Do I need fresh consent from existing customers under DPDP?
What to do about the data you collected before the Act bites.
The re-notice obligation
For data collected under consent before the Act's provisions apply, you must give the person an itemised, plain-language notice describing the personal data and purposes, and how to withdraw consent and exercise rights. This is a one-time re-papering exercise across your existing base.
How to run it without losing your list
Segment your contacts by purpose, send a clear re-consent or notice campaign, and make withdrawal genuinely one-click. Treat non-response according to your basis: silence is not fresh consent for new purposes, so don't expand processing — keep it to what was already agreed.
Records are everything
Keep evidence of what notice you sent, when, and who withdrew. If a complaint reaches the Board, your contemporaneous records are what demonstrate you acted in good faith and on time.
Frequently asked questions
Do I have to stop processing until I re-notify?
No. You may continue processing already-collected data while you issue the fresh notice as soon as reasonably practicable, but you must honour any withdrawal.
Is silence the same as consent?
No. If someone doesn't respond, you cannot treat that as fresh consent for new purposes. Continue only the processing they originally agreed to.
What if I relied on legitimate use, not consent?
Then fresh consent isn't required, but you should still ensure your notice and records reflect the legitimate use you rely on.
Re-paper your consents cleanly
Use the Consent Notice Builder to produce the fresh, itemised notice your existing customers need.
Build a Consent Notice