A marketing head at a growing Indian consumer brand is asked a simple question by her legal team: "For the four lakh people on our WhatsApp and email lists, can you show when each of them agreed to receive marketing, what they were told, and how they can withdraw?" She can show some of it. The rest came from festive campaigns, contest entries, an old app, a partner promotion and a list the previous agency built. Nobody is quite sure.
That question is about to become unavoidable. India's Digital Personal Data Protection Rules reach their first anniversary this month, and the substantive obligations apply from 13 May 2027, with maximum penalties of ₹250 crore for security safeguard failures, ₹200 crore for breach-notification or children's data failures, ₹150 crore for breaching the additional obligations of Significant Data Fiduciaries, and ₹50 crore for breaches of other provisions of the Act or Rules. These are ceilings, not automatic fines: the Data Protection Board decides any penalty after an inquiry. Much of the coverage treats this as a job for lawyers and IT teams. For marketers, it is more direct than that. Because the DPDP Act offers no broad "legitimate interest" basis like Europe's GDPR, most marketing depends on consent, which makes May 2027 a marketing deadline, not just a legal one.
This is general information for marketers, not legal advice. The DPDP framework is new, official guidance is still developing, and timelines could change. Take legal advice on how the Act and Rules apply to your business.
Where things stand, one year in
The Ministry of Electronics and Information Technology notified the DPDP Rules in mid-November 2025 (see the Gazette notification of the Rules, the Gazette notification bringing the Act into force and the government's PIB announcement), bringing the 2023 Act into force in three phases. The first phase took effect straight away, establishing the Data Protection Board framework and definitions. The second, around 13 November 2026, opens the framework for registering Consent Managers, the platforms that will let people give, manage and withdraw consent across services. The third, on 13 May 2027, brings in almost everything that affects day-to-day marketing: notice and consent requirements, security safeguards, breach reporting, individuals' rights, children's data protections, retention and deletion, and the penalties. Both Gazette notifications are dated 13 November 2025, hence 13 May; some legal commentary gives 14 May, counting from the 14 November date in the government's announcement. Plan to be compliant by 13 May.
One more reason not to wait: at a January 2026 stakeholder meeting, the government proposed compressing the timeline to 12 months for large Significant Data Fiduciaries. As of late October 2026, no amendment had been published in the Gazette, so 13 May 2027 still stands, but treat it as the latest date, not a comfortable one.
Why this lands on marketing's desk
Under Europe's GDPR, many businesses rely on "legitimate interests" for some marketing, such as emailing existing customers about similar products. The DPDP Act has no equivalent broad basis. Personal data can be processed with consent, or for a short list of "certain legitimate uses", such as where someone voluntarily provides data for a specific purpose. Giving your phone number for delivery updates, for example, doesn't by itself make that number available for promotional WhatsApp campaigns. Channel rules still apply on top: DPDP consent doesn't replace TRAI's rules for promotional SMS and calls, or WhatsApp's own opt-in requirements.
So consent becomes the foundation of most marketing that uses personal data: email, SMS, WhatsApp, and retargeting, audience uploads, personalisation and analytics that identify individuals. Truly anonymous, aggregated reporting isn't personal data, but customer lists, hashed emails for audience matching and device IDs tied to a profile still identify people. The Act sets a high bar: consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and linked to a clear notice explaining the data and purposes. People must be able to withdraw as easily as they agreed. If you have worked with GDPR, the checklist in GDPR and CCPA for marketers will feel familiar, but don't assume that a GDPR-ready setup is automatically DPDP-ready.
The Act covers digital personal data processed in India, and processing outside India connected with offering goods or services to people in India, so an overseas vendor or a brand selling into India from abroad is not outside its reach.
KrispCall
Cloud phone system with virtual numbers in 100+ countries, IVR, call recording and CRM integrations.
