Can we use customer data for analytics and models?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY)
Short answer: Yes, within the purpose or with consent
Yes, where the use fits the purpose people were told, or you have consent for it. Improving the service people signed up for usually fits. Selling insights, profiling for third parties or targeting children does not. Mask or aggregate wherever the question allows, and give analysis copies their own deletion date.
Why it matters
Section 4 needs a lawful basis for each purpose. Section 6 needs specific consent. Section 9 bars behavioural monitoring of children. Section 8(3) asks for accuracy when data drives decisions.
- Section 4: Personal data may be processed only for a lawful purpose, either with the person's consent or for one of the legitimate uses listed in Section 7.
- Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
- Section 9 · Rules 10, 12: For anyone under 18, get verifiable consent from a parent or lawful guardian, and do not track, behaviourally monitor or target advertising at children. Rule 12 and the Fourth Schedule exempt some classes and purposes, for example clinical establishments and healthcare professionals to the extent needed to protect the child's health.
- Section 8(3): If personal data is used to make a decision about a person, or is shared with another Data Fiduciary, reasonable care must be taken that it is complete, accurate and consistent.
A worked example
An insurer wants to model claim patterns. Service improvement fits the purpose; selling insights to a partner does not. The model runs on masked IDs and the copy is deleted after six months.
Steps
- Write the question and the data needed.
- Check the purpose people were told.
- Mask or aggregate by default.
- Get consent for uses outside the purpose.
- Set a deletion date for the copy.
Evidence to keep
- Purpose checks
- Data specifications
- Retention entries
Common mistakes
- Using all data because it is there
- Analysis copies with no end date
- Profiling children
Who does what
- Data and analytics head: Check the purpose before each new analysis. Purpose decides whether you need consent.
- Product head: Product analytics needs a basis like any other use.
- Marketing head (CMO): Tracking pixels and ad SDKs collect personal data; check the basis.
- Data and analytics department: Check the purpose before each analysis.
What a good answer from management sounds like
“Each analysis has a purpose check, uses masked data where possible, and its copy has a deletion date.” Effort and time: Light per analysis.