Issue 05

First-party data under the DPDP Act: what brands must change before May 2027

13 October 2026

Flicp Editorial

The rules of the offer desk

India's data protection rules apply in full from May 2027. What the Act asks of brands on consent, children, breaches and deletion, and why a clear value exchange matters more than ever.

A shopper in Kochi buys a pressure cooker from a kitchenware brand's website. A week later, their phone starts ringing: a credit card offer, an insurance agent, a stranger selling a "free" home loan consultation. They never gave any of these people their number. They did give it to the kitchenware brand.

Maybe the brand didn't leak it. Maybe a delivery partner did, or a marketing vendor, or nobody can say. The shopper doesn't care about the difference. The next time a checkout page asks for their phone number, they'll hesitate, or type a fake one.

India's Digital Personal Data Protection Act, 2023 (the DPDP Act) is designed to change how that story ends. Its main obligations for businesses take effect in May 2027, which leaves brands roughly seven months from the date of this issue. This issue explains what's changing, why first-party data still matters, and how brands can build customer relationships that hold up under the new rules.

This is general information, not legal advice. If your business processes personal data, talk to your own lawyer about how the Act applies to you.

Indians are worried about their data

The trust problem is already visible in survey data.

A LocalCircles survey reported in March 2025, with more than 36,000 responses from 375 districts, found that 87% of respondents believed at least some of their personal data had been leaked into the public domain.
Asked who they thought had leaked it, 65% blamed telecom providers, 63% blamed e-commerce apps and sites and 56% blamed banks and financial services.
PwC India's Voice of the Consumer Survey 2024 found that 82% of Indian consumers saw protecting their personal data as the most important factor in trusting a brand.
The same survey found that 66% were willing to share data for more personalised experiences, provided their privacy was not compromised, and that 76% had privacy concerns about shopping on social media.

Those numbers point in two directions at once. Indian shoppers are suspicious, and e-commerce is near the top of their list of suspects. But most are still willing to share data with a brand they trust, in return for something useful. The DPDP Act effectively writes that bargain into law.

The timeline: what applies when

The Act was passed in August 2023, but most of it waited for rules. The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, with a phased start:

13 November 2025: provisions setting up the Data Protection Board of India took effect.
13 November 2026: rules on registering consent managers take effect, along with related powers of the Board.
13 May 2027: the substantive framework applies, including notice, consent, security safeguards, breach reporting and the rights of individuals.

Eighteen months sounded like a long runway in November 2025. Rebuilding sign-up flows, consent records, vendor contracts and deletion processes across a business takes time, and the runway is now more than half used.

What the Act asks of brands

The Act calls a business that decides how and why personal data is processed a data fiduciary, and the person the data is about a data principal. A few obligations matter most for brands that sell to consumers.

Consent that means something

Where a business relies on consent, the Act requires it to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. Pre-ticked boxes and "by using this site you agree" banners don't fit that description.

Under the Rules, the notice that asks for consent must be clear and understandable on its own, and must give:

an itemised description of the personal data being collected;
the specific purposes it will be used for, and a description of the goods or services those purposes enable; and
a way to withdraw consent and to exercise the person's rights under the Act.

The Act also says withdrawing consent must be as easy as giving it. If a shopper opted in with one tap at checkout, opting out shouldn't need an email to a support address and a two-week wait.

For marketing teams, the practical consequence is that "we collected the number at checkout, so we can use it for anything" stops working. Data collected to deliver an order is collected for delivery. Using it for promotional messages, or sharing it with a partner, needs its own lawful basis.

Children: no tracking, no targeting

Under the Act, a child is anyone under 18. Brands need verifiable consent from a parent or guardian before processing a child's personal data, and must not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, except where the government has granted an exemption.

For categories popular with teenagers, such as fashion, sneakers, gaming, snacks and beauty, that's a significant change. Campaigns that profile young shoppers by browsing behaviour, or loyalty programmes that sign up anyone without checking age, will need rethinking.

Security, breaches and deletion

Security safeguards. Fiduciaries must take reasonable security measures to prevent personal data breaches. This carries the Act's highest penalty.
Breach reporting. If a breach happens, the business must inform the Data Protection Board and affected individuals without delay, and give the Board a detailed report within 72 hours, unless the Board allows longer.
Deletion after inactivity. E-commerce entities with at least 2 crore registered users in India must erase a person's data three years after their last interaction, unless it's needed for legal reasons or account access, and must warn the person 48 hours before erasing it. Similar rules apply to large gaming and social media platforms.

Rights customers will be able to use

The Act also gives individuals rights they can use against a business, and brands will need processes to handle them at scale. A data principal can ask a fiduciary for:

a summary of the personal data being processed about them and what is being done with it, and the identities of other fiduciaries and processors it has been shared with;
correction, completion, updating and erasure of their data, including erasure once it's no longer needed for the purpose it was collected for;
grievance redressal, through a contact the business must publish; and
the right to nominate someone to exercise these rights if they die or become unable to.

Under the Rules, businesses must publish how these requests can be made and respond to them within a period they set, which may not exceed 90 days.

