Reimagining marketing and communications in the era of data protection

When the European Union implemented the General Data Protection Regulation (GDPR) in 2018, organizations were forced to rethink how they track, store, manage, and process data. The data was classified into different classes, mainly public data, personal data, and sensitive personal data. Given the extraterritorial applicability of GDPR and its focus on user privacy, this means a significant rethinking of organizations’ marketing, communications, and business development functions.

To enable a smooth transition, the European Union has adopted a systematic approach to the implementation of GDPR. This was preceded by years of work, with extensive documentation and training sessions, to clarify the scope and application of the law.

However, India’s data privacy transition may not be as smooth given the less clear rules defining the path and technology readiness of marketing and communications departments.

It’s no longer a matter of business choice

As India prepares to implement the Digital Personal Data Protection Act, 2023 (DPDP Act), there is a lot of discussion about aligning core business functions and sales-centric processes with the provisions of the law.

For end-consumer-focused digital capabilities, reconsider business models, especially if selling, transferring, or exchanging data is a core part of revenue generation, customer targeting or profiling, or sales funnel management. There may be a need.

A relevant scenario from a privacy perspective is restricting the use of cookies, which Google and Apple have voluntarily implemented. With the DPDP Act, which carries potentially significant penalties, data practices and standards are no longer a matter of company choice.

Additionally, the continued evolution and tightening of the benchmark data privacy regulation, GDPR, indicates that standards and compliance will become more stringent over time.

For example, consider stakeholder data governance.

Data governance is an extension of data privacy or data protection (mentioned in India’s more liberal regime compared to GDPR standards). As environmental, social and governance (ESG) standards become a top priority for companies, stakeholder data governance is also expected to become a key requirement.

In the digital age, the world of such stakeholders has expanded beyond investors and customers to include financial institutions, the media, and even academia as business becomes more digital.

Data protection and marketing

So far, aside from customer relationship management (CRM) and sales funnels, marketing and communications departments have been far removed from the challenges of data audits and regulatory compliance.

Even with CRM-type data, the focus is on the quality and accuracy of the data rather than the source, validity, and legality that the organization controls.

In India, most marketing and communication data, especially stakeholder-related data, is primarily obtained and stored manually, with additional baggage of historical data and archives.

This includes influencer records, media lists, beneficiary records (participants in initiatives, contests, etc.), people involved in corporate social responsibility initiatives (including health and family records), programs and It may include personal data such as details from past partners.

How DPDP impacts marketing

The law applies to all forms of data, whether collected online or offline and later digitized, even if the data processing is done externally for the purpose of providing goods and services in India. Applies to

The law is also based on consent, and data can only be processed for authorized or lawful purposes based on the consent of the individual.

There is a pause when it comes to voluntarily provided data, but perhaps there are records to prove the same if the situation arises.

As data fiduciaries, organizations are also responsible for ensuring the security of personal data. The provisions of this law require certain compliances related to marketing, particularly the data of minors.

Marketing and communications teams must perform the difficult task of cleaning and streamlining data, which is sure to take both time and resources.

While the EU provides considerable support and training, Indian companies may not have that luxury. On the other hand, multinationals may benefit from the experience of their European peers, particularly through the adoption of IT tools that may be implemented in the EU.

For service aggregators, such as public relations agencies or direct marketing agencies, the situation is a little more complicated. Indian law imposes limits on how long data can be stored and states that data can only be used for purposes for which consent has been obtained.

This means that PR agencies that use the same data for multiple clients may need to take a subscription-based approach to press release distribution or follow a Chinese wall model for each client. Masu. This poses a significant challenge and can involve significant costs.

Compliance and its benefits

A CRM-type approach to stakeholder data management seems inevitable, and companies, especially those with large historical datasets and manual records, will need to do a major cleanup.

Although it may be painful, in the long run, digitalization in this area will benefit organizations as it will help reduce business and compliance risks, strengthen data governance, and introduce process efficiencies through automation. may bring benefits.

However, given the complexity, the sooner companies start moving in this direction, the more time they have to commit to transformation rather than rushing through a painful transition at the last minute.

Rahul Gosain is Head of Marketing Communications at Cyril Amarchand Mangaldas