India’s Digital Personal Data Protection Act (DPDP), 2023, is the country’s first full law on digital personal data. The rules that make it enforceable were notified on 13 November 2025, and full compliance kicks in from 13 May 2027. Anyone who collects a fan’s phone number, email, or address now qualifies as a “data fiduciary” under the law. That includes creators too.
India’s creator economy already counts over two million monetised creators, and most of them run giveaways, sell merchandise, or manage a WhatsApp community. Each of those activities now sits inside a legal framework. Here is what that framework actually asks of a creator.
Transparent notice and explicit consent
Before collecting any data, a creator ensures that a fan knows why it is being collected. A vague line like ‘Join our community’ is not enough. The notice needs to state the exact purpose, in plain language.
Consent also has to be an active choice, as it must be free, specific, informed, and given through a clear affirmative action; a pre-ticked box does not count. A fan who signs up for a newsletter has not automatically agreed to WhatsApp promotions too.
YouTube already logs watch time and subscriber data on its own servers, so the platform carries much of that compliance load.
Instagram DMs and story replies work the same way. But the moment a creator moves a fan’s number into a personal spreadsheet or a WhatsApp broadcast list, that responsibility shifts entirely onto the creator.
Purpose limitation and data minimisation
The law says data can only be used for the reason it was collected. A creator who takes an address for merchandise shipping cannot later use it for a separate marketing campaign without fresh consent.
Data minimisation follows the same logic. Collect only what a task needs, like a meet-and-greet RSVP, which needs a name and a phone number, not a birth date and a home address. Fewer fields also means less risk if something ever goes wrong.
Audience rights
Fans now hold legal, enforceable rights over their own data. They can ask a creator what data is held, request a copy of it, or ask for corrections. They can also withdraw consent at any time, and withdrawal must be as easy as giving consent was.
Fans can also file a grievance if a creator ignores these requests. Complaints eventually reach the Data Protection Board, the regulator set up to enforce the Act.
Data security
Storing fan data safely is a legal duty, if a breach happens, the creator must inform both the affected fans and the Data Protection Board without delay. Non-compliance across these obligations can attract penalties between ₹50 crore and ₹250 crore per violation. Those figures are aimed at large platforms, but the underlying duty of care applies to anyone handling personal data, at any scale.
What this changes for a creator
A creator asks followers to comment, then DM their address to claim a prize. Under the new rules, that DM thread is now a data collection point requiring its own notice and a clear deletion timeline once the giveaway ends.
The same applies to WhatsApp broadcast lists built from Instagram followers. Consent for Instagram engagement does not carry over to WhatsApp messages because each communication channel needs its own separate consent. A creator running a paid community on Telegram faces the same question: was consent taken for that specific group or assumed from a follower?
None of this demands a legal team; it demands a habit: write down why data is collected, store it only as long as needed, and give fans an easy way to opt out.
Building this habit early, before enforcement tightens, is far cheaper than fixing it under pressure later. For creators structuring brand deals around audience data, this is worth reviewing alongside how creator contracts are evolving in 2026.
FAQs
Does the DPDP Act apply to individual creators, or only companies?
It applies to anyone who decides why and how personal data is processed, which includes individual creators running newsletters, giveaways, or fan communities.
What counts as personal data for a creator?
Names, phone numbers, email addresses, and shipping addresses all count. Even a fan’s city, shared casually in a DM, can qualify if it can identify them.
Can a creator keep using an old fan email list collected before the Act?
Only if fresh notice is given, explaining what data is held and how it will be used, along with a clear way to opt out.
What happens if a creator ignores a fan’s request to delete their data?
The fan can raise a grievance, and unresolved complaints can escalate to the Data Protection Board, which has the power to investigate and penalise.
