The Digital Personal Data Protection (DPDP) Act, first introduced by the Ministry of Electronics and Information Technology in August 2023 and passed in Parliament under the leadership of Union Minister Ashwini Vaishnaw, finally came into force on September 28, 2025.
Designed to safeguard consumer rights in the digital age, the legislation places strict limitations on how companies collect, process, and store personal data. For marketers, this marks the beginning of a new era in which data-driven strategies must align with a more rigorous privacy-first framework.
The act is now live, and brands are busy rewriting their game plans. The DPDP Act restricts the ways marketers can track online behaviour, retarget audiences, and leverage third-party data, tools that have long been central to digital advertising. This shift is pushing teams to rethink behavioural targeting, prioritise transparency, and invest in privacy-respecting alternatives that don’t compromise compliance.
For marketers, the challenge is twofold: to maintain meaningful customer engagement and to safeguard return on investment (ROI). In place of intrusive data practices, strategies such as contextual advertising, first-party data collection, and deeper brand storytelling are emerging as frontrunners. The industry is now preparing for a balancing act, finding creative ways to connect with audiences without overstepping the new legal boundaries.
Rajiv Dubey, VP and Head of Media, Dabur India, shares that the brand is still in early days for the DPDP Act, but has already initiated a companywide readiness programme to ensure compliance across all functions. He adds that the company has trained teams, strengthened processes, and put the right frameworks in place so that consumer trust and legal obligations are fully safeguarded. “While our approach to behavioural targeting and segmentation will evolve as the rules are operationalised, our immediate priority is compliance,” he states.
Dr Angeline Gautami Fernando, Associate Professor - Digital and Social Media Marketing, Business Analytics; Great Lakes Institute of Management, Chennai; also believes that the act is bringing major changes. As businesses can no longer access consumer data without consent, it becomes difficult to continue with traditional strategies. She further adds that if companies have collected data without consent, they will now be required to delete it. Third-party data access will also no longer be available.
“This is going to impact sectors like e-commerce, retail, and financial services, which traditionally rely heavily on such data to reach customers. Performance marketing, which is relatively cost-effective, will face challenges. Companies will now also have to invest in building consent mechanisms, auditing systems, and compliance barriers. So, at least in the initial stages, it’s going to be a difficult transition,” she remarks.
Alternative data-driven approaches
With the implementation of the act, marketers are now turning to alternative data-driven approaches ranging from first-party data to investing in tools that enhance relevance without breaching trust. For many, this means leaning on new data practices and rediscovering old ones in fresh, tech-enabled ways.
“Internally, we are building systems to capture and activate consented data, from website interactions, chatbot journeys, WhatsApp signups, feedback forms, and influencer campaigns that include clear opt-ins,” says Hemal Majithia, Founder and Chief OktoMind, OktoBuzz, a digital communication agency. He explains that the goal is to structure this data so it’s “compliant, usable, and mapped to audience personas instead of individual level IDs.” Majithia adds that on the media side, contextual targeting is making a comeback, with ad platforms now offering clusters based on interests and engagement signals rather than past browsing behaviour.
Kartik Mehta, Head of Asia and CBO, Channel Factory, a global technology and data platform, sees the trend in similar terms but with sharper technological tools. “Contextual intelligence, AI-powered tools can now analyse video, text, and imagery to ensure ads are placed next to the most relevant and brand-suitable content,” he says, noting that this shift both respects privacy norms and boosts engagement. He also points out that “First-party and consent-driven data are becoming invaluable, especially when combined with privacy-safe modeling such as anonymised look-alikes and sentiment-based targeting.”
Travel and event management company Tamarind Global is also embracing privacy-first strategies to maintain campaign effectiveness and ROI as the DPDP Act comes into force. The company is recommending tools and frameworks that respect user consent while ensuring marketing outcomes remain robust. “A privacy-first framework doesn’t mean compromising performance, it often improves it instead,” says Siddharth Kadri, General Manager – Marketing, Tamarind Global.
