Understanding the implications of the Digital Personal Data Protection Bill on digital advertising & marketing

Digital Personal Data Protection Bill is expected to reshape the landscape of digital advertising and marketing in India. Industry experts have varying views on the bill's implications. Here’s what they have to say.

In a significant stride toward safeguarding individual privacy in the digital age, Lok Sabha (lower house of the Indian Parliament) passed the Digital Personal Data Protection Bill (DPDP) on August 7, 2023. This landmark legislation comes after years of deliberation and is expected to reshape the landscape of digital advertising and marketing in India. 

With an increased focus on data protection and accountability, the bill carries implications that will transform the way businesses collect, process, and utilize personal data for advertising and marketing purposes.

Guidelines and Challenges

The bill introduces the concept of 'data fiduciaries,' which refers to entities, whether public or private, that collect and process personal data. These entities are now required to adhere to strict guidelines for data collection, processing, and storage.

To ensure alignment with the evolving legal framework, Naresh Gupta, Co-founder of Bang In The Middle, emphasizes that every data-driven business will have to redo their data privacy policies.

He highlights the current lack of clarity regarding data ownership, citing scenarios where consumer transactions on a website like X raise questions about what information is owned by the platform versus the consumer.

Welcoming the restrictions on data harvesting, Gupta said, “The new bill is clear in defining the ownership and with data portability options being proposed, the misappropriation of data will become difficult. It's actually good that digital media sites, ad platforms, and social media sites cannot harvest my data without my permission and sell me stuff using that data.”

Under the bill, data fiduciaries can only process personal data after obtaining explicit and informed consent from the individuals concerned. This provision ensures that users have a clear understanding of how their data will be used before granting permission.

Vikas Chawla, Co-Founder, Social Beat, opines that the DPDP Bill is a welcome first step as it does have a lot of provisions regarding taking consent, on how it needs to be stored and to report data breaches.

Acknowledging the challenges that might arise in implementation, Chawla said, “Age verification and parental consent for anyone below 18 years is surely going to be complex to execute.” 

Chawla believes that in the mid to long term, the bill will have a positive impact on the industry by enhancing data privacy and security.

Also Read: Expert Speak: Evergreen Independence Day campaigns that became a defining moment for the creative industry 

Putting Consumer in the Driver’s Seat

The bill focuses on regulating the processing and protection of personal data, emphasizing the compulsion of informed consent and transparency. 

Swati Nathani, Co-Founder and Chief Business Officer, Team Pumpkin, believes that the DPDP Bill acts as the protector of trust between businesses and their valued audience in the constantly evolving world of digital communications. 

She explained that the DPDP Bill is seen as a foundation to create significant relationships and will only motivate to craft marketing narratives that respect the privacy of personal information.

In a world where interactions are essential, this bill is a constant ally, allowing us to create relationships that last based on trust, integrity, and mutual dedication to a harmless digital society.

Swati Nathani

The legislation necessitates businesses and advertisers to inform individuals about the data they retain and how it is being utilized. This includes details such as the purpose of data collection, minimal data retention requirements, and protective measures to achieve transparency.

For Chaaya Baradhwaaj, Founder & Managing Director, BC Web Wise, DPDP Bill represents a pivotal step toward fostering trust in the digital ecosystem. 

Highlighting the opportunities it presents to champion responsible practices, she said, “Embracing transparency and user consent will redefine engagement and enhance customer relationships. This landmark legislation not only underscores the paramount importance of safeguarding individuals' personal data but also marks a paradigm shift in how digital advertising and marketing strategies are conceived and executed.”

Baradhwaaj added that the agency focuses on delivering personalized digital experiences within a framework that respects user consent and data rights.

By highlighting data protection and accountability, the bill emphasizes the responsibility of internet companies, mobile apps, and entities dealing with individuals' data. 

Rashid Ahmed, Digital Head, Infectious Advertising emphasizes that the DPDP Bill could lead to a significant transformation in digital advertising and marketing practices. 

Informed Consent will become the norm while collecting personal data.

Rashid Ahmed

He explained that while many Indian entities already deal with European and US regulations, personal data collection and processing in India will require explicit, informed consent from individuals.

He said, “Marketers will be compelled to acquire unambiguous consent for data collection especially where data of minors or persons with disability is concerned, amplifying the significance of transparency and trust-building.”

Bill Pushes Ethical Data Usage

The bill enforces ethical data usage norms, emphasizing accuracy, storage, and protective measures. This reflects a shift towards responsible data handling practices.

Ahmed explained the legislation which focuses on digital personal data, would directly impact first-party data collection accentuating the indispensable need for a Consent Management Framework within Customer Data Platforms (CDPs). Businesses and advertisers will need to inform individuals about any personal data retained and how the data is being utilised. 

He said, “Ethical Data Usage norms, including aspects like the purpose of data collection, minimal data retention requirements, and policies like accuracy, storage, and protective measures will need to be communicated. The DPDP Bill harmonizes with international data protection frameworks, aligning considerably with the EU's GDPR, while being tailored to be suitable for India. Advertisers will need to consolidate individuals’ data to combat data fragmentation challenges, which would necessitate having a unified customer data management framework in place.”

In line with the DPDP Bill's requirements, marketers will need to deal with the complexities of integrations between advertising platforms, customer relationship management (CRM) platforms, and any other systems which draw on and utilize individuals’ data. 

Angad Singh Manchanda, CEO & Founder, Chimp&zInc sees the recent passage of the DPDP Bill as a significant milestone that reinforces India's digital landscape. 

This achievement is cause for celebration, as it sets the stage for a more trustworthy and secure environment that is essential for businesses to thrive. By bestowing individuals with fundamental privacy rights, including the ability to access, correct, and erase their data, the bill underscores our nation's commitment to safeguarding its citizens.

Angad Singh Manchanda

While he commends the bill for empowering individuals with fundamental privacy rights, he points out the need to address emerging challenges posed by AI-generated content and deep fakes in future iterations of legislation.

He said, “It's worth noting that the bill currently lacks specific provisions addressing the emerging challenges posed by AI-generated content and deep fakes. As our digital landscape continues to evolve, it will be essential for future iterations of legislation to encompass these intricate issues to ensure comprehensive protection for all aspects of data usage and manipulation.”

Experts shared a mix of optimism and caution about the implications of the DPDP bill. From their insights, it's clear that the bill will help the industry take a step forward towards prompting a transformation in strategies, pushing businesses toward more responsible, transparent, and customer-centric practices.

While the bill is hailed as a crucial step toward data ethics, protection, and user consent, it also brings forth challenges related to consent acquisition, data integration, and adaptation to the evolving regulatory landscape.