Data Is Borrowed, Not Owned
Think of personal data like a friend's car. The DPDP Act just made the rules of the road official.
3 minutes read
Say a friend lends you their car.
You don't repaint it. You don't lend it to a stranger. You don't drive it to Goa when you said you were going to the supermarket. And when they ask for the keys back, you hand them over.
Nobody needs to write that down. It's just how borrowing works.
India's Digital Personal Data Protection (DPDP) Act applies the same common sense to personal data. Your users are lending you their information, and with most obligations taking effect on 13 May 2027, the rules of that loan are now law.
Here's how the metaphor maps to what your privacy, legal and marketing teams need to do.
1. Ask before you take the keys
You wouldn't drive off in a friend's car without asking. Under the DPDP Act, you can't drop analytics or advertising cookies on someone's browser without asking either.
Consent has to be a clear yes. No pre-ticked boxes, no "by continuing to browse you agree", and nothing firing in the background before the person decides. Unlike GDPR, the DPDP Act has no general legitimate interest route around this.
With ConsentCenter
Non-essential scripts stay blocked until the user says yes, and Indian visitors automatically see a DPDP opt-in experience.
2. Only drive where you said you would
"Can I borrow your car to go to the supermarket?" is not permission for a road trip.
Consent under the DPDP Act works the same way. It covers a specific purpose, so agreeing to analytics doesn't cover ad retargeting. Each purpose needs its own clear ask.
With ConsentCenter
Every tracker on your site is scanned and grouped by purpose, so users choose analytics, marketing and functional cookies separately.
3. Hand the keys back the moment they ask
If your friend wants their car back, you don't ask them to email your legal team and wait 30 days.
The DPDP Act says withdrawing consent must be as easy as giving it. One click to accept means one click to withdraw. And once the keys are back, you stop driving everywhere: your website, your CRM, your email campaigns, your ad audiences.
With ConsentCenter
A single preference center lets users change their minds any time, and every withdrawal syncs to your connected tools in real time.
4. Keep a logbook
If your friend ever asks, "Where did you take my car?", you want a clear answer.
The DPDP Act puts the burden of proof on the business. If the Data Protection Board asks whether someone agreed, you need to show who agreed, to what, when, and which notice they saw.
With ConsentCenter
Every consent event lands in a timestamped, exportable ledger, ready for any audit.
5. Bring it back in one piece
Borrowing comes with responsibility. Under the DPDP Act, failing to take reasonable security safeguards against a data breach can cost up to ₹250 crore. That's not a dent you can buff out.
Users can also ask to see, correct or erase their data at any point.
With ConsentCenter
DSAR workflows handle access, correction and deletion requests with owners, deadlines and evidence at every step.
The bottom line
Good friends get to borrow the car again. Careless ones don't.
The same is true for data. Companies that respect the terms of the loan build something no competitor can copy: trust that's on record.
ConsentCenter gives you everything you need to borrow responsibly: cookie scanning, region-aware consent for DPDP, GDPR and CCPA, real-time sync across your stack, DSAR workflows and an audit-ready consent ledger.
Ready to get your consent DPDP-ready? Book a demo call or learn more about ConsentCenter.
