Data Protection Law: Time to revisit ad strategies?

Out of the four new bills signed into law by President Droupadi Murmu on August 12, none has garnered more scrutiny and commentary than the Digital Personal Data Protection Bill, now a supposedly tough act that all digital players in the country have to follow.

While the law is stated to safeguard the interests (literally and figuratively) of the ‘digital nagrik’, as defined by the central government, as they navigate the digital ecosystem and its many layers, walled gardens and the great outside, it also means the introduction of a raft of rights and duties for so called ‘Data Fiduciaries’ (persons, companies and government entities who process data), ‘Data Principals’ (the person to whom the data relates), and financial penalties for breach of rights, duties and obligations.

Given that the entire digital advertising ecosystem depends on consumer data, exchange4media asked industry experts how this will impact publishers, local and international advertisers, and of course, media exchanges

What It Means

Vivek Das, CEO, FoxyMoron (Zoo Media), observes that India’s Data Protection Bill has defined the role of Data Fiduciaries who will be responsible for ensuring 100% compliance and also raising complaints to the Data Protection Board in case of violation.

“The key point to note here is that while there is no provision of ‘right to be forgotten’, there is a clear requirement for deletion of data once the purpose has been met. However, in case of large-scale and long-term data users like social media platforms, this is a loophole as they can continue to store the data in perpetuity especially because the consumer doesn’t have the right to be forgotten,” he says.

This will especially be true for local platforms whose business is entirely in India. However, global platforms have to also comply with GDPR (the EU’s General Data Protection Regulation, the gold standard of data regulation) which requires them to provide users with a mechanism to ask for deletion of their data completely.

Mitesh Kothari, Co-founder and Chief Creative Officer, White Rivers Media, believes the bill could also necessitate a re-evaluation of targeted advertising strategies due to potential restrictions on data processing for profiling and targeting. “Advertisers must align their initiatives with the bill's provisions to ensure responsible data handling, customer trust, and privacy-centric branding. While data management is facilitated through consent and compliance measures, challenges may arise around AI-generated content and potential fraudulent activities,” adds Kothari.

Vivek Kumar Anand, Chief Business Officer, DViO Digital, points out that many countries already had similar bills in place, meaning it shouldn't be challenging for Indian companies or those operating in the Indian market to navigate through this and implement the best practices that are already established.

“The responsibility lies with both - the entity collecting the data and the entity using the data in any capacity. A simple yet crucial keyword to ensure the safety of all parties is consent. Most reputable media exchanges already have data privacy measures in place, while those that do not will now need to appoint data security personnel or establish a dedicated department/team for compliance,” he notes.

Das says the law should also be able to address the failure of the DND regulation that was brought in to control the menace of unsolicited telemarketing activities. “However, it all depends on proper enforcement of the regulation which is a fundamental challenge in India across the law enforcement system,” he says.

As far as the global/international publishers and media exchanges are concerned, it should not be too difficult for them to become compliant. The same cannot be said for local publishers (or local brands for that matter).

Das says “In that sense, the bill forces compliance thus making them ready for global markets. The responsibility and accountability are greater for media exchanges, which in essence are data fiduciaries. In the short term, it will increase both Capex and Opex as they will need to invest in appropriate data management systems, and also refresh user consent periodically.”

Advertisers will also need to adopt a set of stringent practices that demands checks and balances from publishers and exchanges so that they buy audiences without the fear of being persecuted under the law.

Deep Impact

Das says the heaviest impact of the law will be on the publishers and exchanges, “at least in the short term as stated earlier. Despite increase in costs, they will not be able to pass the entire increment to advertisers especially in the current media market conditions. While it is great from the lens of ethical use of data, it will have a severe downside for smaller local publishers.”

“Marketers would likely need to obtain explicit and informed consent from individuals for data processing, enhancing transparency and understanding of data usage. Additionally, if provisions for cross-border data transfers are included, compliance with specific requirements might affect international partnerships and data storage practices,” observes Kothari.

As for advertisers, according to Anand, heavily impacted sectors will be the likes of telecom, banking, insurance, payment gateways, and e-commerce websites, which handle substantial amounts of personal data daily.

“They will now have to verify the presence of consent for all collected first-party data. If not obtained, they must initiate this process to ensure protection against data misuse,” he says, adding, “Data localization will play a pivotal role, leading to an increased demand for local data centre service providers such as Sify Technologies, Tata Communications, AdaniConneX, and others.”

Kothari adds collaborative efforts are vital for successful navigation of the bill's complexities, saying, “Ultimately, investing in data fortification is crucial for safeguarding privacy and fostering innovation in India's evolving digital landscape.”