Subscriber data, done right.
Newsletter opt-in, ad-tech consent, reader DSR, IT Rules 2021 Grievance Officer, editorial source protection. One tenant that handles subscription re-consent for legacy lists, generates IAB TCF v2.2 signals for every vendor, logs the Grievance Officer workflow, and keeps editorial source data walled off from platform data.
one unsub propagates to every CDP + ESP in secondsSix frameworks, one newsroom.
DPDP for reader data. IT Rules 2021 for the grievance pipe. Press Council for the content. TCF for the ad-tech. GDPR if EU readers. CERT-In for the breach.
Four fires that lose the audience.
Existing newsletter list re-consent. Legacy subscribers signed up under IT Act, not DPDP. Need re-consent or a documented legitimate basis. Re-consent workflow with one-click opt-out.
Ad-tech + IAB TCF. Every pixel, SSP, DMP tag = joint-controller relationship. Need disclosure, purpose consent, preference centre per vendor, DPA with each. TCF v2.2 signal built in.
IT Rules 2021 grievance officer. India-resident Grievance Officer, published contact, 15-day resolution, monthly report if significant publisher. Not an email alias — a tracked ticket pipe.
Editorial source protection. Sources need protection. Access controls, time-boxed reads, no bulk export, audit trail. Separate from the platform-side data store.
Every publisher module, reader-first.
Publisher engagement from Rs 1,99,999 (60 days). Significant-publisher Enterprise (custom). Managed retainer from Rs 19,999/mo.
Publishing compliance in four numbers.
Questions editors and ops leads actually ask.
Digital publishers process reader personal data through subscriptions, comments, newsletter sign-ups, analytics, ad targeting and personalisation. Every one is subject to DPDP. Publishers additionally face Press Council rules on journalistic accuracy, IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 for news content, and CERT-In 6-hour breach reporting.
The DPDP Act has a research/journalism exemption but it is narrow. It exempts only the processing needed for a specific journalistic story, not the general data-collection infrastructure of a publisher (subscription, analytics, ad platform, comment system). dcomply keeps journalism and platform-side data separate in the processing register.
Every third-party pixel, SSP or DMP tag on a publisher's site is a joint-controller relationship under DPDP. Requires: disclosure in the notice, purpose-specific consent (usually "advertising and measurement"), preference-centre control per vendor, and a data-processing addendum with each vendor. dcomply's consent widget supports IAB TCF v2.2 signal generation.
The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 require digital news publishers to appoint a Grievance Officer (India-resident), publish a monthly compliance report if a significant publisher, honour 15-day grievance resolution timelines, and self-regulate content under the Press Council of India / NBSA code.
Reader data used for AI-generated news or personalisation must be covered by explicit purpose-scoped consent. "Improving our service" is not specific enough. Also: DPDP Rule 12 mandates a DPIA before deploying AI systems that process personal data at scale. dcomply auto-triggers the DPIA workflow when an AI purpose is added.
DSR requests from readers must be honoured within 90 days. For publishers this means: erase newsletter subscription, remove/anonymise reader comments per journalistic archive policy, fan out to CDPs and email platforms, and produce an export bundle. dcomply's DSR portal plus connector layer handles all of this via the /api/v1 endpoint.
Yes, under DPDP. Existing lists need re-consent or a documented legitimate basis. dcomply's Consent Manager handles the re-consent workflow.
Anonymous readers don't need consent management. The moment you have identifiable data (email, phone, account) DPDP applies.
Yes. The Grievance module publishes the required officer details and logs the workflow.
Sensitive-source workflow with access controls, audit trail, and time-boxed access. Designed with editorial teams to preserve source confidentiality.
dcomply is a processor for the personal data you upload. A DPA is in place at signup.
Request a scope. Re-consent your list in a week.
Publisher engagement from Rs 1,99,999 (60 days). Significant-publisher Enterprise custom-quoted. Managed retainer from Rs 19,999/mo.