The Shillong indie-music creator and the DPDPA Telegram fan group

She writes songs in Khasi and English, usually alone, occasionally with her friend Daibor on bass and her friend Rina on a second guitar. The genre sits somewhere between dream-pop and indie-folk — slow arpeggios, her voice close to the microphone, lyrics that move between landscape and feeling in the way Khasi does naturally, where one word can mean the hill and the longing both. She releases through Bandcamp and distributes to Spotify; she has 12,000 monthly listeners there, 95,000 followers on Instagram, and a presence that is large enough that Shillong's independent music scene considers her one of its more visible names. She is not famous in the way a Bollywood playback singer is famous. She is the kind of artist whose fans mail her handwritten letters from Tura and Jowai and one from Dimapur that she has kept on her windowsill for a year because it mentioned a song she wrote in 2022 in terms that suggested the person had listened to it thirty or forty times.

The Telegram group started in 2021, during the pandemic, when physical shows stopped and the only way to reach an audience was to create one in a messaging app. She named it something in Khasi that translates roughly as "the listening room" and over three years it grew to 18,000 members. She used it for what felt reasonable and human: announcing upcoming shows, dropping early-access links to singles before they went live, sending out a short monthly newsletter about what she was working on. To receive the newsletter and the early-access links, fans had to send her their email addresses and phone numbers, which she collected in a single Google Sheet. The sheet, in May 2026, had 6,400 rows.

The email arrived on a Thursday morning at 11:43, with the subject line: DPDPA grievance — fan data deletion request.

🗓️ The data-fiduciary problem no one explained to her

The Digital Personal Data Protection Act 2023 received Presidential assent on 11 August 2023. It defines, in Section 2(i), a "data fiduciary" as any person — individual, sole proprietor, company — who determines the purpose and means of processing personal data. Badaplin had been a data fiduciary since the moment she created the Google Sheet. The Act defines "personal data" in Section 2(t) to include any information that can identify a person; an email address is personal data. A phone number is personal data. Her 6,400-row sheet was a dataset of personal data, processed — in the statutory language of Section 4 — for the purposes of fan communications and event promotion.

Section 5 requires that personal data be processed only for the specific purpose for which consent was obtained — purpose limitation. Section 6 requires that consent be obtained through a notice that clearly states the type of data being collected, the purpose, how it can be withdrawn, and where to lodge a grievance. Badaplin had done none of this. Her call to action was a pinned message in the Telegram group that said, approximately: send me your email and number to get the early-access link. No privacy notice. No withdrawal mechanism. No grievance contact.

Section 8 lays out the obligations of a data fiduciary: maintain security safeguards, ensure accuracy of data, erase data when no longer needed, and respond to grievances within a timeframe to be specified by rules. Section 11 gives every data principal — every fan who sent her their details — the right to request information about what data she holds on them, the right to correction and erasure, and the right to a grievance response.

1. ⚖️

   Aug 2023 — DPDPA receives Presidential assent

   The Digital Personal Data Protection Act 2023 becomes law. Any person who determines the purpose and means of processing personal data — including an indie musician collecting fan emails and phone numbers — is a data fiduciary under Section 2(i). No registration is required to become one; collecting a single email for a defined purpose is sufficient.

2. 📋

   Section 6 — Consent notice obligation

   Every data fiduciary must obtain consent through a notice that specifies the data type, the exact purpose, the right to withdraw, and the grievance channel. A Telegram pinned message saying 'send me your email for the early-access link' does not constitute a valid consent notice under Section 6. All 6,400 entries in Badaplin's sheet lacked valid consent records.

3. 🔍

   Section 11 — Data principal rights in force

   Every fan who sent Badaplin their email or phone number has, from the Act's commencement, the right to access what data is held on them, the right to correction and erasure, and the right to a grievance response. A data fiduciary who fails to respond to a grievance can be reported to the Data Protection Board — the Board may then initiate an inquiry under Section 28.

4. ₹

   Section 33 — Penalty exposure: ₹50L to ₹250 crore

   The penalty schedule under Section 33 ranges from ₹50 lakh (failure to notify a data breach) up to ₹250 crore (failure to implement reasonable security safeguards). Failure to observe the obligations of a significant data fiduciary carries a penalty of up to ₹200 crore. No penalty has been imposed on a solo creator yet — but the Board's jurisdiction is explicit, and a formal complaint is all that is needed to open an inquiry.

She had not read the DPDPA. She had not known, before the email arrived, that the DPDPA existed. She is not unusual in this. The Act's obligations for creators and small operators have received almost no public attention compared to those for large tech platforms. A solo musician with 18,000 Telegram members and a Google Sheet is not, in any intuitive sense, a "data controller." But the Act makes no distinction based on size in its baseline obligations. She was a data fiduciary. Her fans were data principals. And a data principal had just exercised their rights under Section 11.

