What about personal data you collected before the DPDP Act?

Every Indian business has a back catalogue of personal data: old customer lists, years of CRM history, archived job applications, scanned KYC documents. What does the DPDP Act say about data you collected before it applied?

The rule in section 5(2)

Where a person gave consent before the Act commenced, the Data Fiduciary must give them a notice as soon as it is reasonably practicable, describing:

• the personal data and the purpose for which it has been processed,
• how to withdraw consent and exercise rights, and
• how to complain to the Data Protection Board.

You may continue processing until the person withdraws consent.

What this means in practice

1. You need a notice campaign. Email, SMS, in-app messages or letters, depending on what contact details you hold.
2. You need a withdrawal route ready before the notice goes out, because the notice must explain it.
3. You need to prove it. Keep a record of when each notice was sent and to which contact.

Data you never had consent for

Section 5(2) helps only where consent existed. Data gathered with no consent, such as bought lead lists, scraped contacts, or data collected for one purpose and quietly reused for another, has no such protection. For each dataset, ask:

• Does a legitimate use under section 7 cover it?
• If not, can you get fresh consent?
• If not, should you delete it?

Clean up before you notify

Sending a notice for data you shouldn’t hold advertises the problem. A sensible order:

1. Map every store of personal data: CRMs, spreadsheets, email inboxes, shared drives, old backups.
2. Delete what you no longer need, subject to legal retention (tax, labour and sector laws).
3. Decide the ground for what remains: consent, legitimate use or legal obligation.
4. Notify people whose data you keep on the basis of earlier consent.
5. Fix the front door: new collection must follow the new notice and consent rules.

The erasure trap

From 13 May 2027, section 8(7) requires erasure when the purpose is served. For large e-commerce, gaming and social media platforms, the Rules set a three-year inactivity period, after which data must be erased with 48 hours’ notice. Old accounts dormant for years may need attention.

Timing

Most obligations, including Rule 3’s notice standard, apply from 13 May 2027. A notice campaign for millions of records takes months. Starting in 2026 is sensible.

Go deeper

Our courses include a legacy-data clean-up exercise. Browse the courses.

This article is for education and is not legal advice.