Data ethics & privacy: DPDP Act 2023 basics

Data scientists work with customer names, phone numbers, locations, purchase histories and sometimes health or financial data. Mishandling it hurts people and exposes companies to heavy penalties. In India, the Digital Personal Data Protection Act, 2023 (DPDP Act) sets the main rules, with operational details in the DPDP Rules, 2025 that are being brought into force in phases. This lesson covers the basics; it is not legal advice, so always check the current official text with your legal team.

Key terms

The Act applies to digital personal data (and data collected offline and later digitised) processed in India, and to processing outside India if it relates to offering goods or services to people in India.

Core duties for organisations

• Lawful purpose with consent or a legitimate use. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Some "legitimate uses" (for example, data a person voluntarily provides for a specific purpose, or certain employment and legal needs) do not need separate consent.
• Notice. Tell people what data you collect and why, and how to exercise their rights.
• Purpose limitation. Data collected for delivery cannot quietly be reused for an unrelated purpose.
• Accuracy, security and erasure. Take reasonable security safeguards and delete data when the purpose is served or consent is withdrawn, unless the law requires keeping it.
• Breach reporting. Inform the Data Protection Board and affected individuals of a personal data breach.
• Children. For users under 18, verifiable parental consent is needed, and tracking, behavioural monitoring and targeted advertising aimed at children are not allowed.

Individuals get rights to access information about their data, correction and erasure, grievance redressal and to nominate someone to act for them. Penalties can reach ₹250 crore for failing to protect data with reasonable security safeguards.

What this means in your daily analytics work

1. Minimise. Pull only the columns you need. A churn model rarely needs names or full addresses.
2. Pseudonymise identifiers before analysis:

import hashlib
import os

SALT = os.environ["HASH_SALT"]           # keep the salt secret, outside the code

def pseudo(value: str) -> str:
    return hashlib.sha256((SALT + value).encode()).hexdigest()[:16]

customers["cust_key"] = customers["mobile"].astype(str).map(pseudo)
customers = customers.drop(columns=["name", "mobile", "email"])

3. Aggregate before sharing. Share counts by city or age band, and suppress very small groups that could identify someone.
4. Control access. No customer extracts on personal laptops, pen drives or public GitHub repos.
5. Respect withdrawal. When someone withdraws consent, make sure your pipelines and marketing lists drop them.

Ethics beyond the law

Legal is the minimum. Also ask: could this model treat a group unfairly (for example, rejecting loans by pin code that acts as a proxy for community)? Would customers be surprised or upset by this use of their data? Can we explain the decision to the person affected?

Common mistakes

• Treating hashed phone numbers without a secret salt as anonymous; they can be reversed by brute force.
• Keeping "just in case" copies of raw customer data forever.
• Using data collected for one purpose to train an unrelated model without checking the consent basis.