On January 3, 2024, the Digital Personal Data Protection (DPDP) Act entered a new phase with the release of its draft rules by MeitY (Ministry of Electronics and Information Technology). The draft rules aim to overhaul how companies handle personal data, marking a new era in data privacy. As these rules enter the public consultation phase, marketers everywhere must brace for the implications of these regulations on their data collection strategies.
These new rules introduce significant shifts, particularly in how businesses manage consent and data withdrawal. Marketers will now face a more stringent environment, making it harder to gather data for targeting, which could undermine the effectiveness of their campaigns.
Let’s break down the impact of these draft rules and what marketers need to do to adapt.
What are the DPDP Draft Rules?
The DPDP draft rules aim to safeguard individuals’ personal data, enforce stricter guidelines on consent withdrawal, and make companies more transparent about how they collect and process personal data.
-
Verifiable parental consent for children: One of the standout features of the draft is the verifiable consent requirement for minors who wish to open social media accounts. This is a direct response to growing concerns about children’s online safety.
-
Clear communication from data fiduciaries: The Data Fiduciary (the organisation collecting data) must provide a standalone notice to the Data Principal (the individual providing data) explaining what data is being collected, why it is needed, and how long it will be stored.
These rules are being watched closely because they not only affect businesses in India but could have a ripple effect on global marketers who rely on the country’s data.
How Do the DPDP Draft Rules Affect Marketers?
The DPDP Act brings several significant changes that will directly impact how marketers collect and use personal data. Here are some key elements to consider:
1. The Withdrawal of Consent
Marketers are no strangers to collecting personal data for the purpose of targeted marketing. However, under the DPDP rules, individuals will have the right to withdraw their consent at any time.
-
What this means for marketers: It makes it difficult to collect third-party data over long periods. With more users withdrawing consent for data usage, targeting accuracy will diminish, reducing the effectiveness of ad campaigns and personalised recommendations.
-
Example: If a user withdraws consent from a social media platform, marketers will no longer have access to their data, making it challenging to track their behaviour for future campaigns.
2. Data Erasure
The DPDP draft rules also require that data must be erased after a specified period if the Data Principal does not engage with the Data Fiduciary.
-
What this means for marketers: The time limit on data storage limits the lifespan of data that marketers can use for retargeting. In turn, this will likely reduce the accuracy of audience segmentation and lead to less personalised advertising.
-
Example: Let’s say a user provides consent for their data to be collected for a marketing campaign. After a period of inactivity, the data would be erased unless the user engages with the company again. This dynamic creates a challenge for marketers who rely on historical data to shape their advertising strategy.
3. Stronger Parental Consent Requirements for Children
The verifiable parental consent for children who wish to access social media platforms is a key part of this legislation. This, along with similar bills in other countries like Australia, poses a challenge for marketers who want to target younger audiences.
-
What this means for marketers: The restrictions around collecting data from children under the age of 16 will make it harder for businesses to market to younger demographics. Marketers will need to find compliant ways to engage with this audience while ensuring that they meet parental consent requirements.
-
Example: To run targeted ads on social media for younger users, marketers will now need to obtain parental consent for each child. This not only creates a logistical burden but also limits the data marketers can use.
4. Clearer Communication and Transparency
Marketers will also face tighter rules around how they communicate with customers about data collection.
-
What this means for marketers: Companies must be transparent in their data collection practices, providing clear notices about the purpose of data collection, how long it will be stored, and how individuals can opt out. Marketers will need to ensure that their data collection processes are fully compliant and that all communication is clear and straightforward.
-
Example: A fitness app must clearly state why it’s collecting health data, how it will be used, and provide an easy way for users to withdraw their consent. Failure to do so could result in penalties and a loss of trust from users.
What Can Marketers Do to Stay Compliant?
While the new rules present significant challenges, there are several steps marketers can take to stay compliant and ensure their strategies remain effective:
1. Innovate Data Collection Methods
Marketers must adapt by creating new ways to collect authentic data while respecting individuals’ privacy. This includes leveraging first-party data, user consent, and transparency in data practices.
2. Focus on Consent Management
Implement a robust consent management system that allows users to easily opt-in and opt-out. This will help businesses maintain a healthy relationship with customers and ensure continuous consent.
3. Minimise Data Collection
Be strategic about what data you actually need. Collect only the essential data and ensure it aligns with the purpose of your marketing campaign. This reduces the likelihood of data breaches and compliance issues.
Conclusion: Navigating the Future of Digital Marketing with DPDP
The new DPDP draft rules mark a significant shift in the digital marketing landscape. Marketers will need to adapt quickly to ensure they comply with these regulations while still being able to collect valuable data for targeted campaigns.
The shift towards more transparent data practices and increased control for consumers over their personal information is part of a larger trend in data privacy. As marketers, we need to embrace these changes and find innovative ways to engage with customers while respecting their privacy. Staying compliant and transparent will be key to thriving in this evolving landscape.
Relevant Links for Further Reading:
Photo credit: MediaNama
