DPDP Act is here: New rules to rewire how brands and ad agencies collect, use, and prove data consent

A new playbook is taking shape for India’s ad world as the Digital Personal Data Protection (DPDP) Act kicks in.

Agencies say the law’s sharp focus on explicit consent and data minimisation is forcing them to rethink how consumer information is collected, used and protected across campaigns.

The Act was officially notified by India's Ministry of Electronics and Information Technology (MeitY) on November 13, 2025. Since then, the Act has nudged agencies to change a few practices.

"The DPDP Act requires us to re-examine how we collect, store, process, and share personal data across all touchpoints, impacting marketing workflows, CRM (customer relationship management) pipelines, analytics setups, HR data handling, and how we work with third-party platforms," Prashant Puri, Co-Founder & Chief Executive Officer (CEO), AdLift (Liqvd Asia), told Moneycontrol.

He added that even though many brands already follow global standards like General Data Protection Regulation (GDPR) or Central Consumer Protection Authority in India (CCPA), DPDP adds India-specific requirements, especially around consent, purpose limitation, data minimisation, and vendor accountability.

The Act requires us to follow a stronger privacy-first process, said Ankit Chowdhary, CEO, OG media 360.

Here is what they now follow:

• Taking clear and explicit consent before collecting any personal data
• Storing data securely and limiting who can access it
• Using only opt-in forms for newsletters, lead magnets and campaigns
• Ensuring all tools and vendors they use follow DPDP standards
• Training team to handle data responsibly

They have already made updates such as:

• A consent tracker for all collected data
• Collecting only the minimum information needed
• Updated contracts and Non-Disclosure Agreements (NDAs) with clients and partners
• New Standard Operating Procedures (SOPs) for outreach so that no one receives unsolicited communication

Chandan Sharma, General Manager, Digital Media, Adani Group, also listed down methods that ad agencies are looking to tighten, including data minimisation. "We can no longer collect ‘nice-to-have’ data. Only campaign-critical data is being stored for the shortest possible period."

• Vendor due diligence: DPDP-aligned audits are being conducted on all the partners, like marketing technology (martech)/analytics, including their data storage location.
• Internal Governance: The agencies must create a DPDP playbook, mandatory employee training, new SOPs for data ingestion, retention, anonymisation, and destruction, Sharma added.

Agencies like Excellent Publicity are now following more explicit and transparent consent mechanisms. "This is to ensure users have clear visibility into how their data is used, and adhere to stricter data-minimisation practices," said its Co-founder, Vaishal Dalal.

He added that the Act also requires agencies like theirs to maintain more robust audit trails, update privacy notices, enable user rights like data access or deletion, and embed privacy-by-design into our campaign planning.

These practices are making agencies more accountable, said Yasin Hamidani, Director, Media Care Brand Solutions. "Creative and media planning teams now work closely with legal and tech to ensure every data-driven activity from audience targeting to analytics is compliant, transparent, and purpose-specific."

But these SOPs are coming at a cost.

For mid–to large-sized agencies, costs have risen by 12–18 percent across legal reviews, data audits, secure storage, consent management tech, and staff training, Sharma noted.

Chowdhary said that for an agency of their size, the cost increase is around 8 to 12 percent of operational overhead.

The smaller agencies might see bigger implications, as DPDP compliance requires dedicated processes, not ad hoc fixes, Sharma said.

On the other hand, Puri said that for companies dealing with large volumes of personal data, the increase may be significant.

Hamidani pointed to ad agencies now needing data ethics officers and consent frameworks embedded into every stage of the media planning lifecycle.

"These costs are largely front-loaded, and we expect them to stabilise once the new systems are fully integrated," Dalal said.

Even if the infrastructure is not the biggest issue, operational discipline is one of the new adaptations that can have an adverse effect, resulting in extra money and time for every campaign, Sharma noted. "Every campaign now needs proper documentation, proof of consent, secure data handling, and breach-readiness."

It’s not just ad agencies feeling the heat. Brands, too, are waking up to a new reality: data is no longer “free”, Sharma said. “Costs will go up because authenticated data costs a lot more.”

Ad slot buying hasn’t taken a hit in volumes yet, Hamidani noted, but the logic powering targeting is now under tighter scrutiny. “We’re moving from reach-based buying to ‘responsible reach,’ where every impression has to clear the privacy-and-consent bar. Clean, compliant targeting comes at a premium,” he said, adding that costs could rise 5–10 percent, especially in data-heavy categories such as BFSI, healthcare and e-commerce.

Chowdhary echoed the point, saying privacy-compliant advertising will cost more as platforms charge extra for compliant data processing, agencies pass on compliance overheads, lead generation shifts from quantity to quality, and new secure systems add to the bill.