India's DPDP Act and what it means for digital marketers

The Digital Personal Data Protection Act (DPDP Act) 2023 received Presidential assent in August 2023. The rules under the Act are still being finalized, but the direction is clear: Indian businesses that collect and process personal data need to rethink how they do it.

For digital marketers, this has direct implications for email lists, retargeting audiences, CRM data, lead management, and analytics. The question is not whether to comply but how to comply without destroying your marketing effectiveness.

What the DPDP Act requires from marketers

The Act establishes that personal data can only be processed for the purpose for which consent was given. This sounds obvious. In practice, many Indian marketing teams collect data for one stated purpose and use it for several others.

Someone who gives their email address to download a product brochure has consented to receive that brochure. They have not consented to receiving weekly promotional emails, being added to retargeting audiences on Meta, or having their data shared with third-party lead aggregators.

Consent must be informed, specific, and revocable. The checkbox pre-ticked with "I agree to receive marketing communications" that has been standard practice on Indian forms is not valid consent under this Act.

Data minimization is another principle. You cannot collect data you do not need. If you only need an email for a newsletter, you do not need a phone number, date of birth, and company name.

How this affects your existing marketing channels

Email marketing: your existing email lists need consent audit. Lists built through purchases, scraping, or unclear consent mechanisms are a liability. The safer approach is a re-engagement campaign asking existing subscribers to explicitly opt in under clear terms.

Meta and Google advertising: custom audiences built from customer data require that those customers consented to their data being used for advertising purposes. This is a gap for many Indian businesses. Standard terms of service that mention data sharing in dense legal language do not meet the consent standard.

CRM and lead management: leads collected through third-party sources, lead aggregators, or purchased lists are particularly vulnerable. If the original collection mechanism did not meet DPDP standards, using that data creates liability.

Practical changes for Indian marketing teams

Update your forms immediately. Every form that collects personal data needs a clear, specific consent checkbox that is not pre-ticked. The consent language should explain exactly how the data will be used.

Create a data inventory. This is a simple spreadsheet listing what personal data you collect, where it is stored, why you collect it, and what the consent basis is for processing it. You need this to respond to data subject requests.

Implement an unsubscribe mechanism that actually works and processes immediately. The DPDP Act gives individuals the right to withdraw consent and the right to erasure of their data.

Audit your third-party tools. Every marketing tool you use that processes personal data (email platforms, CRM, analytics, advertising platforms) should be on your inventory. Check their data processing agreements.

What the penalties look like

The DPDP Act specifies penalties up to ₹250 crore for serious violations. For significant data breaches without adequate security measures, the penalty can reach ₹200 crore.

These are not theoretical numbers. Similar legislation in Europe (GDPR) has resulted in substantial fines for Indian companies operating in European markets. The DPDP Act creates similar liability for operations within India.

Frequently asked questions