Collect less, ask clearly

Two lawful grounds

You may process personal data only for a lawful purpose, and only on one of two grounds: the person's consent, or one of the legitimate uses listed in section 7.

Section 4(1) allows processing only with consent or for 'certain legitimate uses', and s.4(2) defines a lawful purpose as one not expressly forbidden by law. The list in s.7 is closed. The Act's text has no general ground such as 'legitimate interests' or 'needed for a contract', so write down which of the two grounds you rely on for each purpose in your data map.

A short notice that does the job

Before you ask for consent, give a notice. It can be short: what data, for what purpose, how to withdraw, how to use their rights, and how to complain to the Board.

Rule 3(a) wants the notice to be presented and understandable independently of other information, so a link to a long privacy policy alone is unlikely to be enough. Rule 3(b) requires an itemised description of the data and the specified purposes. Rule 3(c) requires the particular link to your website or app for withdrawing consent, exercising rights and complaining to the Board. Under s.5(3) the person must have the option to read it in English or a language in the Eighth Schedule to the Constitution. The consent request must also give contact details of the person who handles rights queries (s.6(3)).

A checkout form, sorted

Consent covers only the data that is necessary for the stated purpose. If a field is not needed to deliver the order, remove it from the form.

Section 6(1) limits consent to 'such personal data as is necessary for such specified purpose'. The Act's own illustration is a telemedicine app that also asks for the phone's contact list: even though the user agrees to both, the consent is limited to what the telemedicine service needs. If you want an extra field for a different purpose, such as a birthday offer, state that purpose in the notice and ask for it separately. Under s.6(2), any part of a consent that infringes the Act, such as waiving the right to complain to the Board, is invalid.

Marketing

An order is not permission for promotional WhatsApp messages. Ask separately, leave the box unticked, and let the order go through either way.

The Act does not use the word 'bundling' or mention pre-ticked boxes. This advice follows from s.6(1): consent is tied to a specified purpose, must be unconditional, and needs a clear affirmative action, so a pre-ticked box or a forced marketing opt-in is a risk. Keep a record of who opted in and when, because you carry the burden of proof (s.6(10)). Other laws on commercial messages may also apply; they are outside this guide.

Withdrawing must be as easy as agreeing

If someone agreed with one tick, they should be able to withdraw just as easily. Then stop the processing, have your vendors stop, and erase the data unless a law requires you to keep it.

Section 6(4) requires the ease of withdrawal to be comparable to the ease of giving consent. Withdrawal does not make earlier processing unlawful, and the person bears its consequences (s.6(5)): in the Act's illustration, a shop may stop offering the service but must still deliver an order already paid for. Under s.6(6) you must stop, and cause your processors to stop, within a reasonable time, unless processing without consent is required or authorised by law. Section 8(7) then requires erasure unless retention is needed to comply with a law. Chapter 3 covers the one-year minimum in Rule 8(3).

When you do not need to ask

Two legitimate uses matter most for small businesses. Data a person gives you voluntarily can be used for that specific purpose, and staff data can be used for employment purposes.

Section 7(a) covers data voluntarily provided for a specified purpose, where the person has not indicated that she does not consent. The Act's illustrations are a pharmacy sending a payment receipt, and a broker who must stop once the customer says she no longer needs help. Section 7(i) covers the purposes of employment and safeguarding the employer from loss or liability. The s.5 notice is tied to requests for consent, so the Act does not require it for these uses; security, breach and retention duties still apply, and the rights in s.11 and s.12 extend to s.7(a) data. Other s.7 uses include legal disclosure duties, court orders and medical emergencies.

Existing customer lists

You do not have to delete an old customer list on day one. Where people had given consent, send them the notice by email or in the app, and act on any withdrawal.

Section 5(2)(a) requires the notice 'as soon as it is reasonably practicable', and s.5(2)(b) lets you continue processing until consent is withdrawn. The Act's illustration mentions email, in-app notification or another effective method. The notice follows the same Rule 3 format. This applies where consent was given before commencement. The Act does not say how to treat old data collected without any consent, such as a purchased contact list; assume it needs a lawful ground under s.4 and take advice.

Under 18 counts as a child under the Act

If teenagers may use your app or attend your classes, plan for this. You need a parent's verifiable consent, and you must not track children or target advertisements at them.

Section 9(1) requires verifiable parental consent, s.9(2) bars processing likely to harm a child's well-being, and s.9(3) bars tracking, behavioural monitoring and targeted advertising. Rule 10 requires due diligence that the person claiming to be the parent is an identifiable adult, using reliable identity and age details you already hold, details they provide, or a virtual token such as one from a Digital Locker service. The Rules do not prescribe how to find out a user's age. The Fourth Schedule gives limited exemptions, for example to clinics for health services and to educational institutions for educational activities and safety; whether a coaching centre is an 'educational institution' is not spelt out. Breach can cost up to ₹200 crore.

In one line

Next, how to protect what you keep, and what to do when something goes wrong.