Understand the rules around how personal data can and cannot be used for marketing, analytics, and business operations under the DPDP Act.
No, these activities fall under legitimate use because they are necessary to deliver the service requested by the user.
No, data can only be used for the purpose it was originally collected for. Any new purpose requires fresh consent.
Yes, but only if users are clearly informed and consent is taken where required.
Yes, but only if you have explicit marketing consent. Using behavioral data without consent for targeting can lead to compliance violations.
Yes, but the purpose must be clearly defined and communicated. If the use goes beyond core service delivery, consent may be required.
Customer data can only be retained for the purpose for which it was collected. Once that purpose is fulfilled or consent is withdrawn, the data must be deleted unless there is a valid legal reason to retain it.