India’s Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how businesses collect and use personal data. This includes names, phone numbers and email addresses. Its rules are being brought into force in phases, so marketers should prepare now.
This is a general overview, not legal advice. Check the current status of the Act and its rules, and consult a lawyer for your situation.
Key ideas
- Consent: collect personal data with clear, specific consent for a stated purpose.
- Notice: tell people what you collect, why, and how they can withdraw consent or complain.
- Purpose limitation: use data only for the purpose you stated.
- Security: protect the data you hold.
- Rights: people can access, correct and ask you to erase their data.
- Retention: do not keep data longer than needed.
What it means for marketing
- Lead forms should say how you will use the data, such as calls and WhatsApp messages about the enquiry.
- Use separate, unticked opt-ins for marketing messages.
- Make opting out easy, and honour it everywhere.
- Do not buy or use scraped contact lists.
- Limit who in your team can access lead data.
Update your website
- A clear privacy policy; start with our privacy policy generator and have it reviewed.
- A cookie notice if you use tracking; try our cookie banner generator.
- A contact for privacy requests.
Good practice anyway
Respecting data builds trust, and permission-based lists perform better than cold lists.
Want to go deeper? Our complete guides cover each channel in detail, from SEO to WhatsApp.
