In short
- A brand that decides why and how personal data from a creator campaign is used, such as lead forms, giveaway entries or creator bank details, is the Data Fiduciary, and stays responsible even if an agency handles the data.
- Consent must be free, specific, informed, unconditional and unambiguous, limited to the data needed, and asked with a notice available in English or an Eighth Schedule language.
- The Act bars tracking, behavioural monitoring and targeted advertising directed at children, and needs verifiable parental consent. A child is anyone under 18.
- The Rules were notified on 13 or 14 Nov 2025 and phase in, with main duties after 18 months, around May 2027. Maximum penalties run to ₹250 crore.
The Digital Personal Data Protection Act, 2023 applies to a creator campaign whenever the campaign collects or uses personal data of identifiable people in digital form: lead forms, giveaway entries, app sign-ups, partnership-ad audiences, and the PAN and bank details of the creators themselves. The brand that decides why and how that data is used is the "Data Fiduciary", and it is responsible for it even when an agency or a creator touches it.
Our guide to influencer contracts in India flags this in one clause. This post goes into what the Act and the 2025 Rules mean for how a campaign is designed, with a data-flow table, a playbook and sample clauses. For the wider channel, see our complete guide to influencer marketing in India.
Where the Act touches a creator campaign
| Data flow | Who decides the purpose | Likely role | What to do |
|---|---|---|---|
| Lead form or landing page behind a creator's link | The brand | Brand is Data Fiduciary | Show a notice, ask for consent, collect only needed fields |
| Giveaway or contest entries: names, phones, addresses | The brand, which runs or benefits from it | Brand is Data Fiduciary | Use the data only to run the giveaway, then delete |
| Discount-code and affiliate tracking | The brand | Brand, for buyer data | Give creators sales counts, not buyer details |
| Creator onboarding: PAN, GSTIN, bank details, address | The brand, or the agency for the brand | Brand or agency, for creators' data | Collect the minimum for payment and tax, secure it, limit access |
| Audience insights shared by a creator | The creator, which owns the account | Aggregate screenshots are generally not personal data (our reading) | Avoid exports with individual followers, comments or DMs |
| Faces and voices in UGC and event content | The brand, for how it uses them | Brand, for likeness data | Get consent, and take extra care with children |
| Retargeting or partnership-ad audiences | The brand and the platform | Brand, for the audiences it builds | Notice and consent; no targeting directed at children |
| Event or meetup RSVPs | The brand | Brand is Data Fiduciary | Notice at sign-up; delete after the event |
| Leads forwarded by creators through DMs or WhatsApp | Nobody, which is the problem | Uncontrolled copies | Stop it. Use the brand's own form |
Fiduciary and processor
The Act defines a Data Fiduciary as any person who alone or with others determines the purpose and means of processing personal data, and a Data Processor as a person who processes personal data on behalf of a fiduciary. It then says two things that matter for agencies and creators.
- A Data Fiduciary is responsible for complying with the Act for any processing done by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary (section 8(1)).
- A fiduciary may engage a processor to process data for offering goods or services only under a valid contract (section 8(2)).
So if an agency runs your giveaway form, it is acting as your processor, and the contract between you must cover the data. If you ask a creator to collect entries by DM, the creator is in effect another processor, working outside your systems. The cleanest design is that creators never collect personal data: they point to the brand's own page, and the brand handles notice, consent and storage.
