Permission is a design material

India’s Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)). They give effect to the DPDP Act, 2023, with an eighteen-month period for phased compliance. Every Data Fiduciary must give a separate consent notice that is clear and easy to understand, and that explains the specific purpose for which personal data is collected and used.

The Act also sets the standard for leaving. Where consent is the basis for processing, a person may withdraw it at any time, “with the ease of doing so being comparable to the ease with which such consent was given.”

What we check: that a CRM can answer three questions about any contact: what they agreed to, when, and through which notice. And that unsubscribing takes no more steps than signing up did.

The European Accessibility Act has applied since 28 June 2025. Products and services in its scope, among them e-commerce, banking services, e-books, computers, smartphones and ticketing machines, must meet its accessibility requirements to be sold in the EU, with transition periods for some services already in use.

In practice, teams work to WCAG: the European standard EN 301 549 (V3.2.1) builds its requirements for web content on WCAG 2.1 level AA, and a revision built on WCAG 2.2 is in preparation.

What we check: consent itself. Cookie banners, preference centres and sign-up forms are among the least accessible parts of most sites, and a choice a person cannot operate is not a choice.

An agent that can send, buy, book or delete is making decisions on someone’s behalf. OWASP calls the failure Excessive Agency (LLM06:2025) and traces it to three root causes: excessive functionality, excessive permissions and excessive autonomy.

1. Sort every tool an agent can call into read, reversible and irreversible.
2. Let read and reversible actions run, and log them.
3. Put a named person in front of every irreversible one, with the agent’s reasoning and the data it used on screen.

The record matters as much as the gate. Every approval, refusal and override should be logged with who made it and what they saw, so a decision can be explained later to the customer it affected.

What we check: that the approval step shows enough for a person to say no. An approve button with nothing behind it is a rubber stamp, not oversight.

The last thing a reader sees from a brand is often its unsubscribe page. Gmail expects one-click unsubscribe from bulk senders, and RFC 8058 defines how a mail client can unsubscribe someone with a single request, sent as an HTTPS POST so a link scanner cannot do it by accident.

We built this newsletter’s way in and way out to the same standard: a confirmation email before anything else is sent, topics you choose rather than boxes ticked for you, one-click unsubscribe in the mail apps that support it and a link in every issue, and a page that confirms you have left without asking you to explain.

What we check: that leaving is as well designed as joining. People remember both.