Affiliate campaigns can involve personal data at several points: a publisher may collect a lead, an advertiser may receive it, and service providers may process it for validation, attribution or customer contact. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are therefore relevant to Indian businesses handling digital personal data. This article is an operational overview, not legal advice.
Check the commencement timeline
The Government of India published a commencement notification in the Gazette on 13 November 2025. It phases commencement rather than bringing every provision into force on the same date. As of 4 November 2026, the one-year commencement milestone has not yet arrived; several core provisions are scheduled for a later eighteen-month milestone. Businesses should read the Gazette notification and obtain current legal advice before setting compliance deadlines.
Map the data flow
Document which party collects the data, who decides why and how it is processed, which service providers act on instructions, and which parties receive the data. Do not assume a publisher, network or advertiser automatically has the same legal role in every campaign. The role depends on the actual processing arrangement.
Make notices and purposes specific
A lead form should explain what information is collected, why it is collected, who may receive it and how the person can exercise applicable rights. The purpose should match the actual campaign. Avoid collecting extra fields “just in case” or using lead data for unrelated promotions without a valid basis and appropriate notice.
Control partner sharing
Contracts and operating procedures should cover permitted data fields, purpose limitations, security expectations, retention, deletion, incident escalation, onward sharing and assistance with rights requests. A publisher should not pass personal information through a tracking URL or sub-ID. Use pseudonymous click identifiers and keep personal data in the appropriate secured systems.
Build a readiness checklist
- Inventory every form, pixel, SDK, postback and data export.
- Record the purpose and legal role for each processing activity.
- Review notices, consent flows and withdrawal handling.
- Minimise fields and define retention periods.
- Document partner instructions and data-sharing terms.
- Restrict access and log sensitive exports.
- Prepare an incident and complaint escalation route.
- Re-check the official commencement notifications and rules.
Important limitation
The Act and Rules have staged commencement provisions. A business should not describe every obligation as already effective on the same date. Use the official Gazette text, monitor subsequent notifications and obtain qualified advice for the business's exact role and processing flows.
Sources and further reading
- Gazette of India: commencement notification, 13 November 2025
- PIB: DPDP Rules, 2025 notified
- European Commission: GDPR principles
Primary sources and further reading
Editorial note: This article is general educational information, not legal, financial or campaign-specific advice. Verify current rules and the actual campaign terms before acting.