What the Act asks of a campaign
| Duty | Where | Plain meaning | Campaign effect |
|---|---|---|---|
| Lawful purpose | Section 4 | Process personal data only with the person's consent, or for certain legitimate uses | No use beyond what you told them |
| Notice | Section 5 | At or before asking for consent, say what data, why, how to exercise rights and how to complain | A notice on every landing page and form. Available in English or any Eighth Schedule language, which matters for regional campaigns |
| Consent | Section 6 | Free, specific, informed, unconditional and unambiguous, by a clear affirmative action, limited to the data needed for the stated purpose | No pre-ticked boxes. No bundling a newsletter with a giveaway |
| Withdrawal | Section 6 | As easy to withdraw as to give | A working unsubscribe or deletion route |
| Burden of proof | Section 6 | The fiduciary must prove notice was given and consent obtained | Keep timestamps and the notice version |
| Volunteered data | Section 7 | Data a person volunteers for a specified purpose can be used for that purpose unless they object | Use an entrant's address for the prize, not for marketing |
| Accuracy | Section 8 | Complete, accurate data where it drives decisions or is shared | Do not assemble lists from guesses |
| Security safeguards | Section 8 | Reasonable safeguards to prevent a breach | Passwords, access control, no loose spreadsheets in chats |
| Breach notice | Section 8 | Tell the Board and each affected person, as prescribed | Know who tells whom, and how fast |
| Erasure | Section 8 | Erase when consent is withdrawn or the purpose is no longer served, and make processors erase | Deletion dates in every contract |
| Grievances | Section 8 | Publish a contact and run a redress mechanism | A named contact on every notice |
Two exemptions are relevant. The Act does not apply to personal data processed by an individual for a personal or domestic purpose. It also does not apply to personal data made publicly available by the person it relates to. Our reading is that a creator's public handle, bio and follower count, which the creator chose to publish, are outside the Act. The PAN a creator emails you, the bank details on an invoice and a follower's DM are not public in that sense. We rate this reading Low confidence.
Children and creator campaigns
Section 9 requires verifiable consent of a parent or lawful guardian before processing a child's personal data, bars processing likely to harm a child's wellbeing, and bars tracking, behavioural monitoring and targeted advertising directed at children. The Act defines a child as anyone under 18. A PIB release of 25 March 2026, giving information from MeitY, repeats these safeguards and adds the right to withdraw consent and the duty to erase.
The Act lets the government prescribe exemptions for classes of fiduciaries and purposes. We have not read what the Rules prescribe, so do not assume one applies to you. In practice:
- Giveaways. Make them 18+ and say so. If under-18s can enter, you need a way to get verifiable parental consent, and most brands should not build one for a giveaway.
- Teen creators. A creator under 18 is a child under the Act, so their details and the contract need extra care, usually with a parent or guardian involved.
- Targeting. Partnership ads and retargeting must not be directed at children. See our service page on creator ads and whitelisting.
- Kids' categories. For toys, baby care, edtech and gaming, get legal advice before collecting any data. See our pages on parenting and baby, edtech and education and gaming and esports.
Timeline
| Item | Date | Confidence |
|---|---|---|
| DPDP Act, 2023 | Passed in 2023; commencement by notification, with different dates for different provisions (section 1(2)) | High |
| DPDP Rules 2025 notified | 13 or 14 Nov 2025 (sources differ by a day) | Medium |
| Consent-manager registration | After one year, about Nov 2026 | Medium |
| Main data-fiduciary duties: notice, security safeguards, breach reporting, children's data | After 18 months, around 12 to 14 May 2027 per press reports | Medium |
| SPDI Rules 2011 | Stay in force in the meantime | Medium |
Press sources differ on the exact dates, so use May 2027 as a planning date and check the notified schedule with your lawyer.
Penalties
Under the Act's Schedule, the Data Protection Board can impose the following maximum penalties after an inquiry.
| Breach | Maximum |
|---|---|
| Failure to take reasonable security safeguards (section 8(5)) | ₹250 crore |
| Failure to notify a personal data breach (section 8(6)) | ₹200 crore |
| Breach of the children's obligations (section 9) | ₹200 crore |
| Breach of significant data fiduciary duties (section 10) | ₹150 crore |
| Any other breach of the Act or Rules | ₹50 crore |
| Breach of a data principal's duties (section 15) | ₹10,000 |
These are ceilings, not typical outcomes. They show where the exposure sits: on the fiduciary, which for a creator campaign is the brand. An agency or creator contract cannot move that responsibility, so make sure they handle data the way you would.
A playbook for the next campaign
- Map the data. For each campaign, list what is collected, where it lives, who can see it and when it will be deleted. One page is enough.
- Collect less. Most campaigns need a name and a phone number or email at most. Drop every other field.
- Use one notice. Put the same notice on every form: what, why, how to withdraw, how to complain, in English or the campaign's language. Tick boxes should be unticked.
- Keep personal data away from creators. They get aggregated results. Tell them not to ask followers to DM details. Our performance influencer marketing work tracks sales through codes and links, so creators never need buyer data.
- Paper the agency and the creators. Cover purpose, instructions, security, deletion, breach notice and sub-processors.
