Marketing teams handle more personal data than almost any other function: names, emails and phone numbers from forms, behaviour data from websites and apps, customer lists uploaded to ad platforms, call recordings and chat logs, and increasingly, data passed to AI tools. India's Digital Personal Data Protection Act, 2023, and the rules notified under it, change how this data must be collected and used. This article explains the main obligations in marketing terms and turns them into a practical checklist. It is an operational guide from a marketing perspective, not legal advice; confirm your obligations with a lawyer.
Where things stand
The Digital Personal Data Protection Act, 2023 was passed by Parliament in August 2023. According to the Government of India's press release, the Digital Personal Data Protection Rules, 2025 were notified in November 2025 and provide a phased period for compliance, including the establishment of the Data Protection Board. Because obligations come into force in stages, check with your legal adviser which provisions apply to you now and which apply later. Planning early is sensible, because changing forms, consent records, data flows and vendor contracts takes time.
Notice and consent
Under the Act, personal data is generally processed on the basis of consent or for certain legitimate uses set out in the law. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the specified purpose. It must be preceded by a notice explaining what data is collected, the purpose, and how the person can exercise their rights and complain. For marketing, this means lead forms should state clearly what the data will be used for, consent for marketing communications should be separate from consent needed to deliver a requested service, pre-ticked boxes should be avoided, and consent should be recorded with a timestamp and the notice shown.
Withdrawal and rights
People must be able to withdraw consent as easily as they gave it, and once they do, processing for that purpose should stop within a reasonable time. The Act also gives individuals rights to access information about their data, to correction and erasure, and to grievance redressal. For marketing, every email and message should include an easy way to opt out, unsubscribes should sync across systems such as the CRM, email platform, WhatsApp provider and ad audience lists, and there should be a clear contact for data requests. Test the opt-out path end to end, because data often lives in several tools.
Children's data
The Act sets specific obligations for processing the personal data of children, defined as people under 18, including verifiable consent of a parent or lawful guardian, and it restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions in the rules. Marketing teams in education, gaming, consumer products and similar categories should review forms, audiences and ad targeting carefully with legal advice.
Ad platforms, CRMs and processors
When you upload customer lists to ad platforms, send conversion data through APIs, or store leads in a CRM, those vendors process data on your behalf or alongside you. Check that your notices cover these uses, that contracts with processors include appropriate data protection terms, and that you only share what is needed. Hashed data uploads reduce exposure but still involve personal data, so consent and purpose limits still apply. Keep a record of which tools hold personal data, what for and who administers them.
AI tools and personal data
Entering personal data into AI tools, such as call transcripts, customer lists or support tickets, is processing like any other. Use business tiers with terms that prohibit training on your data and meet your obligations, mask identifiers where you can, limit what is entered to what the task needs, and include AI tool use in your records of processing and vendor reviews. Set clear rules for the team about what may and may not be entered into AI tools.
Security and breaches
Data fiduciaries must take reasonable security safeguards to prevent personal data breaches, and the Act requires breaches to be reported to the Data Protection Board and affected individuals in the manner set out in the rules. The Act's schedule sets out penalties, which can be substantial for failure to take reasonable security safeguards. For marketing, the practical steps are basic but important: named user access to every tool, two-factor authentication, removing access when people or agencies leave, avoiding spreadsheets of leads shared by email, and knowing who to call if something goes wrong.
Marketing DPDP checklist
Use this as a starting point for a review with your legal adviser.
| Area | Check |
|---|---|
| Forms | Clear notice of data and purpose; separate, unticked marketing consent |
| Consent records | Timestamp, notice version and source stored in the CRM |
| Opt-out | Easy unsubscribe in every message; syncs across all tools and audiences |
| Data inventory | List of tools holding personal data, purpose and admin |
| Vendors | Processor contracts reviewed for data protection terms |
| Ad audiences | Customer list uploads covered by notice and consent |
| AI tools | Business tiers, no training on your data, masking, team rules |
| Children | Age considerations, parental consent and ad targeting reviewed |
| Security | Named access, two-factor authentication, offboarding, breach plan |
| Requests | Published contact and process for access, correction and erasure |
Making consent part of the funnel
Good consent practice can improve marketing rather than just constrain it. Clear notices and an honest choice about marketing communications tend to produce a smaller but more engaged list, with fewer complaints, unsubscribes and spam reports, which helps deliverability on email and quality ratings on WhatsApp. Recording consent with source and date in the CRM also makes segmentation easier: you know who agreed to what, through which form and when. Build consent capture into every entry point at the design stage, including landing pages, chat flows, WhatsApp entry points, events and offline forms, rather than adding it after launch. Treat the consent rate as a funnel metric, and test notice wording for clarity, not to pressure people into agreeing.
Sources
Press Information Bureau, Government of India, Government notifies DPDP Rules (November 2025): https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014
Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
Working with agencies and vendors
Marketing teams often share personal data with agencies, freelancers, event partners, data providers and technology vendors. Each relationship needs attention. Agencies running ads or email on your behalf should access data through your accounts with named users, not by receiving spreadsheets of contacts. Contracts should set out what data they may use, for what purpose, how it is secured and that it is returned or deleted at the end. Be cautious with purchased or rented contact lists, because you need to be confident the people were given notice and gave consent that covers your use. Event partners and co-marketing arrangements should state clearly, at the point of collection, which companies will receive attendees' details and for what. Review these arrangements with your legal adviser as part of your DPDP preparation.
FAQ
Yes. Collecting and using personal data such as names, emails, phone numbers and behaviour data for marketing is processing covered by the Act. Confirm which provisions apply to you now with legal advice.
According to the Government of India, the DPDP Rules, 2025 were notified in November 2025 with a phased compliance period. Check current timelines with your legal adviser.
The Act requires consent through a clear affirmative action, so pre-ticked boxes are best avoided. Keep marketing consent separate from consent needed for the service requested.
Only where your notice and consent cover that use and contracts with the platforms include appropriate terms. Hashing reduces exposure but the data is still personal data.
It is processing like any other. Use business tiers that do not train on your data, mask identifiers, limit inputs and include AI tools in vendor reviews.
Only with confidence that people received notice and gave consent covering your use. Many purchased lists cannot show this, so take legal advice before using them.
Contracts should cover permitted use, purpose, security, and return or deletion of data at the end. Agencies should work in your accounts through named access.
It applies to digital personal data of individuals, which includes business contacts' names, emails and phone numbers. Confirm the details of your case with legal advice.