DPDPA readiness for digital service providers.
Digital services — apps, content platforms, digital marketing, and everything in between — often collect personal data through the product itself and through the ad-tech and analytics tools embedded in it. Readiness work usually starts with separating what you collect directly from what a third-party script collects on your behalf.
What personal data typically looks like here
Where this usually creates the most work
Third-party scripts collecting data you didn't directly ask for
Analytics, advertising, and embedded widgets often collect personal data the moment a page loads, before any consent interaction happens. Knowing what each script actually collects is the starting point, not an afterthought.
Vendor review checklistConsent for tracking and personalised advertising
Using behavioural data to personalise content or ads is a distinct processing activity from running the core product, and needs its own clear notice and consent, not a blanket policy.
Children and younger users on a general-audience platform
A platform built for a general audience can still end up with underage users. Knowing whether that's happening, and what it means under the DPDPA's children's-data rules, is worth checking rather than assuming an exclusively adult audience.
What the DPDPA says about children's dataUser-generated content that includes other people's data
Photos, posts, comments, and messages can contain personal data about people who never directly interacted with your platform — a real category of data you hold without a direct relationship to the person it's about.
Other industries
Readiness work looks different depending on how your organisation uses personal data.
See where your organisation stands.
Ten minutes, no legal jargon, no commitment.