How social.fluxx Approaches Data Protection Under GDPR and India's DPDP Act

GDPR governs data protection for users connected to the EU, and it's the more widely known framework. India's DPDP Act, which is now actively enforced with an operational Data Protection Board, governs data handling for a business incorporated in India, which is where social.fluxx's parent company is based. Between the two, DPDP tends to be the stricter standard on one specific point: consent.

DPDP treats consent as essentially the only lawful basis for processing personal data, without the broader "legitimate interest" fallback GDPR allows for certain cases. Consent also can't be bundled into general terms of service or defaulted to opt-in through a pre-checked box, it has to be a clear, specific choice. Designing around the stricter of the two standards, rather than the more permissive one, is the practical approach to staying compliant with both.

Both frameworks expect data to be kept only as long as there's a defined reason to keep it, not indefinitely by default. That means DM content and campaign data are handled with a defined retention approach rather than an assumption that everything stays forever, and users have a path to request deletion of their data as described in the data deletion policy.