Overview
Disney+ Hotstar (operated by Novi Digital Entertainment) is India’s leading OTT platform with hundreds of millions of users. The platform processes highly personal ‘behavioral’ data—including viewing history, search queries, and location data—alongside sensitive financial information for premium subscriptions. Under the DPDP Act 2023, Hotstar is classified as a Data Fiduciary and likely qualifies as a ‘Significant Data Fiduciary’ (SDF) due to the volume of data and potential risk to public order, necessitating a higher standard of compliance.
DPDP Readiness: Section-by-Section Analysis
Section 5 & 6 — Notice and Consent ⚠️
Hotstar uses an “Acceptance by Use” model. By accessing the service, users are deemed to have accepted the policy. This “bundled consent” is a direct violation of Section 6 of the DPDP Act, which requires consent to be free, specific, informed, unconditional, and an affirmative action.
Gap: The current notice does not provide a clear, separate table of “What data is collected” and “For what specific purpose” as suggested by the DPDP illustrative guidelines. Users cannot opt-in to streaming while opting-out of ad-tracking at the initial consent layer.
Section 8 — Security and Accuracy ✅
The policy excels in describing its technical safeguards. It mentions administrative, technical, and physical safeguards to protect personal information against loss, theft, and unauthorized access.
Strength: Hotstar’s alignment with global Disney standards ensures high-level encryption and access controls, which satisfies the “reasonable security safeguards” requirement under Section 8(5).
Section 9 — Processing of Personal Data of Children 🔴
This is a major compliance bottleneck. DPDP Section 9 prohibits processing data of children (under 18) that is likely to cause detrimental effects and requires “verifiable parental consent.”
Gap: Hotstar’s “Kids Mode” and age-gating are designed for content filtering, not for DPDP-grade parental consent verification. Furthermore, the Act prohibits “tracking or behavioral monitoring” of children. Since Hotstar’s core business involves tracking viewing habits to recommend content, its current model for users aged 13-18 is in direct conflict with Section 9.
Section 9 — Data Retention and Erasure ⚠️
What the policy says: “We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy.”
DPDP requirement: Section 9(6) requires the Data Fiduciary to erase personal data as soon as the purpose of collection is no longer served or consent is withdrawn.
Gap: The policy lacks an “Erasure by Default” clause. It does not specify that data will be purged within a set window (e.g., 30 days) after a subscription expires or an account is deleted, relying instead on vague “business necessity” windows.
Section 11 — Rights of Data Principal ⚠️
Hotstar allows users to “access, correct or update” their information via account settings. However, it misses the newer statutory rights:
- Right to Nominate: No mechanism to appoint a nominee.
- Right to Erasure: While “Delete Account” exists, the policy does not explicitly guarantee the erasure of data held by third-party “Data Processors” (like analytics partners) upon the user’s request to the Fiduciary.
Section 12 — Right of Grievance Redressal ⚠️
The policy identifies a Grievance Officer, providing an email and physical address in Mumbai.
Gap: Under the DPDP Act, the Data Principal must exhaust the Fiduciary’s grievance process before approaching the Data Protection Board (DPB). Hotstar’s policy does not mention the DPB as the secondary regulatory authority, potentially misleading users about their legal escalation options.
Risk Assessment
| Category | Risk Level | DPDP Compliance Gap |
|---|---|---|
| Consent | High | Bundled consent; lack of granularity and specific notice (Section 6). |
| Children’s Data | Critical | Tracking/behavioral profiling of minors (under 18) without verifiable consent (Section 9). |
| Data Erasure | Medium | No defined “expiry date” for data; vague retention language (Section 9). |
| Principal Rights | Medium | Missing Right to Nominate (Section 14) and limited right to withdraw consent easily. |
| Governance | Low | Strong internal security and clear grievance contact (Section 8/12). |
Recommendation
Hotstar must transition from a “Global/GDPR” privacy template to an “India-First” DPDP framework. Priority should be placed on implementing a Consent Manager interface that allows users to toggle specific processing activities, and a radical overhaul of how users under 18 are tracked and profiled on the platform.