Consent as a routing gate
Every event carries its consent state into the pipeline. Destinations that aren't covered by the principal's consent never receive the event — the block happens before the request leaves.
India · Digital Personal Data Protection Act, 2023
DPDP is coming.
DPDP is coming.
Your attribution doesn't have to break.
From May 2027, every event you send to Meta, Google or your warehouse needs provable consent. Ingest Labs enforces that consent at the source — per event, per destination — and keeps the record that proves it.
EVENT
purchase
principal_8842 · IN
Consent state checked at ingest — analytics ✓ advertising ✓ marketing ✗
✓Meta CAPIadvertising
✓Google Adsadvertising
✓Snowflakeanalytics
✕Klaviyowithdrawn
audit evt_9f2c1a · 3 routed, 1 blocked · basis=consent · notice_v4 · retained 7y
Where the law actually is
Three dates that matter
The DPDP Rules were notified on 13 November 2025. Obligations arrive in phases — and the last one is the one that reaches your tracking stack.
In force
Nov 2025
The Board exists
The Data Protection Board of India is constituted with four members in New Delhi. Complaints can be filed; the enforcement machinery is real.
12 months
Nov 2026
Consent Managers go live
Registered Consent Managers become operative — a licensed category with no GDPR equivalent, holding consent records for seven years.
Hard deadline
13 May 2027
Everything else
Notice, consent, data principal rights, children's data and cross-border transfer obligations all bite. This is the date your event pipeline has to be ready for.
The part most teams miss
DPDP has no "legitimate interests" basis
If your India tracking is running on a GDPR-shaped consent model, this is the sentence that breaks it. Under GDPR, most analytics, attribution and measurement rides on legitimate interests. The DPDP Act simply doesn't offer that ground.
GDPR — Article 6 lawful bases
- 1 Consent
- 2 Contract
- 3 Legal obligation
- 4 Vital interests
- 5 Public task
- 6 Legitimate interests
DPDP Act — grounds for processing
- 1 Consent
- 2 Certain enumerated "legitimate uses"
- ✕ Legitimate interests
The enumerated legitimate uses cover things like medical emergencies, state benefits, employment and legal claims. Attribution, audience building and traffic measurement are not among them.
What this means in practice. For data principals in India, essentially your entire measurement stack needs consent — free, specific, informed, unconditional and unambiguous, given by clear affirmative action, with an itemised description of the data and the purpose. Recovering events that a user declined to consent to stops being a performance win and becomes an exposure.
Already in the platform
Built to enforce, not just to record
Consent-governed routing has been part of Ingest IQ since day one. Under DPDP it stops being a nice-to-have and becomes the control your Data Fiduciary obligations rest on.
Purpose mapped per destination
Analytics, advertising and marketing are separate purposes under DPDP. Each of your 100+ integrations is tagged to the purpose it serves, so consent granularity survives the fan-out.
An audit trail you can hand over
Per-event, per-destination records of what was sent, under which consent version, and what was withheld — exportable in a form your legal team can put in front of the Board.
Withdrawal that travels downstream
When a principal withdraws consent or requests erasure, the instruction propagates to the destinations that received their data — rather than stopping at the banner.
Where the data sits
Region-pinned processing for Indian data principals, with a documented sub-processor list — so cross-border questions have an answer before procurement asks them.
Measurement that still works
Server-side collection, first-party identity and modelled gaps mean you keep attribution quality on consented traffic instead of losing the whole signal to a blunt opt-out.
The distinction that matters
Your CMP records consent.
Ingest Labs enforces it.
A consent banner captures a preference. It has no idea what your tag manager, your CAPI integration or your warehouse sync did with it three hops later.
Consent Management Platform
Captures the preference
Presents the notice, collects the affirmative action, stores the record.
- Notice presentation and language variants
- Consent capture and versioning
- Preference centre and withdrawal UI
then
Ingest Labs
Acts on it, every time
Reads the consent state at ingest and decides what actually leaves your infrastructure.
