet consent requirements?

Accepted Answer

No, a privacy policy only informs users — it does not capture consent. DPDP requires active user action, such as clicking a checkbox or accepting a specific option.

Businesses must design clear consent capture mechanisms, not rely on passive acceptance through terms.

Question 20

What information must we provide when asking for consent from users?

Accepted Answer

You must clearly inform users about what data is being collected and why it is being used, in simple and understandable language.

This ensures that consent is truly informed and reduces disputes or complaints later.

Question 21

If a customer asks what data we have about them, what exactly do we need to provide?

Accepted Answer

You must provide a clear summary of personal data being processed, along with the purpose and how it is used. This should be understandable, not technical.

This requires businesses to maintain a centralized data view, otherwise responding becomes operationally difficult.

Question 22

If a customer asks us to delete their data, can we retain it for internal analytics or business use?

Accepted Answer

You can only retain data if there is a valid legal or operational requirement. Otherwise, it must be deleted once the purpose is fulfilled or upon request.

Keeping data for "future use" without justification is not allowed under DPDP.

Question 23

Do we need a system to handle user requests like access, correction, or deletion?

Accepted Answer

Yes, DPDP requires a structured and trackable grievance system to handle such requests efficiently.

Manual handling is not scalable, so businesses typically implement workflows or platforms to manage this.

Question 24

What happens if we ignore or delay customer data requests?

Accepted Answer

Customers can escalate complaints to the Data Protection Board, which can investigate and impose penalties.

This makes timely handling of requests critical from both compliance and reputation perspectives.

Question 25

Can a user appoint someone else to manage their data rights?

Accepted Answer

Yes, users can nominate another individual to exercise their rights in case of death or incapacity.

Businesses must be prepared to handle such requests through proper verification mechanisms.

Question 26

We use customer data for order processing, billing, and support — do we need consent for all these activities?

Accepted Answer

No, these activities fall under legitimate use because they are necessary to deliver the service requested by the user.

However, the data cannot be reused for marketing or unrelated purposes without consent, which is where many businesses make mistakes.

Question 27

Can we reuse customer data collected during signup for marketing campaigns later?

Accepted Answer

No, data can only be used for the purpose it was originally collected for. Any new purpose requires fresh consent.

This means your systems must track purpose mapping clearly, otherwise reuse becomes a compliance risk.

Question 28

Can we track user behavior on our website or app for analytics and personalization?

Accepted Answer

Yes, but only if users are clearly informed and consent is taken where required.

Tracking beyond essential functionality (like analytics or profiling) usually requires consent, especially for marketing-related use cases.

Question 29

Can we send targeted offers based on customer purchase history?

Accepted Answer

Yes, but only if you have explicit marketing consent. Using behavioral data without consent for targeting can lead to compliance violations.

Question 30

Can we use customer data for improving products and internal analytics?

Accepted Answer

Yes, but the purpose must be clearly defined and communicated. If the use goes beyond core service delivery, consent may be required.

Question 31

What level of data security is expected from us under DPDP, and how do we ensure we are compliant?

Accepted Answer

DPDP requires businesses to implement reasonable security safeguards to protect personal data from unauthorized access, breaches, or misuse. This includes encryption, access controls, monitoring systems, and secure storage practices.

From a business perspective, security is not just an IT function — it must be embedded across systems, vendors, and workflows. You should also regularly review and upgrade your security posture as systems evolve.

Question 32

If a data breach happens in our system, what are the exact steps we are expected to take?

Accepted Answer

In case of a breach, you must promptly notify both the Data Protection Board and all affected users, along with taking immediate corrective actions to contain the incident.

From a practical standpoint, this means you should already have a breach response plan, including detection, escalation, communication, and reporting workflows. Delays or lack of preparedness can significantly increase risk and penalties.

Question 33

If a breach happens because of a vendor or third-party system, are we still responsible?

Accepted Answer

Yes, your company remains responsible because you are the Data Fiduciary. Even if the breach originates from a vendor, the accountability does not shift.

This is why businesses must ensure strong vendor governance, contracts, and monitoring mechanisms. You are expected to ensure that your entire ecosystem follows DPDP standards.

Question 34

What are the potential penalties if we fail to protect customer data properly?

