This is a moment for marketers to prioritise transparency and trust: Akshayy S Nanda

The e4m Martech India Conference 2024, held in Delhi-NCR on November 11, saw a deep dive into the cutting-edge trends, tools, and strategies that are shaping the future of marketing, led by the industry’s top experts.

Among the litany of sessions of the day Akshayy S Nanda - Partner - Saraf and Partners, spoke at a fireside chat with Shantanu David, Special Correspondent, about ‘Data Privacy and Compliance: What Marketers Need to Know,’ which delved into the nuances of data privacy and compliance, shedding light on what the Digital Personal Data Protection Act (DPDPA) means for marketers.

Over the course of the conversation, Nanda laid out the genesis, implications, and opportunities embedded in the new legislation, offering a roadmap for businesses as they brace for significant changes.

Nanda began by tracing the origins of the DPDPA to the landmark Puttaswamy case of 2017, where the Supreme Court of India upheld privacy as a fundamental right. "Informational privacy was recognized as an essential facet of this right, leading to the Supreme Court urging the government to introduce a comprehensive data protection framework," he noted. After multiple iterations, the Act was finally passed in August 2023, though it awaits full implementation pending the release of accompanying rules. “We anticipate the rules to be out soon, and once they are finalized, enforcement will follow, with organizations required to overhaul practices to ensure compliance,” he added.“

The DPDPA, according to Nanda, draws heavily from global data protection frameworks like the GDPR in Europe, CCPA in California, and PDPA in Singapore, embodying principles of lawfulness, fairness, transparency, purpose limitation, data minimization, and accountability. "It’s based on the same guiding principles—only collect what you need, use it for what you told the user you would, and ensure robust security safeguards,” he explained.

He was candid about the challenges the Act presents for marketers, especially regarding consent requirements. “Consent under the DPDPA must be free, specific, informed, unambiguous, and given with a clear affirmative action,” he stated, underscoring that marketers can no longer rely on pre-ticked boxes, implied consent, or bundled agreements. “The aim of the law is to put individuals in the driver’s seat. They must have genuine control over how their data is collected and used. This means separate consent for every processing activity, whether it’s delivering a product or sending marketing messages.”

Highlighting the broad definition of personal data, Nanda noted that it extends beyond basic identifiers like names and emails to include inferred or derived data obtained through analytics. "Even something like tracking how harshly someone brakes their car becomes personal data if it can be tied to an individual," he said. He also emphasized the stringent regulations around children’s data, calling it a potential “sleepless night” for marketers. "For anyone under 18, you cannot process their data without verifiable parental consent. And merely displaying a banner asking if the user is over 18 won’t suffice.”

Nanda acknowledged the uphill battle organizations face in meeting the law’s demands, from rewriting privacy policies in plain language across India’s 22 official languages to ensuring compliance even with third-party vendors. However, he argued that the challenges also bring opportunities. “This is a moment for marketers to prioritize transparency and trust. Be clear about what data you’re collecting and why. Respect consent boundaries. Trust is going to be the new oil in the digital economy,” he asserted. He advised marketers to reframe their approach, treating privacy not as a burden but as a competitive differentiator. “Globally, companies are already using privacy as a selling point. Respect for privacy is becoming a non-price parameter of competition.”

On the practical side, Nanda urged organizations to act swiftly. “Start with a data audit. Understand what data you’re collecting, how it flows through your organization, and who you’re sharing it with,” he recommended. He stressed that compliance isn’t just about avoiding hefty penalties, which can reach ₹250 crores for a single violation, but also about fostering consumer trust and safeguarding reputation. "The consumer of tomorrow will reward brands they trust with their data, provided they’re transparent and responsible."

Closing on a reflective note, Nanda remarked, “For years, we’ve heard that data is the new oil. I believe that era is over. Trust is the new oil. Gain your users’ trust, and they will give you consent to use their data—on their terms. This is not just compliance; it’s the future of digital business.”

With the DPDPA poised to reshape the Indian digital landscape, Nanda’s insights serve as both a warning and an invitation. Marketers have an opportunity to lead with responsibility, harnessing privacy as a cornerstone of trust and innovation in the years ahead.