⚠️ What very nearly happened

The email was polite and precise. The fan — Badaplin never disclosed the name, even to her collaborators — had written in English, citing Section 11 of the DPDPA by number. They wanted: a complete list of all personal data Badaplin held on them; a record of every third party with whom the data had been shared; erasure of all their personal data from her systems within the time period specified by rules; and a written acknowledgement of the grievance within the same period. At the bottom of the email, two lines without hostility but with clarity: If I do not receive a response within the prescribed period, I intend to file a complaint with the Data Protection Board of India under Section 28. I am aware this is not currently a registration requirement for the Board; the complaint portal is available at dpdp.gov.in.

She read the email three times. She forwarded it to no one, because she did not know who to forward it to.

"Nga dei ban kyrkhu ia ki kynmaw — hynrei nga'm tip phi noh ia u bynta u bynmaw."

— I want to do right by my fans — but I did not know this was a rule that applied to me.

The exposure, had a Data Protection Board inquiry followed, was not hypothetical. A formal complaint triggers a preliminary inquiry under Section 28(1). If the Board finds a prima facie case, it issues notice to the data fiduciary and begins proceedings under Section 29. The penalty scale under Section 33 for failure to observe data fiduciary obligations is up to ₹250 crore for "significant data fiduciaries" — a category defined by rules yet to be notified — and a lower but still serious sum for non-significant data fiduciaries. No penalty has yet been imposed on an individual creator in India. That is not a precedent. That is a gap waiting to be filled.

What very nearly happened was that Badaplin responded to the email the way she responded to most difficult messages: she drafted a reply, deleted it, drafted another, decided she needed to think about it more, and let forty-eight hours pass. By that point, if rules specified a forty-eight or seventy-two-hour acknowledgement window, she was already in breach. She had no privacy policy to point to, no consent record to produce, and no way to answer the data-sharing audit question — because she could not remember, with certainty, whether she had ever shared the Google Sheet with anyone, or forwarded a subset of the data to Daibor for event ticketing coordination, or used an unverified third-party tool to send a newsletter once in 2023.

🌗 What changed

Arjun Khongwir is Badaplin's drummer on occasional sessions — not a regular collaborator, but someone she plays with three or four times a year, usually for a live show. He works as a backend engineer at a Bengaluru SaaS company that, for the past eighteen months, had been building a DPDPA-compliant data consent management platform for its enterprise clients. He knows the Act the way he knows the time signatures of the songs they play: precisely, from repeated exposure.

He saw her Instagram story — a guitar riff posted without caption, which her followers know means she is distracted — and sent her a voice note asking if everything was all right. She sent him a screenshot of the email. He called within four minutes.

She told him she did not know what Section 11 meant in practice. He said: it means you have to respond, you have to produce the data you hold on this person, and if you shared it with anyone you have to say so.

She said, in Khasi: "Ngan tip noh ua phi ia kita ki email address — hynrei ki ki share, nga'm tip."

He said: "That's the problem. Let me come Saturday."

He arrived on a Saturday morning in the second week of May with his laptop and a printed four-page summary of the DPDPA obligations he had prepared for a client onboarding at work. They sat at the small wooden table beside her window, rain on the glass outside, and he walked her through the agent he had been testing internally.

She typed her first question slowly, in English:

"I have 18,000 people in a Telegram group. I collected their emails and phone numbers. No privacy policy. A fan has now asked for deletion and an audit of data sharing. What are my obligations under the DPDPA?"

"Under Section 8 read with Section 11 of the Digital Personal Data Protection Act 2023, you are a data fiduciary — you determined the purpose and means of processing the personal data you collected. The data principal who sent this grievance has three active rights: the right to information about what data you hold (Section 11(a)), the right to erasure when consent is withdrawn (Section 11(d)), and the right to a grievance response within the period notified under rules. Your immediate obligation is to acknowledge the grievance in writing — this stops the clock on any Data Protection Board complaint timeline. The second step is to identify exactly what data you hold on this person, which third parties (if any) have received it, and confirm in writing that it has been deleted. The third step is to issue a privacy notice to your Telegram group before collecting any further data — this notice must comply with Section 6(1) and include the data types collected, the purpose, and the withdrawal mechanism."

(The agent cited the specific sections, named the Board's complaint portal, and laid out the three steps in order of urgency. It did not say she was in serious trouble. It said what to do next.)

Arjun walked her through the Google Sheet. They searched for the specific fan's email address — it was row 3,847, with a phone number and a date-stamp from April 2023. No record of sharing. She replied to the grievance within two hours of the agent's response: a formal written acknowledgement citing Section 11, stating that she had located the data and would delete it within the specified window, and confirming that the Sheet had not been shared with any third party in a way that retained the data. She appended a deletion confirmation the following morning.

📋

Grievance response

Within 48 hours

Written acknowledgement to the data principal citing Section 11, confirmation of data location, statement of no third-party sharing, deletion confirmation. Stops the Data Protection Board complaint clock. Zero cost, zero legal help required — the agent drafted the response, Badaplin reviewed and sent.

🔒

Privacy notice to Telegram group

Section 6 compliant

A pinned notice in the group specifying: data collected (email, phone), purpose (newsletter + early-access links), right to withdrawal (direct message to Badaplin), grievance contact (her email address). Sent to all 18,000 members. New data collection requests now include a link to the notice.

