India's Digital Personal Data Protection Act, 2023, the DPDP Act, became law in August 2023. Brands, agencies, and content creators are still figuring out what it actually changes. If you run campaigns that involve real people talking on camera, submitting testimonials, or tagging your brand on Instagram, this law touches you. This article explains, in plain terms, what the DPDP Act says, why it matters specifically for user-generated content, and what practical steps brands working with UGC should take right now.
You do not need a law degree to understand this. The ideas below are deliberately beginner-level. If you are a brand manager briefing a UGC campaign, a founder choosing a UGC agency, or a creator wondering about your own rights, keep reading.
What the DPDP Act Actually Is
India has had sector-specific privacy rules for years, the IT Act, 2000 and its 2011 amendments included some data protection provisions, but they were patchy and hard to enforce. The DPDP Act, 2023 is India's first comprehensive, standalone data protection law. Think of it as India's version of Europe's GDPR, adapted for the Indian legal context.
The law rests on a few core ideas:
- Personal data belongs to the person it describes. A creator's face, voice, name, location, and contact details are their personal data.
- You need consent before you collect or use personal data. That consent must be free, specific, informed, and unconditional. A checkbox buried in a 40-page terms-of-service does not count.
- People have the right to withdraw consent and to be forgotten. If a creator later asks you to remove their video, you have an obligation to act on that request.
- Significant Fiduciaries face extra obligations. The government will designate large platforms and businesses as "Significant Data Fiduciaries," imposing stricter audit, localisation, and algorithmic impact requirements on them.
The Ministry of Electronics and IT (MeitY) is still finalising the rules under the Act, so some operational details will be clarified by subordinate legislation. But the core framework is already in force, and brands should not wait for the rules to be notified before updating their processes.
Why UGC Sits Squarely in the Act's Scope
UGC in a marketing context almost always involves collecting, storing, and publishing personal data. Consider the most common UGC formats used by Indian brands:
- Video testimonials, a real customer's face, voice, name, and sometimes location appear on screen.
- Instagram reposts, the creator's handle, profile picture, and original caption travel with the content when a brand shares it.
- Google and Justdial reviews screenshotted for ads, these include real usernames and star ratings.
- WhatsApp testimonial compilations, chat screenshots often include phone numbers visible in the header.
- Creator-made videos submitted via Google Forms or Razorpay intake pages, the submission itself includes an email or phone number.
Every one of these scenarios involves "processing personal data" as defined by the DPDP Act. The brand (or its agency) becomes a Data Fiduciary, the party responsible for determining why and how data is used. The creator or customer is the Data Principal, the person whose data it is.
The Consent Problem Most Brands Are Ignoring
Here is the gap that will cause the most trouble for Indian brands over the next 12–24 months: many UGC collection practices assume that permission granted on one platform extends to others. It does not.
A few common scenarios where consent breaks down:
- A customer posts a glowing review on Instagram with your brand tagged. You screenshot it and run it as a Meta ad. The customer never consented to being used in paid advertising. Their original post was a voluntary public statement, not an authorisation for commercial use.
- You run a "share your experience" contest and collect 200 video entries. The contest terms said entries could be used "for promotional purposes." You then licence those videos to a third-party retailer for their campaign. The scope of consent has been exceeded.
- You brief nano-creators in Tier cities across India, Surat, Coimbatore, Patna, over WhatsApp, they send selfie videos, and your team uploads those to YouTube. If there was no written consent covering that specific use, you have a DPDP compliance gap.
Under the DPDP Act, consent must be obtained before or at the time of collection, not retroactively. Running a campaign now and updating your terms later does not cure the original deficiency.
ASCI Guidelines Add Another Layer
The DPDP Act is not the only framework at play. The Advertising Standards Council of India (ASCI) has its own guidelines on endorsements and testimonials, updated in 2021 and further clarified in 2023 for social media influencer disclosures. The key ASCI rules that intersect with UGC are:
- Paid or gifted UGC must carry a clear disclosure label (#ad, #sponsored, or equivalent) in the first line of the caption, not buried after "more."
