Insight · MeasurementTOFU
The DPDP Rules: what Indian marketers need to change
The short answer
India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules notified in November 2025 change how marketers may collect and use personal data, with obligations phasing in through May 2027 (PIB). For most marketing teams, the work is practical: clearer notices, real consent, easy withdrawal, tighter data handling and better vendor contracts.
This article summarises the law for planning purposes. It isn't legal advice; have your notices, contracts and processes reviewed by a qualified adviser.
The principles that matter for marketing
- Notice — tell people, in clear and plain language, what personal data you collect and why, before or when you ask for it
- Consent — free, specific, informed, unconditional and unambiguous, given through a clear affirmative action; no pre-ticked boxes
- Withdrawal — withdrawing consent must be as easy as giving it
- Purpose limitation — use data for the purpose you stated, not anything you might want later
- Erasure — delete personal data when the purpose is served or consent is withdrawn, unless a law requires you to keep it
- Security and breaches — take reasonable security safeguards and notify the Data Protection Board and affected people of a breach
- Children — for anyone under 18, get verifiable parental consent; tracking, behavioural monitoring and targeted advertising directed at children are not allowed
Penalties under the Act can run up to ₹250 crore for some failures, which is why this belongs on the marketing agenda rather than only legal's.
Where marketing touches personal data
Almost everywhere:
| Activity | Personal data involved | What to check |
|---|---|---|
| Lead forms and landing pages | Name, phone, email, enquiry details | Notice next to the form, a consent checkbox that isn't pre-ticked, purpose stated |
| WhatsApp, SMS and email marketing | Phone numbers, email, messages | Recorded opt-in, easy opt-out, sender registration for SMS (DLT) |
| Customer-match and lookalike uploads | Hashed emails and phones | Your notice covers advertising use; consent recorded; lists refreshed when people opt out |
| Pixels, tags and Conversions API | Identifiers, behaviour on site | What you send, why, and whether you minimise it; consider server-side tagging for control |
| CRM and sales follow-up | Lead details, call notes | Access controls, retention period, deletion process |
| Agencies and tools | Everything above | Data processing terms, security and breach duties |
What to change first
- Map your data. List every form, list, tag, tool and export that holds personal data, and who can access it.
- Rewrite notices. Short, plain-language notices at each collection point, linked to a full privacy policy.
- Fix consent capture. Unticked checkboxes, separate consent where purposes differ, and a record of when and how consent was given.
- Make withdrawal easy. A visible unsubscribe, an opt-out keyword on WhatsApp and SMS, and a process to remove people from ad audiences and CRM campaigns.
- Minimise. Stop collecting fields you don't use; send platforms only the events and identifiers you need.
- Contract your vendors. Agencies, CRMs, call-tracking and messaging providers should commit to security, breach notification and deletion.
- Plan for breaches. Know who decides, who tells the Board and affected people, and how quickly.
Children and edtech
Education, gaming, toys and youth fashion need special care. Because children are defined as under 18, a large share of the audience for coaching and test-prep is covered. Campaigns should be directed at parents and adult students, children's data should only be processed with verifiable parental consent, and targeting or tracking that is directed at children should stop. See also our notes on education lead generation.
What doesn't change
Good marketing still works. First-party relationships — customers who chose to hear from you — become more valuable, not less. Measurement still works when designed with consent and minimisation in mind, and platform tools such as the Conversions API can be configured to send only what's necessary. Our marketing analytics and CRM marketing teams build tracking and lists this way by default, alongside your legal adviser.
A consent wording example (illustrative)
A short notice and consent line under a lead form might read: "We'll use your name, phone number and email to respond to your enquiry and, if you agree, to send you offers about our services. You can withdraw consent at any time by replying STOP or emailing privacy@yourbrand.com. See our privacy policy." — followed by an unticked checkbox for marketing communications. Keep enquiry handling and marketing consent distinct where the purposes differ, and record when and how consent was given. Have your adviser adapt the wording to your business.
What to ask your agency and vendors
- Which personal data do you collect, store or send on our behalf, and where is it stored?
- Who on your team can access our customer and lead data?
- How do you handle opt-outs across ad audiences, WhatsApp, SMS and email?
- Which tools and sub-processors touch our data?
- What happens to our data when the engagement ends?
- How would you tell us about a breach, and how quickly?
Consent managers
The Act also creates registered consent managers — platforms through which people can give, manage and withdraw consent across businesses. Their role will grow as the Rules phase in. Marketers don't need to build anything for this today, but consent records should be clean and exportable so they can connect to such systems later.
Frequently asked questions
When do the DPDP Rules take effect?
The Rules were notified in November 2025, with obligations phasing in through May 2027. Plan to have notices, consent and processes ready well before then.
Can we still run retargeting?
Generally yes, with a clear notice, a lawful basis (usually consent) and respect for withdrawals. Remove people who opt out, and don't target children.
Do we need consent for WhatsApp marketing?
Yes — WhatsApp's own policies already require opt-in, and DPDP consent rules apply to the phone numbers you use. Keep a record of opt-ins and make opting out easy.
Is hashing customer lists enough?
Hashing protects data in transit, but it doesn't replace notice and consent. Your notice should say that you use contact details for advertising.
Does DPDP apply to B2B leads?
It applies to personal data of individuals, which includes the names, emails and phone numbers of people at businesses.
Do we need a cookie banner in India?
The DPDP framework focuses on personal data and consent rather than cookies as such. If your tags collect personal data, provide notice and obtain consent where required; many brands use a consent banner, especially if they also serve visitors from Europe.
Is a privacy policy enough?
No. A policy helps, but the Act expects notice at the point of collection and consent given through a clear action. Link the policy from short, specific notices.
Keep reading
Services behind this
Terms used on this page
Talk to a strategist
Thirty minutes. Your numbers. A straight answer.
Book a strategy call with the people who'd actually run your account. We'll tell you what we'd do — or that you don't need us yet.