DPDP Act: What will it take for marketers to master the data game

The Ministry of Electronics and Information Technology (MeitY) on January 3, 2025, unveiled draft regulations to operationalise the Digital Personal Data Protection (DPDP) Act, 2023. Enacted last August, the act establishes a comprehensive legal framework for the processing of digital personal data to safeguard citizens’ privacy.

Data platforms, including e-commerce and online gaming companies, and social media websites, will now have to delete users' personal data within three years of it becoming obsolete or no longer necessary for its original purpose.

The marketing world is abuzz with questions following the introduction of new data regulations and what will be their way out?

For Rajiv Dingra, founder and CEO of ReBid, a customer data platform, the answer lies in a strategic recalibration. According to him, the new law will likely necessitate investments in advanced data governance solutions and CDPs to ensure compliance.

Dingra emphasises the need for agility, stating, "More importantly, marketers will focus on deriving actionable insights from data within a shorter time and double down on strategies such as first-party data collection, consent management, and robust customer engagement campaigns to maximise value within the stipulated three years."

Kushal Sanghvi, chief revenue officer at iCubesWire, an adtech and influencer marketing agency, highlights the need for responsible data management. "It’s about time we had robust rules and regulations around data, especially considering how much data marketers handle across various touchpoints."

Sanghvi notes that many marketers already use CDPs or similar centralised data repositories, but the new regulations will require them to deepen their understanding of data's value.

"This act will push marketers to understand the value of their data, segment and prioritise it effectively, and ensure it is managed responsibly"

Kushal Sanghvi, iCubesWire

The DPDP Act's three-year data retention limit necessitates a strategic recalibration for marketers. They must optimise campaigns within this timeframe, prioritising consent-driven data collection and timely, impactful engagement.

Hemal Majithia, founder and chief oktomind at Oktobuzz, a digital marketing agency, says the approach will differ based on industry-specific dynamics. "Three years is a reasonable timeframe for most industries with shorter sales cycles, like FMCG or e-commerce," he says.

However, for sectors such as real estate or education, where customer journeys are often longer, a more nuanced strategy will be essential.

"If we’re helping students prepare for exams like NEET [National Eligibility cum Entrance Test] or ACCA [Association of Chartered Certified Accountants], we could explicitly state that data will be stored for three years or request user consent to retain it longer for alumni benefits or career guidance," Majithia explains.

Shrenik Gandhi, co-founder and CEO, White Rivers Media, a digital marketing agency, sees the DPDP guidelines as a turning point for consumer data practices. He advocates for a shift from "data hoarding to data harmony," stressing the importance of clear retention policies and consumer-centric measures.

"Pre-deletion notifications put consumers back in the driver’s seat, while stronger consent rules make ‘yes’ mean yes and nothing less"

Shrenik Gandhi, White Rivers Media

Gandhi highlights that for D2C brands, the stakes are particularly high. "D2C brands may have unique considerations compared to large FMCG conglomerates due to their reliance on first-party data for customer engagement."

Suraj Chaudhari, co-founder and CBO at Zlade, a shaving and intimate grooming brand for men and women, says that if one looks at what brands are spending to acquire each customer, most will need at least 3-5 years to recoup that cost.

"The sales generated from the customer over this period should justify the acquisition cost. However, the LTV/CAC calculation is disrupted by the new regulations"

Suraj Chaudhari, Zlade

Will marketers add clauses to the terms and conditions?

The DPDP Act demands a fundamental shift in marketing strategies. While prioritising compliance is essential, the ethical dilemma lies in ensuring marketers don't seek loopholes to circumvent regulations and maintain data collection practices.

Dingra cautions against such tactics.

"Marketers must tread carefully. Exploiting loopholes could lead to significant reputational damage and potential legal consequences, given the increased scrutiny on data privacy"

Rajiv Dingra, ReBid

Instead, he recommends a proactive approach rooted in transparency and trust. "A better approach would be to adopt transparency and prioritise customer trust by clearly communicating data usage policies and ensuring compliance through robust technology solutions," he adds.

Sourya Banerjee, policy head at Jajabor Brand Consultancy, a PR agency, highlights the regulatory safeguards that limit the use of ambiguous terms and conditions. "As per the current draft Rules, T&C can't be all bundled together," he explains.

"The rules require (i) an itemised description of such personal data; and (ii) the specified purpose of, and an itemised description of the goods or services to be provided or uses to be enabled by such processing"

Sourya Banerjee, Jajabor Brand Consultancy

Delivering personalised and targeted marketing campaigns

With stricter data retention limits imposed by new privacy regulations, marketers face the challenge of delivering personalized campaigns while maintaining consumer trust. This requires a delicate balance between effective engagement and full compliance.

Sanghvi shares that while there might initially be challenges, such as a reduced outreach base, this could lead to a healthier ecosystem.

Stressing the importance of consent and legitimate engagement, he states, "With proper consent and legitimate engagement, marketers can build more meaningful and effective campaigns. In the long term, this will result in a cleaner system where only interested consumers receive communication, leading to better outcomes for everyone."

Majithia highlights the operational benefits of the three-year data limit.

"Personalised marketing will require us to rely on precise, up-to-date data. The three-year limit ensures we don’t hoard irrelevant data, which can improve campaign efficiency"

Hemal Majithia, Oktobuzz

These regulations, according to him, push marketers to "innovate responsibly and strengthen user trust," ultimately fostering better relationships and outcomes.