DPDP questions, answered
Questions people actually ask, answered from the Gazette text. New ones added regularly.
Can I send WhatsApp marketing messages to customers whose numbers I already have?
Not just because you have the number. A phone number given for a booking or an order can be used for that booking or order under s.7(a), but a promotional message is a different purpose, and the DPDP Act has no...
2026-10-27
Does an NGO or charitable trust need verifiable parental consent to collect student data?
Yes, by default. The DPDP Act has no exemption for charities, NGOs or trusts, and anyone under 18 is a child (s.2(f)). Before processing a child's personal data, the trust must obtain "verifiable consent of the parent"...
2026-10-26
Does the DPDP Act apply to CCTV cameras in my office, shop or housing society?
Yes. Footage in which a person can be recognised is personal data under s.2(t), recording and storing it is "processing" under s.2(x), and a digital recorder puts it inside the Act under s.3(a). The Act never mentions...
2026-10-25
Does the DPDP Act require a cookie consent banner?
The DPDP Act never mentions cookies, so there is no "cookie law" in India. But a cookie or device ID that lets you single out a visitor is personal data under s.2(t), and the Act allows only two lawful bases for...
2026-10-23
Last updated . Report an error.