One of the hardest Digital Personal Data Protection (DPDP) compliance questions is surprisingly simple: Why are we collecting this data?
Imagine a telemedicine app requesting access to a patient’s entire phone contact list.
Even if the patient agrees, that doesn’t automatically make the collection lawful.
Section 6(1) requires consent-based processing to be limited to personal data necessary for the specified purpose.
In fact, the DPDP Act uses a telemedicine app requesting access to phone contacts as an illustration of excessive consent.
Now apply the same question to your organisation:
Do you really need a customer’s date of birth, residential address, identity document or location for the service you’re providing?
The takeaway: Review every personal data field collected and ask whether it is genuinely necessary for the specified purpose.
This article is general information, not legal advice.