Connected products stream usage, location and sometimes household data back from the field.
In short
If it identifies a person, the Act applies: consent in the product, minimization by design, and security across the device fleet. Penalties reach ₹250 crore.
What changes for this sub-sector.
Usage, location and identifiers from connected products can identify people.
Build notice and consent into device setup, not buried in a portal.
Collect the least the product needs; avoid always-on capture you cannot justify.
Secure devices and update paths; unpatched fleets are a breach risk.
Support access and erasure for data tied to devices and accounts.
Cloud, analytics and connectivity partners are processors.
Design consent and minimization into the product first.
The readiness check surfaces consent, minimization and firmware gaps.
Take the readiness check →