Accepted Answer

Penalties can go up to ₹250 crore, depending on the severity of the violation, especially in cases of data breaches or failure to implement proper safeguards.

Beyond financial penalties, businesses also face reputational damage and loss of customer trust, which can have long-term impact on growth and retention.

Question 35

Do we need to regularly audit our systems and security measures to stay compliant?

Accepted Answer

Yes, regular audits are essential to ensure that your systems remain compliant over time. As your tech stack evolves, new risks may emerge, and periodic reviews help identify and mitigate them.

Businesses should treat compliance as an ongoing process, not a one-time implementation. Continuous monitoring, logging, and audit trails are critical for both compliance and incident readiness.

Question 36

We work with multiple vendors like SMS providers, CRM tools, and analytics platforms — can they use our customer data independently?

Accepted Answer

No, vendors can only process data on your behalf and strictly for the defined purpose. They cannot use the data for their own business purposes or reuse it beyond your instructions.

From a business standpoint, this means you must clearly define data usage boundaries and ensure vendors adhere to them through contracts and monitoring.

Question 37

Do we need formal agreements with vendors to ensure DPDP compliance?

Accepted Answer

Yes, it is critical to have formal agreements (like Data Processing Agreements) that clearly define roles, responsibilities, data usage, and security obligations.

Without these agreements, you risk losing control over how your data is handled, which can directly lead to compliance violations.

Question 38

Should we inform users about third-party vendors who process their data?

Accepted Answer

Yes, transparency is a key requirement. Users should be informed about who is processing their data and for what purpose, especially when third parties are involved.

This builds trust and ensures that users are making informed decisions while giving consent.

Question 39

Can we transfer customer data outside India when working with global vendors?

Accepted Answer

Yes, cross-border data transfer is allowed, but only to countries approved by the government. You must also ensure that appropriate safeguards are in place.

Businesses working with global vendors need to carefully evaluate data flow and jurisdiction risks to remain compliant.

Question 40

Do we need to audit or monitor vendors regularly to ensure compliance?

Accepted Answer

Yes, vendor monitoring is critical. You must ensure that vendors continue to comply with DPDP requirements through periodic audits, reviews, and compliance checks.

Vendor-related risks are one of the biggest gaps in most organizations, so proactive governance is essential.

Question 41

What are the most practical first steps we should take to become DPDP compliant as a business?

Accepted Answer

The first step is to map your entire data lifecycle — what data you collect, where it comes from, how it flows across systems, and why it is used.

This helps you identify gaps in consent, security, and governance. Without this visibility, compliance efforts remain incomplete and reactive.

Question 42

Is it possible to manage DPDP compliance manually without a dedicated platform?

Accepted Answer

In small setups, it may seem possible, but at scale, manual processes become unreliable and error-prone. With multiple systems and touchpoints, tracking consent and data usage manually is extremely difficult.

Businesses typically adopt platforms to ensure centralized control, auditability, and real-time compliance tracking.

Question 43

Do we need to maintain records of user consent, and how detailed should these records be?

Accepted Answer

Yes, maintaining consent records is essential. You should be able to demonstrate when consent was taken, for what purpose, and how it can be withdrawn.

These records act as proof during audits or disputes, making them a critical part of your compliance framework.

Question 44

Do all companies need to appoint a Data Protection Officer (DPO)?

Accepted Answer

Only companies classified as Significant Data Fiduciaries (SDFs) are required to appoint a DPO. However, even if not mandatory, having a DPO or similar role is highly recommended.

This helps in managing compliance, handling user requests, and acting as a point of contact for regulators.

Question 45

What is the timeline for DPDP compliance, and when should we be ready?

Accepted Answer

DPDP is expected to be fully enforceable by 2027, but businesses should start preparing much earlier. Compliance involves system changes, process alignment, and vendor management, which take time.

Early adoption not only reduces risk but also builds customer trust and operational efficiency.

Question 46

If a customer raises a complaint about misuse of their data, how should we handle it internally?

Accepted Answer

You must handle the complaint through a formal grievance redressal mechanism, investigate the issue, and provide a clear response within a reasonable timeframe.

This process should be structured, documented, and auditable. Handling complaints effectively is critical for both compliance and customer trust.

Question 47

If a customer is not satisfied with our response, where can they escalate the complaint?

