First-party data without activation infrastructure is not an asset; in India today it is a liability with a statutory timetable attached.
The Digital Personal Data Protection Act (DPDP), passed in 2023, ended the era in which an Indian marketing organisation could treat data collection as a costless hedge. Its obligations — verifiable consent, purpose limitation, notice, erasure on request, breach notification, and heightened duties for significant data fiduciaries — are phasing into enforcement through 2027 as the implementing rules take effect. Every chief marketing officer who spent the last five years being told to “collect first-party data” now owns a regulated inventory, and the question a regulator will eventually ask is not how much data the brand holds but whether each record has a lawful basis, a stated purpose, and a deletion path. Data that cannot pass that test generates storage cost, breach exposure, and audit risk while generating no revenue. That is the accounting definition of a liability.
This movie has run before, and we watched it from the front row. Across a decade of deployments, the pattern repeats: the profile architectures built for large Indian enterprises in the mid-2010s — unified customer stores assembled from data warehouses, campaign databases, and web analytics — were designed for marketing effectiveness and for nothing else. Consent management was not a design constraint. There was no purpose-limitation model, no right-to-erasure mechanism, no audit trail, because in the India of 2014 no law required one and no client asked. Those were reasonable omissions at the time. The problem is that enterprise data architecture outlives the assumptions it was built on: many of those systems were still in production when the European Union’s General Data Protection Regulation (GDPR) landed in 2018, and they were not consent-ready. Retrofitting governance onto a live profile store proved vastly more expensive than designing it in. Indian enterprises building or expanding first-party data estates in 2026 are making the 2014 decision again, except this time the statute already exists and the phase-in dates are published. There is no longer an excuse of unforeseeability.
The commercial half of the argument is just as sharp as the regulatory half. The forcing function that made first-party data existential — the deprecation of third-party cookies and the tightening of consent regimes from 2017 onwards — rewarded a specific kind of brand: not the one that collected the most data, but the one that could activate what it collected. First-party data creates value only at the end of a chain: collection, then identity resolution, then segmentation, then channel activation, then measurement. Break the chain anywhere and the value drops to zero while the cost and the risk remain. A customer record that cannot be matched to a device, an email hash, or a media identifier cannot be reached. A segment that no channel can receive cannot be tested. An activation whose incrementality is never measured cannot defend its budget. Across platform-side, agency-side, and product-side work since 2017, the throughline has been constant: first-party data is only as valuable as the activation infrastructure around it. Collection without identity resolution and channel activation produces compliance liability, not commercial return.
The consent layer deserves particular emphasis, because its role has inverted. In 2015 it was an afterthought; today it is load-bearing. Under DPDP, a record without verifiable consent is not merely unusable in theory — activating it is the violation. That means consent status now sits upstream of every commercial use of the data estate. The practical consequence is uncomfortable for organisations that grew their databases through acquisition-era sign-ups, scraped enrichment, or pre-DPDP campaigns with ambiguous opt-ins: a large fraction of the “asset” on which the personalisation roadmap depends may be unactivatable the moment the relevant rules bite. The brand lens tends to resist this conclusion, because the database headcount is a vanity metric with deep emotional roots — ten million records feels like ten million relationships. The evidence lens asks three questions of every record: is it consent-verifiable, is it identity-resolvable, and has it been activated in any channel in the last quarter? The share of most Indian enterprise databases that passes all three is small, and the gap between headline count and activatable count is the truest measure of how much of the data programme is theatre.
There is also an organisational tell. When data collection is funded but activation is not, the imbalance shows up in the budget before it shows up in the results: money for forms, pixels, enrichment, and storage; nothing for identity infrastructure, channel integrations, experimentation, or the consent tooling that makes any of it lawful. That budget shape is common because collection is easy to buy and activation is an operating capability that must be built. But under a phased-enforcement statute, the shape is now actively dangerous — it accumulates regulated inventory at exactly the moment the cost of holding unusable inventory is rising.
On Monday, commission a three-column inventory of every consumer data store the organisation holds: consent-verifiable, identity-resolvable, activated in the last ninety days. Set a policy for records that fail all three — re-permission them through a genuine value exchange, or delete them, and treat deletion as risk reduction rather than loss. Move the consent management layer out of the legal department’s pending file and into the marketing technology architecture, budgeted and owned, before the next tranche of DPDP obligations lands. And impose one rule on all future data investment: no new collection initiative is approved without a named activation use case, a channel that can receive it, and a measurement plan. The brands that treated first-party data as a collection race are about to discover what they actually won. The brands that treat it as an activation discipline will find the regulation is not a constraint at all — it is a moat around data they can lawfully use and their competitors cannot.