Data Broker
A business that collects personal data from many sources and sells or licenses it to others.
A data broker is a business that gathers personal data from many places and sells or licenses it to others, often to marketers. People usually have no idea the broker holds their data.
Meaning of Data Broker
The Act does not define data brokers. Collecting and selling personal data needs a lawful ground and notice like any other processing, and buyers should check that the data was collected with consent for the purposes they intend.
Data brokers collect information from public records, loyalty programmes, websites and apps, surveys, offline events and other businesses, then package it into lists or profiles: "young professionals in Pune interested in travel", for instance. They sell these to marketers, lenders, recruiters and others. Some operate openly, others sit behind lead-generation websites and sign-up forms whose fine print mentions "partners".
The DPDP Act, 2023 does not define data brokers or regulate them as a class. It looks at what they do. A broker that decides why and how to collect and sell personal data is a Data Fiduciary and must comply with Section 4 (lawful ground), Section 5 and Rule 3 (notice), Section 6 (consent) and Section 8 (general obligations). A broker acting only on instructions of a client may be a Data Processor, with the client remaining responsible under Section 8(1).
Several features of the Act make the broker model difficult. Consent must be specific to a purpose; "we may sell your data to partners" buried in a long form falls short, and Section 6(2) says any part of a consent that infringes the Act is invalid to that extent. Section 7(a), which covers data voluntarily provided for a specified purpose, does not stretch to resale. Section 3(c) takes out of the Act only data made publicly available by the Data Principal or by someone under a legal obligation to publish it, so scraped profiles that others put up, or leaked databases, are not covered by the carve-out.
There is no general "legitimate interest" ground as in the GDPR, so commercial interest alone cannot justify collection. For lists collected before the Act, Section 5(2) requires a notice to be given as soon as reasonably practicable to people who consented earlier. Buyers carry risk too: a company that uses a bought list without a proper basis is itself a fiduciary processing without valid consent, and cannot defend itself by saying the broker collected the data.
Examples of Data Broker
An agency considers buying a list of 50,000 email addresses. Before using it, it asks the seller for proof of consent.
An agency is offered 50,000 phone numbers of "home loan prospects" for ₹40,000. It asks for consent records, finds there are none, and declines the purchase, choosing instead to run an opt-in campaign.
A lead site collects details through a free quiz and shares them with unnamed "partners". After advice, it lists each category of recipient, asks for a separate tick-box consent for sharing, and lets people withdraw from its website.
A recruitment firm scrapes professional profiles and resells them. It changes its approach to collect résumés that candidates submit directly, with a notice that names the employers who may see them.
Why Data Broker matters
The broker business model depends on re-use, which is exactly what the purpose-limited consent regime restricts. Brokers and their buyers face exposure for processing without valid consent (up to ₹50 crore as a general breach), for weak security over large databases (up to ₹250 crore), and for failing to report breaches (up to ₹200 crore). Large lists attract attackers, and a broker breach can expose millions of people at once.
Individuals suffer from unwanted calls and messages, scams that use accurate personal details, and loss of control over where their data goes. For businesses, buying a list is a compliance decision, since cheap leads can turn into complaints to the Board, blocked senders and reputational damage.
How it works in practice
- 1If you sell or license data: record the source and the consent for every dataset, and sell only what the notice and consent covered. Remove records where consent has been withdrawn and pass that withdrawal to buyers.
- 2If you buy data: do due diligence before purchase. Ask for the original notice, the consent wording, the date and the sources, and refuse lists that cannot show them.
- 3Put contracts in place that require the seller to warrant lawful collection, to notify you of withdrawals and complaints, and to indemnify you for defects, while recognising that the legal responsibility is still yours.
- 4Provide notice to the people on a purchased list at the first contact: who you are, where you obtained their data, what you will use it for and how to opt out or complain.
- 5Honour rights quickly. Run an easy route for access, correction, erasure and complaints, and publish contact details as Section 8(9) and Rule 9 require.
- 6Prefer first-party data. Collecting directly, with a clear notice and a Consent Manager where suitable, is safer and usually performs better than rented lists.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing that publicly visible data is free to resell. Section 3(c) is narrow, and data posted by others or exposed by leaks does not qualify.
Assuming the seller carries all the risk. A buyer who processes personal data without a valid ground is a Data Fiduciary with its own liability.
Relying on a decade-old opt-in. Consent must meet the standards of Section 6 and the notice must be revisited under Section 5(2) for legacy data.
Ignoring withdrawals. If a person withdraws consent, you must stop processing and tell processors to stop, which means brokers need systems to pass the signal downstream.
Compliance tips
Keep a purchased-data register listing the seller, date, number of records, consent evidence and the campaign it was used for.
Ask for a sample and check it against your own suppression list before any purchase.
Make sure outbound communications from bought lists also follow telecom spam rules and platform policies.
Review vendor lists yearly and drop any seller that cannot show valid consent.
Common questions about Data Broker
Is it legal to buy a mailing list under the DPDP Act?
It is not banned in itself, but you become a Data Fiduciary for the people on it and need a lawful ground. If the list cannot show valid, purpose-specific consent for your use, using it risks penalties of up to ₹50 crore.
Does the DPDP Act regulate data brokers by name?
No. The Act does not define the term. Brokers are covered through the general duties on Data Fiduciaries and processors, including notice, consent, security and erasure, so their activities are regulated by what they do.
Can a broker sell data that is publicly available online?
Only if it falls within Section 3(c), meaning the Data Principal herself made it public or someone under a legal obligation published it. Data posted by others, scraped from closed groups or leaked is not exempt.
Can I ask a data broker to delete my data?
You can ask the broker or any company using its list to erase your data under Section 12 and to stop processing if you withdraw consent. If you do not get a response, you can use the grievance route and then complain to the Board.