Accepted Answer

If unresolved, the customer can escalate the issue to the Data Protection Board of India, which has the authority to investigate and take action.

This makes it important for businesses to resolve issues proactively before they reach regulatory levels.

Question 48

Do we need to track and document all customer complaints and how they were resolved?

Accepted Answer

Yes, maintaining records of complaints and resolutions is important for audit readiness and compliance proof.

It also helps identify recurring issues and improve internal processes, making it both a compliance and operational requirement.

Question 49

Are there defined timelines within which we must respond to customer complaints?

Accepted Answer

While the Act expects responses within a reasonable timeframe, businesses should define internal SLAs to ensure timely resolution.

Delays or lack of response can lead to escalations and regulatory scrutiny, making response time a critical factor.

Question 50

What are the risks if we ignore or mishandle customer complaints related to data?

Accepted Answer

Ignoring complaints can lead to escalation to the Data Protection Board, potential penalties, and loss of customer trust.

Beyond compliance, poor grievance handling can directly impact brand reputation and customer retention, making it a key business priority.

Question 51

What is the DPDP Act?

Accepted Answer

The DPDP Act, 2023 is India's primary data protection law, enacted on 11 August 2023 and being operationalised through phased rules and the Data Protection Board. It applies to any business — Indian or foreign — that processes the digital personal data of individuals in India.

It defines two key roles: the Data Fiduciary (the organisation that decides why and how data is processed) and the Data Principal (the individual whose data is being processed). Every Fiduciary must obtain valid consent, provide clear notices, honour user rights (access, correction, deletion, nomination, grievance), protect data with reasonable safeguards, and notify breaches.

Non-compliance can attract penalties of up to ₹250 crore per violation, adjudicated by the Data Protection Board of India.

Question 52

DPDP Compliance Checklist for Enterprises

Accepted Answer

Enterprise DPDP readiness goes beyond a privacy policy. A complete checklist includes:

1. Map every system that touches personal data (CRM, POS, loyalty, HRMS, marketing tools, vendors).

2. Document the lawful basis (consent or legitimate use) for each processing activity.

3. Re-design forms and journeys for granular, purpose-specific consent capture.

4. Publish plain-language notices at every collection point.

5. Build self-serve rights workflows (access, correction, deletion, nomination, grievance) with SLAs.

6. Sign Data Processing Agreements with every vendor and sub-processor.

7. Implement reasonable security safeguards — encryption, access controls, logging, monitoring.

8. Define and rehearse a breach detection and notification playbook.

9. Maintain tamper-evident audit trails of consent, withdrawals, and rights requests.

10. Appoint a Data Protection Officer (if Significant Data Fiduciary) and a Grievance Officer; publish contact details.

Question 53

DPDP Compliance for Retail Brands

Accepted Answer

Retail is one of the most data-intensive industries, touching customers across stores, e-commerce, loyalty programs, WhatsApp campaigns, SMS, and email. DPDP requires that every one of these touchpoints carry the same consent posture.

Practically, retail brands must: (a) replace bundled terms-and-conditions consent with separate opt-ins for loyalty, marketing, profiling, and analytics; (b) synchronise consent state in real time between CDP, CRM, POS, and channel tools so an opt-out in WhatsApp also suppresses email and SMS; (c) audit legacy customer databases and re-consent where records are missing; (d) keep audit logs that prove when and how consent was captured; (e) train store associates on consent capture at POS.

Non-compliance attracts penalties up to ₹250 crore, but the larger risk is customer trust erosion in a brand-led industry.

Question 54

How to Prepare for DPDP Enforcement

Accepted Answer

Enforcement under DPDP will be progressive, starting with notices and escalating to penalties via the Data Protection Board. Businesses that wait until Day 1 will not have time to remediate. A 90–180 day preparation plan typically follows three phases:

Phase 1 – Discover (Weeks 1–4): map all data flows, classify personal data, list every vendor, and identify gaps in consent, notices, and security.

Phase 2 – Deploy (Weeks 5–12): roll out a consent management platform, re-design forms and notices, sign DPAs, set up rights-handling workflows, and appoint Grievance and Data Protection Officers.

Phase 3 – Operate (Week 13+): activate audit logs, run tabletop breach drills, train teams, monitor vendor compliance, and continuously update records as systems change.