- Set deletion dates. We suggest deleting giveaway entries within 30 days of prize dispatch. That figure is our suggestion, not a legal rule.
- Treat creator KYC as sensitive. Collect PAN, invoice and bank details only for payment and tax, restrict access, and delete when the tax record period allows. The Act allows retention where necessary for compliance with law.
- Plan for a breach. Decide who tells the Board and affected people, and how fast. We have not read the Rules' prescribed form.
- Gate children out. Design for adults unless you have legal advice.
- Review in early 2027, before the main duties start.
Sample clauses
These are illustrative drafting. Have a lawyer adapt them.
Creator data handling. The Creator shall not collect personal data from followers or customers for the Campaign, whether by direct message, form or comment, except through the Brand's own page. The Creator shall not request or retain any personal data supplied by the Brand.
Processor. The Agency shall process personal data collected for the Campaign only on the Brand's written instructions and for the purposes stated in the notice, apply reasonable security safeguards, tell the Brand of any breach without delay, and erase the data on the date the Brand specifies.
Related reading
Usage rights for faces and voices are covered in our post on usage rights for influencer content. AI avatars and cloned voices raise their own questions, in AI-generated content rules for influencers and virtual influencers in India. Our ASCI guidelines explainer covers the labels. For app and sign-up campaigns, see influencer marketing for apps and startups. To have data handling built into a campaign plan, see how we work or send us a brief.
This is general information, not legal advice.
Sources
- The Digital Personal Data Protection Bill, 2023, as introduced (enacted as the DPDP Act, 2023): text of sections 2 to 10 and the Schedule, PRS Legislative Research (2023)
- DPDP Rules 2025 notified, with phased rollout, The Week (PTI) (14 Nov 2025)
- Government committed to fostering AI innovation and growth of digital platforms in a responsible and secure manner: DPDP Act safeguards for children (reply in Rajya Sabha, with information from MeitY), PIB, Ministry of Women and Child Development (25 Mar 2026)
Frequently asked questions
Does the DPDP Act apply to influencer marketing campaigns?
It applies to any campaign that collects or uses personal data of identifiable people in digital form, such as lead forms, giveaway entries, app sign-ups, creator KYC details and partnership-ad audiences. We found no source that ties the Act to influencer databases specifically, so this is our reading. See clause 13 of our influencer contract guide.
When do the DPDP duties start for brands?
The DPDP Rules 2025 were notified on 13 or 14 November 2025 and phase in. A few rules applied at once, consent-manager registration follows after one year, and the main data-fiduciary duties, including notice, security safeguards and breach reporting, follow after 18 months, which press reports put around 12 to 14 May 2027. The older SPDI Rules 2011 stay in force meanwhile.
Who is responsible for data collected in a creator's giveaway, the brand or the creator?
Usually the brand, if it decides why the data is collected and how it is used. The Act says a Data Fiduciary is responsible for processing done on its behalf by a Data Processor, whatever the agreement says, and may use a processor only under a valid contract. The simplest design is that creators never collect personal data. Send entrants to the brand's own page.
Can a brand share campaign leads with the creator?
Avoid it. Disclosing personal data is processing under the Act, and consent covers only the specified purpose in the notice. Give creators aggregated results such as sales and sign-up counts, not names and phone numbers. If a creator needs to follow up with a winner, have the brand do it.
Do creators' own details such as PAN and bank account count as personal data?
Yes. Personal data is any data about an identifiable individual, and a creator's PAN, bank details and address qualify. The brand or agency collecting them for payment should collect only what payment and tax need, secure them, limit access and delete them when no longer needed, subject to any law requiring retention. See TDS 194R and GST on influencer payments.
What does the DPDP Act say about children in creator campaigns?
It requires verifiable parental consent before processing a child's personal data, and bars tracking, behavioural monitoring and targeted advertising directed at children. A child is anyone under 18. Campaigns for toys, edtech, gaming or teen apps need legal review before any data is collected. Our page on parenting and baby influencer marketing covers the category.
What are the penalties under the DPDP Act?
The Act's Schedule sets maximum penalties: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach or breaching the children's obligations, up to ₹150 crore for significant data fiduciary duties, and up to ₹50 crore for any other breach. The Data Protection Board imposes them after an inquiry.