The Digital Personal Data Protection Act, 2023 DPDPA) has transformed the data protection landscape. As businesses await its implementation, a key concern, particularly for B2C industries, is its impact on digital advertising and commercial communications. Advertising has become increasingly personalised. Businesses try to reach consumers most likely to engage with their products or services, often tracking users across websites, devices and platforms through technology. The collection and processing of personal data is essential to build detailed user profiles.

Unlike data protection frameworks in other jurisdictions, such as the EU, the DPDPA primarily allows consent as the legal basis for processing personal data. This is particularly challenging for businesses that rely on inferred interests rather than voluntarily provided user data. Although the DPDPA includes a legitimate use ground for data voluntarily shared by users, it is of limited use in advertising, where data is usually collected passively or inferred from online behaviour.

To comply with the DPDPA, businesses need to shift from broad-based data collection models to more focused and transparent practices. One approach is to restrict data collection only to that which is crucial for advertising. Businesses should ensure that privacy notices are straightforward, clear, and easily comprehensible. They must clarify how consumer data will be utilised for advertising and commercial communications.