🗂️

Data audit and retention policy

6,400 rows reviewed

The agent walked Badaplin through a simple retention policy: data held only for active newsletter subscribers, deleted within 30 days of unsubscription or withdrawal request. Inactive entries (no engagement in 12 months) flagged for deletion on a rolling basis. Google Sheet access restricted to Badaplin only.

🧭 Why we built it

Every newsletter-running creator in India faces a version of this. The mechanisms are different — some use Mailchimp, some use Notion forms, some use a WhatsApp group with 500 contacts, some use Airtable — but the structure is identical: a person with an audience who has collected personal data for a legitimate purpose, with no legal framework around the collection, because no one told them the law had changed.

The DPDPA applies to creators with any audience size. There is no small-operator exemption in Section 4. The definition of "data fiduciary" does not require a business licence, a company registration, or a threshold number of data subjects. A solo musician who collects sixty emails for a small-town gig-notification list is a data fiduciary. So is a regional food vlogger who keeps a WhatsApp contact list of fans who want to know when she visits their city. So is a devotional creator who collects phone numbers to send Aarti timing reminders.

What makes Badaplin's situation different from most is that she received the grievance before a Data Protection Board complaint was filed. That is not a common sequence. The more common sequence is: the fan, frustrated by no response, files with the Board; the Board initiates a preliminary inquiry; the data fiduciary receives formal notice and has to respond under Section 29 with legal counsel, producing records they do not have. The grievance email was not a threat. It was a favour dressed in legal language.

What it does

• ⚖️Identifies the specific DPDPA sections that apply to a creator's data collection practice — Section 4 (applicability), Section 5 (purpose limitation), Section 6 (consent), Section 8 (fiduciary duties), Section 11 (data principal rights) — and explains what each requires in plain language.
• 📋Drafts a Section 11-compliant grievance response, a Section 6-compliant privacy notice for the Telegram group, and a plain-language data retention policy — each reviewed and sent by the creator, not the agent.
• 🗂️Walks through the data audit: what data exists, where it lives, who has access, whether any third-party sharing occurred, and which rows are candidates for deletion under a retention policy.

What it does not do

• 🔒Never accesses the Google Sheet, the Telegram group, or any data store — the creator runs every search and deletion themselves; the agent explains what to look for.
• 💳Never files anything with the Data Protection Board or any government portal on the creator's behalf — every submission is the creator's own act.
• ✅Never advises on whether to comply — compliance is not optional under the DPDPA, and the agent does not treat it as a cost-benefit question. It says what the law requires and what the next step is.

The section of the Indian creator economy most exposed to DPDPA liability is not the large influencer agency with a legal team on retainer. It is the mid-tier solo creator — 10,000 to 200,000 followers, one person, no company — who has spent three or four years building an audience and an informal data infrastructure around that audience. Fan email lists, WhatsApp groups, Telegram channels, Notion forms for subscriber signups, Google Sheets maintained on a personal Gmail account. All of it personal data. All of it subject to Section 11 rights from the moment the Act commenced. All of it unprotected, not by malice, but by the simple fact that the law arrived and no one thought to tell the creator it applied to them.

The compliance gap for Badaplin was closed in one Saturday. Not by a data protection lawyer — she cannot afford one — but by her drummer, a government portal, and a tool that knew the statute.

🌱 What we hope happens

Badaplin posted a short update in the Telegram group two weeks after the grievance was resolved. She did not explain the legal detail. She said: she had updated how the group worked, that members could message her any time to remove their contact details, and that she would not collect new contact information without explaining what it was being used for. Eighteen thousand people saw the message. About forty replied. Most said some version of: we never thought about it, we don't mind, we trust you. One said: thank you, that's good to know.

None of them needed to understand Section 11 for the change to matter. The right existed whether they knew about it or not. The update was not for the fans who would exercise it; it was for the ones who never would but deserved to have the option.

Arjun sent her a message the following week, from Bengaluru, after she had sent him a Bandcamp link to a new recording she had made: two minutes of guitar recorded on a rainy afternoon, the rain audible through the window, posted without title. He said she had handled the whole thing correctly. She said she had not done it alone. He said: that's the point.

The DPDPA is not finished arriving. The Data Protection Board is not yet operational in the form the rules will specify. The consent manager framework under Section 6(4) is not yet notified. The rules that will define response timeframes, retention limits, and the threshold for "significant data fiduciary" designation have not yet been published. The law exists. Its implementing machinery is still being built. The period between the Act commencing and the full rules arriving is the window in which every creator who handles personal data either builds the practice or discovers the gap through someone else's grievance email.

If you have a fan newsletter, a Telegram group, a Mailchimp list, a Notion form, a WhatsApp contact collection — the product is free at gabforge.in. We know the DPDPA Sections by number. We know what a Section 6 notice must contain. We know what a Section 11 response must say and within what window. We will walk you through the audit. We will not tell you it is someone else's problem. We will tell you what the law requires — and then you will do it yourself, as it should be.