You already have a customer database — do you need fresh consent under DPDP?

At a glance

Usually you don’t need to re-collect consent for data you gathered before the DPDP Act — but you do have to send a one-time notice, as soon as reasonably practicable, telling those people what data you hold, why, and how to exercise their rights (including withdrawing consent and raising a grievance). You can keep processing the data unless and until someone withdraws. So it isn’t “start over and re-consent everyone”; it’s “notify your existing base, then continue” — provided the original collection was itself consent-based.

Educational resource only. This explains the transition rule for previously collected data under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

The situation

Every established business has a base of data collected before the DPDP Act — customers, leads, records built up over years. A common fear is that the Act forces you to email everyone and re-collect consent from scratch, or delete the lot. The reality is lighter than that, but it isn’t “do nothing.”

The short version: notice, not fresh consent

For data already collected on the basis of consent, you generally continue processing it — after giving a one-time notice. The Act’s transition provision (Section 5) lets you keep using personal data you collected before it came into force, where consent was obtained at the time, provided you give the affected people a notice as soon as reasonably practicable. You don’t have to re-run a consent exercise across your whole database; you have to inform it. Processing can continue unless someone withdraws consent after getting that notice.

What the one-time notice must say

It’s a transparency notice: what you hold, why, and how they can act on it. At minimum, the notice to your existing base should clearly cover:

• What data you currently hold about them;
• The purpose you’re processing it for;
• Their rights and how to exercise them — including how to withdraw consent and how to raise a grievance.

Plain language, easy to act on. The goal is that a person who wants to withdraw or query can do so straightforwardly — which also means you need a working route for them to do it.

When you can’t simply carry on

The carry-on route assumes the original basis was sound — if it wasn’t, notice alone won’t fix it. Two situations need more than a transition notice:

• No valid original consent. If data was collected without a proper basis in the first place, a transition notice doesn’t retroactively cure that. You’d need to establish a lawful basis or stop processing.
• A new purpose. If you now want to use the old data for something different from what it was collected for — say, marketing to a list gathered only for order fulfilment — that’s a new purpose needing its own consent, not covered by “carry on.”

So “notify and continue” applies to lawfully-collected data used for its original purpose; step outside that and the ordinary consent rules return.

What to do with your database now

Treat it as a clean-up plus a notice — not a mass re-consent. A practical sequence:

1. Map what you hold — what data, collected when, for what purpose, on what basis.
2. Minimise first — delete data you no longer need before notifying; less to hold, less to explain.
3. Send the one-time notice to your existing base, covering the points above.
4. Stand up withdrawal and grievance routes so people can act on the notice.
5. Flag new purposes — anything beyond the original purpose needs fresh consent, handled separately.

FAQ