- Per-destination enforcement at the edge
- Purpose-level gating across 100+ integrations
- Immutable record of what was sent and blocked
- Withdrawal propagated to downstream systems
Works with the consent platform you already run — OneTrust, Consentmo, or your own custom implementation. We're the enforcement layer underneath, not a replacement for your CMP.
Roles under the Act
You're the Data Fiduciary. We're your Data Processor.
Knowing which obligations sit where is the first thing your legal team will ask. Here's the split.
| Obligation | You (Data Fiduciary) | Ingest Labs (Processor) |
|---|---|---|
| Notice & consent | Present the itemised notice and collect valid consent | Read and enforce the resulting consent state |
| Purpose limitation | Define the purposes you've told principals about | Gate each destination to its declared purpose |
| Principal rights | Receive and decide on access, correction and erasure requests | Execute erasure across the pipeline and downstream destinations |
| Security safeguards | Ensure safeguards across your whole estate | Encryption, access control, logging and retention on our side |
| Breach notification | Notify the Board and every affected principal | Notify you without delay, with the forensic detail you need |
Worth knowing: under the DPDP Act, the Data Fiduciary remains liable for processing carried out on its behalf irrespective of any agreement to the contrary. You can't contract the obligation away — which is exactly why the enforcement needs to be technical, not just paper.
What non-compliance costs
Penalties under the Act
Determined by the Data Protection Board, weighed against the nature, gravity and duration of the breach.
₹250cr
Failure to take reasonable security safeguards to prevent a personal data breach
₹200cr
Failure to notify the Board and affected data principals of a breach
₹200cr
Non-fulfilment of additional obligations around children's data
₹150cr
Non-fulfilment of Significant Data Fiduciary obligations
Questions we get
DPDP and your tracking stack
Does the DPDP Act apply to us if we're not an Indian company?
Yes, if you offer goods or services to data principals in India and process their personal data in connection with that. The Act applies extra-territorially, so a foreign brand selling to Indian customers is in scope regardless of where it is incorporated.
Is server-side tracking still allowed under DPDP?
Server-side collection is a method, not a lawful basis — it's allowed, but it doesn't create permission. What matters is whether you have valid consent for the purpose you're processing for. The advantage of server-side is that it gives you a single place to enforce that consent across every destination, instead of hoping each client-side tag behaves.
We already comply with GDPR. Isn't that enough?
Not directly. The biggest gap is that DPDP has no legitimate interests basis, so processing you currently justify that way needs consent in India. DPDP also defines a child as anyone under 18 and prohibits behavioural tracking and targeted advertising at children outright, requires notice availability across the twenty-two Eighth Schedule languages, and has no materiality threshold for breach reporting.
What happens to a customer profile when someone withdraws consent?
Processing stops and retention has to end unless another law requires you to keep the data. Withdrawal must be as easy as giving consent was. The harder part is downstream: the data you already forwarded to ad platforms, your CRM and your warehouse. That's the propagation problem Ingest Labs is positioned to solve, because we hold the record of where every event went.
Are you DPDP compliant?
Nobody is, yet — the substantive obligations don't take effect until 13 May 2027, and any vendor claiming compliance today is describing a future state. What we can say is that the architecture is built for it: consent enforcement, purpose mapping and audit logging are already how the platform works, not a module bolted on later. Our current certifications and data handling commitments are documented on our trust page.
Do we need a registered Consent Manager?
Not necessarily. Consent Managers are a registered category under the Act, and data principals may choose to manage consent through one — but neither the Act nor the Rules require every Data Fiduciary to route consent through a Consent Manager. Your existing CMP plus enforcement at the pipeline covers the obligation as it stands.
Find out what breaks before May 2027 does it for you
We'll walk your current event flows, show you which destinations are receiving data without a defensible basis under DPDP, and what enforcement looks like once it's switched on.
SOC 2 Type IIGDPRCCPALive in under 24 hours
This page is general information about the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. It isn't legal advice, and it doesn't create a solicitor–client relationship. Obligations vary by organisation, sector and designation as a Significant Data Fiduciary — please take advice from qualified Indian counsel on your specific position. Last reviewed July 2026.