DPDP Compliance for Customer Reviews & Feedback Data
Liability Check
Your customers' glowing reviews and critical feedback often contain personal data. Under the DPDP Act, handling this data – names, photos, contact details – without explicit, informed consent can lead to penalties up to ₹250 Crore.
Why DPDP Compliance for Customer Reviews & Feedback Data is at Risk
When customers share feedback on your website, app, or via surveys, they often provide names, email IDs, photos, or even specific location details like 'my office in Cyber Hub, Gurugram.' This isn't just anonymous feedback; it's **personal data**. As a **Data Fiduciary**, you're accountable for how you collect, store, and publish this information. Without a clear legal basis, such as **freely given, specific, informed, and unambiguous consent**, you risk severe penalties. Even aggregated feedback needs careful handling if it can be reverse-engineered to identify individuals, which is a common pitfall for Indian e-commerce and SaaS companies.
Common Violations
- 1.Publishing reviews with a customer's full name, profile picture, or specific contact details without their explicit, separate consent for publication.
- 2.Collecting excessive personal data on feedback forms not necessary for the purpose (e.g., asking for Aadhar number for a product review).
- 3.Not providing an easy mechanism for customers to request anonymisation or deletion of their personal data from published reviews on platforms like Zomato, Amazon, or your own website.
The Immediate Fix
Update your review submission process to include a clear, separate consent checkbox specifically for the publication of identifiable personal data (like name/photo). Ensure your privacy policy explicitly details how customer feedback data is collected, used, and retained, and provide an easy way for data principals to request changes or deletion.
Projected Compliance Deadline: Immediate