He states that the strongest results now come from first-party and zero-party data, collected through CRMs, communities, and opt-in experiences such as surveys or gamified quizzes. “These approaches reward customers for sharing accurate information while deepening engagement,” Kadri adds.
To put this into practice, the company is advocating the use of consent management platforms (CMPs) for capturing and managing permissions, alongside privacy-enhancing technologies such as anonymisation and clean rooms that enable safe audience modeling.
Campaigns are guided by contextual advertising, AI-based personalisation with non-identifiable data, and automation tuned to user intent. With the Act in play, marketers find themselves charting through unmarked waters, where grey areas demand sharper navigation than ever.
Vishal Mehta, Equity Partner, VERTICES PARTNERS, a law firm, warns that with the framework, there are specific aspects that marketers should be particularly cautious about, especially when it comes to tracking consumer behaviour. One area generating significant uncertainty is advertising aimed at children. “Under Section 9 of the Act, businesses must obtain ‘verifiable parental consent’ before collecting any data from minors,” he explains.
Mehta adds that Section 9(3) further restricts targeted advertising and behavioural tracking for younger audiences, creating challenges for industries like gaming, social media, and e-commerce, where personalised ads often rely on consumer data. “This restriction means that personalised, behaviour-based marketing directed at children will likely be off-limits,” he notes.
Mehta highlights several grey areas that marketers need to navigate carefully, “How platforms should verify a user’s age, whether broad-based profiling of adults could be challenged as intrusive, and whether advanced analytics or predictive modelling exceeds the ‘stated purpose.’” He also points to the importance of consent design, noting that pop-ups and default opt-ins must be handled with care.
Brands are exploring ways to balance compliance with performance, experimenting with first-party insights, contextual advertising, and AI-driven personalisation to ensure campaigns remain impactful without overstepping new legal boundaries.
Marketers are bracing for an initial period of adjustment, but experts predict long-term gains in campaign performance and ROI. Vinay Tamboli, CEO – Data and Insights at LS Digital, says that brands that relied heavily on third-party signals may see a dip in reach and targeting detail at first. “Those investing in first-party data, server-side activation and privacy-safe collaborations will see stronger engagement, better conversions and more measurable ROI.”
He adds that campaigns built on secure data and validated audiences will perform better because they’re more relevant to the customer, grounded in trust and genuine relevance, not intrusive tracking.
Echoing this, Vaibhav Velhankar, Co-founder and Chief Technology Officer, Segumento, an AI-driven, privacy-focused data intelligence platform, notes that “In the short term there will be some disruption. If you’ve been leaning heavily on third-party behavioural data, your targeting precision may take a hit at first.” Yet he emphasises the upside, explaining ROI might look better over time. “When people know their data is being handled responsibly, they tend to engage more openly. Campaigns built on trust usually see better conversion and stickier relationships,” he adds.
Velhankar also highlights the competitive advantage, adding, “Companies that figure out compliant, creative ways to use data early on will stand out, because clients will actively prefer to work with partners who respect privacy.”
Bala Kumaran, Founder and CEO of BrandStory Digital, reiterates that brands might need short-term adjustments, especially on the reach aspect which will need recalibration given that there will be no third-party data. However, he says that “Audiences who share their data with explicit consent are more engaged, leading to higher conversion rates and deeper loyalty. This reduces wasted spend while upgrading customer lifetime value.”
Kumaran conveys that “The DPDP Act encourages smarter, more respectful marketing that ultimately strengthens trust, builds sustainable growth and delivers stronger returns for better brand performance.”
Looking ahead, the DPDP Act is set to fundamentally reshape digital marketing in India, creating both challenges and opportunities for brands. While initial adjustments in targeting precision and reach are expected, companies that invest in consented first-party data, contextual strategies, and privacy-safe technologies are likely to see stronger engagement, improved conversions, and more sustainable ROI over time.
.png)