- Testimonials must reflect the genuine experience of the person giving them. A brand cannot script a "customer testimonial" using an actor without disclosure.
- The creator/influencer retains responsibility for disclosure compliance, but brands are jointly liable under ASCI's framework if they knowingly allow non-compliant posts.
This means that even if your DPDP consent documentation is perfect, a failure on ASCI disclosures creates separate liability. Both sets of rules need to be built into your UGC brief from the start.
A Practical Consent Checklist for Indian Brands
Here is what a compliant UGC consent process looks like at a practical level, nothing here requires expensive legal infrastructure:
- Written consent form for every creator engagement. A single-page Google Form or PDF (in English and, where appropriate, Hindi, Tamil, Kannada, or the relevant regional language) that specifies: what content is being collected, where it will be used (Meta ads, YouTube, website, OTT pre-rolls), how long it will be used, and whether it will be shared with third parties. In our production work, we use bilingual consent forms for creators in non-English-first markets like Kolkata, Lucknow, and Kochi, it removes ambiguity and speeds up approvals.
- Separate consent for paid media use. Organic social use and running a video as a paid Meta or Google ad are different activities with different reach. Get explicit consent for each use type.
- Withdrawal mechanism. Tell creators upfront how they can ask for their content to be removed and how long removal will take. A simple email address and a 7-day SLA is sufficient for most brands at this stage.
- Data minimisation at collection. If you only need a video and a first name, do not collect a full postal address or Aadhaar number. Collect only what the campaign actually requires.
- Retention policy. Decide upfront how long you will store raw submissions. A creator brief that closes in March should not have the raw footage sitting in a Google Drive indefinitely.
What Happens If You Do Not Comply
The DPDP Act empowers the Data Protection Board of India, a quasi-judicial body, to investigate complaints and impose penalties. The penalty structure is graduated:
- Failure to implement reasonable security safeguards: up to Rs. 250 crore per breach.
- Failure to notify the Board of a data breach: up to Rs. 200 crore.
- Non-fulfilment of obligations related to children's data: up to Rs. 200 crore.
- Other contraventions: up to Rs. 50 crore.
For a D2C brand spending Rs. 60,000–5,00,000 per month on UGC campaigns, the cost of a fine in the lower range (Rs. 50 crore) is existential. The Board is not yet fully operational, so enforcement is light right now. That window will not stay open permanently. Brands that build compliant workflows now, rather than retrofitting them after a complaint, will be significantly better positioned.
There is also reputational risk that is harder to quantify. A creator publicly calling out a brand for misusing their content, which happens regularly on X and Instagram already, will accelerate once the DPDP Act makes the legal basis for the complaint obvious to general audiences.
Specific Actions to Take Before Your Next Campaign
- Audit existing UGC assets. For any creator video currently running as a paid ad, check whether you have signed consent covering that specific use. If not, pause the ad or obtain retroactive consent in writing.
- Update your UGC brief template to include a consent section. The brief that goes to creators, whether they are in Mumbai, Bengaluru, or Tier cities across India, should reference the DPDP Act and include a link to your consent form.
- Add a DPDP disclosure to your UGC intake pages. If you collect videos via a form on your website or a third-party tool like Typeform, add a short paragraph explaining how submissions will be used and stored, and link to your privacy policy.
- Review your agency contracts. If you work with a UGC production agency, your contract should specify which party is the Data Fiduciary for creator data and which party is responsible for obtaining and storing consent records.
- Do not collect UGC from creators who appear to be under 18 without verified parental consent. The DPDP Act has significantly stricter rules for children's data, including a prohibition on behavioural targeting of minors.
UGC remains one of the most cost-effective content formats available to Indian brands, the trust signals, the regional language versatility, the production speed, none of that changes under the DPDP Act. What changes is the paperwork and process behind it. Brands that treat compliance as a one-time setup cost rather than a recurring burden will find it adds very little friction to well-run campaigns. If you want to build a UGC workflow that is production-ready and DPDP-aware from brief to final delivery, talk to us, we brief, shoot, and clear rights for creators across India every week.