For a brand with lakhs of customers, that means building a request process rather than answering emails one by one. It also means knowing where each customer's data lives. A deletion request has to reach the CRM, the email tool, the loyalty programme and every vendor that holds a copy, not only the main database.

Larger businesses carry more duties

The government can notify some businesses as significant data fiduciaries, based on factors such as the volume and sensitivity of the data they process and the risk to individuals. These businesses carry extra obligations, including appointing a Data Protection Officer based in India, appointing an independent data auditor, and carrying out periodic data protection impact assessments and audits.

Most brands won't be notified. But large consumer platforms, and brands whose loyalty programmes hold detailed data on crores of customers, should watch for notifications and plan as if the extra duties might apply.

The penalties

The Act's schedule sets maximum penalties, which the Data Protection Board can impose up to:

₹250 crore for failing to take reasonable security safeguards to prevent a breach;
₹200 crore for failing to notify the Board and affected people of a breach;
₹200 crore for breaching the additional obligations on children's data;
₹150 crore for breaching the additional obligations of a significant data fiduciary; and
₹50 crore for most other contraventions.

These are ceilings, not fixed fines. The Board is expected to weigh factors such as how serious the breach was and what the business did to limit harm. They are still large enough to get a board's attention.

Consent managers

The Act also creates consent managers: registered, India-incorporated intermediaries that let people give, review and withdraw consent across many businesses in one place. Under the Rules, they need a net worth of at least ₹2 crore and must register with the Board, with registration opening in November 2026.

For brands, consent managers may eventually become another channel through which customers grant or withdraw permission. It's worth designing consent records now so they can accept changes from outside your own app.

Cookies didn't die, but first-party data still matters

For years, the marketing industry expected third-party cookies to disappear from Chrome, and "first-party data" became the answer to a problem that was supposedly coming. Then, in April 2025, Google said it would keep third-party cookies available in Chrome by default, managed through existing privacy settings, rather than phasing them out or adding a new consent prompt. Safari and Firefox already block many third-party cookies by default.

So the reason to invest in first-party relationships has changed. It's no longer mainly about losing a tracking technology. It's about:

Law. From May 2027, data collected without clear, purpose-specific consent becomes a liability, wherever it came from.
Trust. As the surveys show, shoppers share data with brands they trust, and withhold it, or fake it, from brands they don't.
Quality. Data a customer chose to give you, for a reason they understand, is more accurate than data inferred from browsing behaviour or bought from a list.

A value exchange shoppers can see

The brands that do best under the DPDP Act will be the ones where the exchange is obvious: the customer shares something specific and gets something specific in return.

A coupon is one of the clearest versions of that exchange. A shopper signs in and claims an offer; the brand learns that this person is interested in this product, in this city, through this channel. The purpose is easy to describe in a consent notice, and the shopper can see what they get for it.

That's the model Flicp is built around: coupons are claimed by signed-in customers and redeemed once, so brands learn about real customers who chose to take part, rather than buying audiences or inferring them. We are working through our own obligations under the Act ahead of the May 2027 deadline, and we'll write about what we learn.

What brands can do before May 2027

Map your data. List every place you collect personal data, from checkout and loyalty to contests, Wi-Fi sign-ins and in-store forms, and what each is used for.
Rewrite your notices. Replace general privacy statements at the point of collection with short, itemised notices that state the data and the specific purpose.
Separate the purposes. Keep consent for marketing separate from data needed to fulfil an order, and record each consent with the notice version the customer saw.
Make withdrawal one step. If opting in takes one tap, make opting out take one tap too, and make sure it reaches every system and vendor that uses the data.
Check for children. Identify products, campaigns and programmes that attract under-18s, and stop behavioural targeting of them.
Review your vendors. Agencies, CRMs, delivery partners and SMS providers that handle your customers' data need contracts and controls that match the Act.
Rehearse a breach. Run a drill to check that you can identify, contain and report a breach within 72 hours.

What this means for store owners

Neighbourhood stores collect personal data too: phone numbers for billing, delivery addresses, customer names in a notebook for credit. The Act applies to digital personal data, including data that is collected on paper and later digitised. A store that types customer numbers into a billing app, or shares them with a brand for a scheme, should know why it's collecting them and who it shares them with.

Coupon schemes that work through the brand's own platform can help here. When a customer redeems a coupon they claimed themselves, the store doesn't need to collect and pass on that customer's details to get paid.

Five questions to ask about your customer data

Can you list every place your business collects personal data, and the purpose for each?
Do your consent notices describe the specific data and purpose, or point to a general privacy policy?
How many steps does it take a customer to withdraw marketing consent?
Do any of your campaigns target or profile people who might be under 18?
If a vendor leaked your customers' data tonight, could you report it within 72 hours?

Sources

The Kochi shopper is an illustration, not a reported case. This issue summarises the DPDP Act and Rules for general readers; it is not legal advice, and the Rules' detail should be read in full with your counsel.

This newsletter is general information, not legal, financial or tax advice. Product details describe Flicp as it works today and may change.