Market research and survey firms collect personal data by design — respondent identities, contact details, opinions and sometimes sensitive attributes. The DPDP Act applies, and the discipline of consent and de-identification is central to doing research right.
Consent and purpose
Tell respondents who you are, what you collect, and how results are used and shared. Panels and re-contact need their own consent.
Anonymise for real
If you claim results are anonymised, make sure respondents can't be re-identified by combining fields (see anonymisation vs pseudonymisation). Small samples and rich attributes are easy to re-identify.
Clients and panels
Sharing raw respondent data with clients is a disclosure; prefer aggregated or properly anonymised outputs, and contract for anything identifiable.
A research checklist
- Clear notice and consent; separate panel consent
- Minimise identifiers; anonymise outputs properly
- Secure respondent data; limit retention
- Contracts for any identifiable data shared with clients
How DPDP Bridge helps
DPDP Bridge helps research firms run consent-first studies and genuinely de-identified outputs that keep respondent data out of scope. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.