In today’s digitized and connected world, the personal data is being collected at an exponential rate. Data is considered as the new oil. We are producing this in the form of digital footprints that we leave whenever we access a website, click a photo, make a phone call, etc. The digital footprint informs how companies communicate with their customers and how it impacts the customer experience in a positive manner.

However, there is a downside to this. Personal data is so valuable that it is vulnerable to theft or misuse. This has raised questions on how a company is making sure that the personal data is secure with them. Clearly, there is a massive disconnect between the customers and companies on how they collect, use and transfer their personal data further.

This has led to the formation of the proposed Personal Data Protection Bill (PDPB) for India.

Challenges for Marketers with PDPB

PDPB might seem extreme, especially for the MSMEs; however, we feel that there would be three key areas that marketers would need to think about:

-Data Permission
-Data Access
-Data Focus

These three areas would go hand in hand. But let’s have a look at them individually.

1. Data Permission

Data permission means ‘taking consent from the customer’. For instance, one cannot assume that a customer wants to be contacted. In the future, the customer would need to express consent in a ‘freely given, specific, informed, and unambiguous’ way. This implies that all the customers and partners would need to explicitly confirm that they want to be contacted in future. Therefore, a pre-selected option that automatically opts the customer in won’t work anymore. The following would make it clear to you.

In another example, in campaigns where you ask for referrals, the customer enters another person’s email address to claim an offer. Once they have entered the address, an automated email is sent to that person without gaining their explicit consent. These emails are typically ‘notifications’, rather than promotional but you still need the recipient’s consent before you can start sending them off.

You would be PDPB compliant if this data is neither stored nor processed for marketing purposes without consent. However, if the data is used for marketing communications, then you would be in violation.

To summarise: No marketing-related communication can be sent out to the customer without obtaining proper consent.

2. Data Access
This bill proposes to give the customers more control of their personal data. They would have the right to access what all data is being stored about them by a company. Also, they would have the right to ask the company to delete their data, if the customer no longer wishes to continue with their services.

As a marketer, it will be our responsibility to make sure that our customers can easily access their data and be given an option to remove consent for its use. This can be done by including an unsubscribe link in the email marketing template, which would link back to the customer profile. This would allow the customers to manage their email preferences.

To summarise: The customers shall be given uninterrupted access to their data and the option to revoke their consent whenever they wish to.

3. Data Focus
As marketers, we are often guilty of collecting relatively more data than we need. Ask yourself… do I really need to collect that additional data element before a customer subscribes to our newsletter?

Probably not.

With this mindset, PDPB would require you to legally justify the collection and processing of all the data elements. You should stop asking for the ‘nice to haves’ additional information. If you really need to know something, and can prove why you need it, you can ask for it. Else, just stick to the basics and try not to collect any unnecessary personal data.

To summarise: Do not collect unnecessary data on a user.

The Penalists

The bill proposes a penalty for violating its terms, which may extend to 15 Cr. or 4% of a company’s total worldwide turnover of the preceding financial year, whichever is higher. It would be a hefty amount to pay.

Besides, the loss of trust from the clients and the loss of brand value could further damage a company.

Conclusion

The PDPB is yet to be finalized. It has now been referred to a Joint Parliament Committee and is expected to be tabled in the next session of the Parliament. We can expect to see it become a Law in the coming months; however, there is no defined timeline. The government has stressed that everyone will have adequate time to implement all the controls.

It is a waiting game now. Let’s see how the final version turns out!!