DPDP Act and Influencer Campaigns: Consent, Data and Giveaway Entries

Under DPDP, the entity that determines why and how data is processed is the data fiduciary — and in a brand-briefed giveaway, that is the brand, not the creator. The creator collecting entries on your behalf is processing data for you. Their compliance failure lands on your desk.

This means giveaway mechanics are no longer just a marketing decision. The data fields collected, the notice shown, the storage and deletion — all of it needs to be specified in the campaign brief and, ideally, the contract.

Valid DPDP consent requires a clear notice at the point of collection: what data, why, how long it is kept, and how to withdraw. 'By entering you agree to T&C' with a dead link does not meet the standard.

Practical compliant mechanics: a proper entry form (even a simple landing page) with a notice and checkbox beats comment-based entry for anything beyond a prize draw that never leaves the platform. If you intend to reuse entries for marketing — and you do — that purpose must be in the notice.

Click-to-WhatsApp campaigns generate inbound messages — personal data the moment they arrive. Using those numbers for the conversation the user initiated is defensible; exporting them into a broadcast list for future campaigns is a new purpose requiring its own consent.

The operational fix: a consent line in your WhatsApp auto-reply ('Reply YES to receive offers from us') and separate lists for service conversations versus marketing. Gujarat's WhatsApp-native funnel works fine under DPDP — it just needs this one extra step.

Add to every campaign agreement involving data: the creator will collect only specified fields, display the brand-provided privacy notice, transfer entries securely, and delete their copy after transfer. State that the brand is the data fiduciary and the creator acts only on documented instructions.

For whitelisted campaigns where platform lead forms feed the brand directly, the data flow is cleaner — but the notice obligation is still yours. Check the form copy before the campaign goes live, not after the entries arrive.