Question 55

Consent Management Under DPDP

Accepted Answer

Section 6 of the DPDP Act sets a high bar for consent. It must be: freely given (no coercion or pre-checked boxes), specific (one purpose at a time), informed (plain-language notice attached), unambiguous (a clear affirmative action), and as easy to withdraw as it was to give.

Operationally, this means every consent event must be (a) captured with timestamp, purpose, channel, and language; (b) stored in a tamper-evident log; (c) enforced in real time across downstream systems (CRM, marketing, analytics, vendors); and (d) revocable through a self-serve preference centre.

A Consent Management Platform (CMP) like OneConsent unifies these four functions into one system of record, eliminating the spreadsheets and fragmented consents that lead to violations.

Question 56

DPDP Penalties Explained

Accepted Answer

The Schedule to the DPDP Act lays out a tiered penalty framework administered by the Data Protection Board:

Up to ₹250 crore — failure to take reasonable security safeguards to prevent a personal data breach.

Up to ₹200 crore — failure to notify the Board and affected Data Principals about a breach.

Up to ₹200 crore — non-fulfilment of obligations toward children's data.

Up to ₹150 crore — non-fulfilment of Significant Data Fiduciary obligations.

Up to ₹50 crore — breach of any other DPDP provision.

Up to ₹10,000 — penalties on Data Principals who file false complaints or misuse rights.

Penalties are decided after inquiry and consider the nature, gravity, duration, repetitiveness, and gain or loss caused. Beyond financial impact, listed companies face reporting obligations, and brand trust damage can outweigh the fine itself.

Question 57

How to Build Audit Trails for DPDP

Accepted Answer

Audit trails are the single most important evidence businesses produce during a DPDP inquiry. A compliant audit trail records:

1. Consent events — who consented, to what purpose, through which channel, in which language, with what notice version, at what time.

2. Withdrawals and preference changes — captured with the same fidelity as consent, plus the downstream suppression confirmation.

3. Rights requests — access, correction, deletion, and nomination requests, with SLA timers and resolution evidence.

4. Data access logs — who in the organisation viewed or exported personal data, and why.

5. Vendor data shares — every onward transfer, with purpose, lawful basis, and DPA reference.

6. Breach events — detection, containment, notification, and remediation timeline.

These logs must be tamper-evident (append-only, hash-chained or signed), retained for the legally required period, and exportable in machine-readable format for the Board.

Question 58

Does the DPDP Act apply to retail businesses?

Accepted Answer

The DPDP Act applies to all retail businesses collecting digital personal data including loyalty programs, billing systems, CRM databases, e-commerce platforms, and marketing communications. If your business collects any form of digital personal data from customers, you are a Data Fiduciary and must comply with the Act.

Question 59

What retail customer data is protected under DPDP?

Accepted Answer

Any personally identifiable customer data such as name, phone number, email, purchase history, loyalty data, and digital identifiers is protected. This includes data collected through POS systems, apps, websites, WhatsApp, and other digital channels.

Question 60

Do retailers need consent for loyalty programs and marketing?

Accepted Answer

Retail brands must collect explicit customer consent before enrolling users in loyalty programs or sending marketing communications. The consent must be specific, informed, and freely given — pre-checked boxes or bundled consent are not valid under DPDP.

Question 61

What happens when a customer withdraws consent?

Accepted Answer

Retailers must immediately stop marketing communication, suppress the user across all channels, and delete or anonymize personal data unless retention is legally required. This must be enforced across all systems without delay.

Question 62

Is WhatsApp, SMS, and email marketing covered under DPDP?

Accepted Answer

All digital marketing channels require verifiable consent and easy opt-out mechanisms. Every communication must be backed by valid, recorded consent from the user.

Question 63

How long can retailers retain customer data?

Accepted Answer

Customer data can only be retained for the purpose for which it was collected. Once that purpose is fulfilled or consent is withdrawn, the data must be deleted unless there is a valid legal reason to retain it.

Question 64

How does OneConsent help with retail DPDP compliance?

Accepted Answer

OneConsent provides end-to-end consent management, preference tracking, automated opt-outs, and audit-ready records. It ensures consent is captured, enforced, and synchronized across all customer touchpoints.

Frequently Asked Questions