When a user fills a form on our website or app, can we automatically use that data for marketing campaigns? No, form submission does not automatically grant marketing permission. You must take explicit and purpose-specific consent for marketing communication.
Read more Can we take a single consent for marketing, analytics, and service communication to simplify the user experience? No, DPDP requires granular consent, meaning each purpose must be clearly separated. Users should know exactly what they are agreeing to.
Read more If a customer withdraws consent for marketing, can we still send transactional messages like OTPs or order updates? Yes, transactional messages can continue because they are necessary to deliver the service requested by the user. These fall under legitimate use.
Read more Is having a privacy policy on our website enough to meet consent requirements? No, a privacy policy only informs users — it does not capture consent. DPDP requires active user action, such as clicking a checkbox or accepting a specific option.
Read more What information must we provide when asking for consent from users? You must clearly inform users about what data is being collected and why it is being used, in simple and understandable language.
Read more Consent Management Under DPDP Section 6 of the DPDP Act sets a high bar for consent. It must be: freely given (no coercion or pre-checked boxes), specific (one purpose at a time), informed (plain-language notice attached), unambiguous (a clear affirmative action), and as easy to withdraw as it was to give.
Read more Do retailers need consent for loyalty programs and marketing? Retail brands must collect explicit customer consent before enrolling users in loyalty programs or sending marketing communications. The consent must be specific, informed, and freely given — pre-checked boxes or bundled consent are not valid under DPDP.
Read more Is WhatsApp, SMS, and email marketing covered under DPDP? All digital marketing channels require verifiable consent and easy opt-out mechanisms. Every communication must be backed by valid, recorded consent from the user.
Read more