The Digital Personal Data Protection Act, 2023 gives India a general data protection law for the first time. If you message customers, it applies to you. This is a practical summary of what changes — not legal advice, and no substitute for a lawyer on anything consequential.
Where you sit in the Act
If you decide why and how personal data is processed, you are a Data Fiduciary. The customer is the Data Principal. A messaging platform you use processes data on your instructions as a Data Processor. The obligations land on you, not on your vendor, and you cannot contract them away.
Consent under the Act
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. Two consequences matter in practice:
- Bundled consent fails. One tick covering order updates, marketing, profiling and partner sharing is not specific.
- Conditional consent fails. Refusing service unless someone accepts marketing makes the consent not free.
The notice requirement
At or before collection you must tell people, in plain language, what data you are collecting, for what purpose, how to withdraw consent, how to exercise their rights, and how to complain to the Data Protection Board. It must be available in English and in the Eighth Schedule languages.
Withdrawal must be as easy as giving
If consent was a tick at checkout, withdrawal cannot require a phone call during office hours. Replying STOP is a good mechanism precisely because it is easier than the opt-in was.
Rights you must be able to service
- Access — a summary of the personal data you hold and who you shared it with.
- Correction, completion and updating.
- Erasure, once the purpose is served and no law requires retention.
- Grievance redressal, with a published route and a response.
- Nomination of someone to exercise rights on their behalf.
Being able to answer "what do you hold about me" within a reasonable window requires knowing where phone numbers live across your systems. For most businesses that inventory is the real work.
Children
Anyone under 18 is a child under the Act. Processing their data needs verifiable parental consent, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited. If your customer base could plausibly include minors, this needs a deliberate answer rather than an assumption.
Breach notification
Personal data breaches must be reported to the Data Protection Board and to affected individuals. There is no materiality threshold to hide behind, so you need a defined internal path — who is told, who decides, who notifies — established before you need it.
A short practical checklist
- Separate consent per purpose, each recorded with timestamp, wording and source.
- A published privacy notice in plain language, kept current.
- A named grievance officer with working contact details.
- A withdrawal mechanism at least as easy as the opt-in.
- Retention periods defined, and deletion that actually runs.
- Written terms with every processor handling your customer data.
Most of this is good practice regardless of the statute. The Act mostly makes it enforceable.