On January 3, 2025, the Ministry of Electronics and Information Technology (MeitY) unveiled draft regulations aimed at operationalising the Digital Personal Data Protection (DPDP) Act, 2023. The introduction of this Act, which became official in August 2023, establishes a comprehensive legal framework for processing digital personal data, with a focus on safeguarding the privacy of citizens.
Under the new regulations, various data platforms—including e-commerce, online gaming companies, and social media websites—are mandated to delete personal data of users within three years after it becomes obsolete or no longer necessary for its original purpose. This shift introduces a new landscape for marketers, who are now faced with the challenge of recalibrating their data strategies in light of these regulations.
Rajiv Dingra, founder and CEO of ReBid, stresses the importance of adjusting to the new legal environment. Speaking to afaqs!, he noted that compliance will likely require increased investments in advanced data governance solutions and customer data platforms (CDPs). Dingra articulated that marketers must accelerate their efforts in deriving actionable insights from data, especially within the stipulated three-year timeframe. He advised that marketers would need to "double down on strategies such as first-party data collection, consent management, and robust customer engagement campaigns" to extract maximum value from their data before it needs to be deleted.
Kushal Sanghvi, chief revenue officer at iCubesWire, echoed the sentiment for responsible data management, highlighting that the new regulations present an opportunity for marketers to better understand the value of data they handle. He stated, "It’s about time we had robust rules and regulations around data," reinforcing the importance of deepening knowledge regarding data segmentation and prioritisation.
Marketers must adapt their strategies according to the specific demands of their industries because the three-year data retention limit could vary in implications. Hemal Majithia, founder and chief oktomind at Oktobuzz, emphasised that industries with shorter sales cycles, such as FMCG and e-commerce, may find the timeframe manageable. However, industries with longer customer outreach processes, like real estate or education, will require a more tailored approach. Majithia explained that consent for retaining data longer may need to be acquired, particularly when dealing with valuable long-term benefits like alumni support or career guidance.
Shrenik Gandhi, co-founder and CEO of White Rivers Media, encouraged marketers to shift from "data hoarding to data harmony," underscoring the necessity for clear retention policies. He observed that consumer data practices are likely to evolve significantly, advocating for transparency in consent processes. According to Gandhi, "Pre-deletion notifications put consumers back in the driver’s seat, while stronger consent rules make ‘yes’ mean yes and nothing less".
For Direct-to-Consumer (D2C) brands, the stakes concerning the DPDP guidelines are particularly high. Suraj Chaudhari, co-founder and CBO at Zlade, pointed out the financial implications; brands typically require three to five years to recoup customer acquisition costs. He remarked that the regulations disrupt the traditional customer lifetime value (LTV) and customer acquisition cost (CAC) calculations.
With the possibility of marketers seeking to exploit loopholes in the new regulations, Dingra urged caution. He warned that "exploiting loopholes could lead to significant reputational damage and potential legal consequences, given the increased scrutiny on data privacy". Instead, Dingra advocates for a transparent approach, encouraging marketers to clearly communicate their data usage policies.
Additionally, Sourya Banerjee, policy head at Jajabor Brand Consultancy, highlighted that the new draft rules mandate clearer terms and conditions regarding personal data. He explained that marketers are required to provide itemised descriptions of the personal data being processed alongside the intended purpose of such data processing.
Balancing compliance with effective marketing strategies remains a challenge, and the new privacy regulations compel marketers to deliver personalised campaigns while ensuring consumer trust. Sanghvi indicated that while there may be initial difficulties in reaching audiences, this could ultimately cultivate a healthier marketing ecosystem. He asserted that legitimate engagement practices can enhance the relevance of marketing communications, which would, in turn, benefit both marketers and recipients.
As businesses continue to navigate the implications of the DPDP Act, the necessity for precise, up-to-date data has become more apparent. Majithia advocated for the operational benefits emerging from the three-year data limit, stating that by fostering responsible innovation and reinforcing user trust, marketers can achieve improved campaign efficiency. These developments point towards a significant evolution in marketing practices shaped by emerging data regulations, poised to redefine the relationship between businesses and consumers in the digital age.
Source: Noah Wire Services