Overview
Gaana (owned by Gamma Gaana Ltd. / Times Internet) is one of India’s leading music streaming services. Its data ecosystem is heavily reliant on advertising-led monetization, requiring the tracking of user preferences, location data, and device identifiers. Under the Digital Personal Data Protection (DPDP) Act 2023, such extensive behavioral profiling requires a significant shift from ‘implied’ to ‘explicit’ consent.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
Gaana uses a legacy “Notice and Consent” model. The policy states that by accessing the service, the user is “consenting to the collection, storage, and use” of information.
DPDP requirement: Section 6 requires consent to be free, specific, informed, unconditional, and an unambiguous indication of intent through an affirmative action.
Gap: Gaana’s consent is bundled. Users cannot opt-out of advertising tracking while opting-in to the music service itself. The “notice” is not provided in multiple languages as suggested by the DPDP framework, nor is it “itemised” to show specifically what data is used for which purpose.
Section 8 — Obligations of Data Fiduciary ⚠️
The policy mentions “reasonable security practices and procedures” and “ISO/IEC 27001” standards. While this aligns with the spirit of Section 8, the DPDP Act introduces a higher burden of “completeness” and “accuracy” of data.
Gap: There is no explicit mention of the obligation to notify the Data Protection Board and affected users in the event of a personal data breach, which is a mandatory requirement under Section 8(6) of the Act.
Section 9 — Data Retention & Erasure 🔴
Critical gap. Gaana’s policy states data is kept “for as long as the purpose for which it was collected continues” or as “required by law.”
DPDP requirement: Section 9(1) mandates that a Data Fiduciary must erase personal data as soon as the purpose of collection is met or consent is withdrawn.
Gap: The policy does not provide a mechanism for the user to trigger “Right to be Forgotten” or a clear timeline for when data is purged after account deactivation.
Section 11 — Rights of Data Principal ⚠️
The policy allows users to “review and correct” information. However, it lacks the expanded suite of rights introduced by the DPDP Act:
- Right to Erasure: Not explicitly defined as a statutory right.
- Right to Nominate: There is no provision for a user to nominate another person to exercise their rights in case of death or incapacity (Section 14).
- Summary of Data: No mechanism exists for a user to request a summary of personal data processed and the identities of all other Data Fiduciaries/Processors with whom data has been shared.
Section 12 — Right of Grievance Redressal ⚠️
Gaana has appointed a Grievance Officer, meeting the legacy requirements of the IT Act.
Gap: To be DPDP compliant, the policy must inform the user that they have the right to exhaust this internal grievance process and then approach the Data Protection Board of India. Gaana’s policy is silent on this external escalation path.
Section 16 — Cross-Border Data Transfer ⚠️
The policy states that information may be transferred to and maintained on computers located outside the user’s state or country where privacy laws may differ.
Gap: Under DPDP Section 16, the Central Government may restrict the transfer of personal data to certain notified countries (negative list). Gaana’s policy uses a blanket transfer clause that does not account for these future restricted jurisdictions or provide the required safeguards for international transfers.
Risk Assessment
| Category | Risk Level | Mitigation Required |
|---|---|---|
| Consent Architecture | HIGH | Implement a Consent Manager (Section 6) with granular check-boxes. |
| Data Erasure | HIGH | Automate deletion workflows for inactive accounts and withdrawn consent. |
| User Rights | MEDIUM | Update UI to allow for “Nomination” and “Request for Summary.” |
| Notice Compliance | MEDIUM | Provide a “Notice” at the time of collection in 22 scheduled languages if requested. |
Conclusion
Gaana’s current privacy policy is a classic “Web 2.0” document—focused on broad permissions for data monetization while offering minimal control to the user. To reach DPDP compliance, Gaana must move away from the “Terms of Use” style agreement and adopt a “Privacy by Design” framework that treats consent as a revocable and specific transaction rather than a one-time entry fee.