Best for: SMBs & remote sales teams needing global virtual numbers
What changes for marketers, area by area
| Requirement | What it means for marketing | Have ready |
|---|---|---|
| Notice and consent | Clear, itemised notice; consent specific to each stated purpose | Rewritten forms and consent records |
| Existing data | Existing contacts may need a notice; every list needs a valid basis | A re-notice plan and a list audit |
| Withdrawal | Opting out must be easy and stop processing everywhere | Opt-outs that reach every tool |
| Children (under 18) | Parental consent; no targeted ads or behavioural tracking | Age signals and audience exclusions |
| Processors | You remain responsible for agencies and tools | Updated contracts and instructions |
| Retention and rights | Delete when no longer needed; answer requests | Retention periods and request workflows |
| Breaches | Tell affected people and the Board without delay; full details to the Board within 72 hours | A plan covering marketing systems |
The overlooked job: your existing database
Most preparation focuses on new sign-ups. But Section 5(2) of the Act covers data already being processed on consent given before its commencement. The business must give those people a notice as soon as reasonably practicable, setting out the data held, the purposes, and how to withdraw or complain, and Section 5(2)(b) lets it continue processing on that earlier consent until the person withdraws it. Because that processing rests on the original consent, it stays within that consent's scope and purpose. The notice doesn't expand the purpose, create consent where none existed, or validate bought lists or unrelated promotional use. For a brand with lakhs of contacts gathered over years of campaigns, that is a significant marketing project in its own right.
Start by knowing where every list came from. Contacts from festive campaigns, contests, partner promotions or bought lists may carry very different levels of evidence, and some may not be usable at all. Plan the notice as a clear, honest communication rather than a buried legal email, and expect some people to withdraw. That is not a loss so much as a cleaner list: people who stay are more likely to engage, which also helps deliverability. The foundations are in building a first-party data strategy.
The shift Because the DPDP Act offers no broad legitimate-interest basis, most marketing depends on consent. That makes May 2027 a marketing deadline, not just a legal one, and your existing database is part of it.
Children: the rule with the widest reach
Under the DPDP Act, a child is anyone under 18, a higher threshold than many other regimes. Processing a child's personal data requires verifiable consent from a parent or lawful guardian, and the Act separately prohibits tracking, behavioural monitoring and targeted advertising directed at children. The Rules allow limited exemptions for certain organisations and purposes, but for most brands the practical implication is clear: interest-based ads, retargeting and custom audiences should not be aimed at people you know or have reason to believe are under 18.
That matters well beyond children's brands. Gaming, education, fashion, beauty, snacks and entertainment all have large teenage audiences. Review how you identify likely minors, which audiences you build and upload, how your ad platform age settings are configured, and what your creative and influencer campaigns target. Penalties for breaching children's data obligations can reach ₹200 crore.
A 27-week plan
From early November to 13 May 2027 is roughly six months. That sounds like plenty until you lay out the work.
From 3 November 2026 to 13 May 2027 is 191 days, about 27 weeks.
→ Map data and purposes: 4 weeks
→ Notices, consent flows and the re-notice plan: 8 weeks
→ Vendor and agency contracts: 4 weeks
→ Withdrawal, rights and grievance workflows: 4 weeks
→ Children's data, retention and breach plan: 3 weeks
→ Test and fix: 4 weeks
Total: 27 weeks. Almost no practical buffer, and that assumes each step runs in sequence without delays, holiday slowdowns or waiting on vendors.
The practical conclusion: run workstreams in parallel wherever you can, and start mapping data this month.
Where to start this month
Map your marketing data. List every source, from website forms, checkout and apps to WhatsApp opt-ins, contests, events, partner campaigns and imported lists, and record what was collected, what people were told and where it now lives. Festive campaigns such as those described in Diwali 2026 e-commerce planning generate large volumes of new contacts, so include this season's data now rather than later.
Redesign consent at the point of collection. Separate consent for separate purposes, write notices people can actually understand, and make the flow easy to complete, using the patterns in building a consent-based data collection flow. The law asks for consent specific to the stated purposes, not a checkbox per channel, though separate email, SMS and WhatsApp choices are a sensible way to show it. For website tracking, see cookie consent without killing your analytics and Consent Mode v2. Update your privacy policy so it matches what you actually do, as covered in writing a privacy policy marketers can follow.
Make withdrawal and rights work end to end. An unsubscribe that stops email but not WhatsApp, or that doesn't reach your agency's audience lists, isn't enough. Build workflows for access, correction and erasure requests, using the approach in data subject access request workflows, and set retention periods following data retention and deletion. Two details in the Rules are easy to miss: certain personal data, traffic data and logs must be kept for at least a year for purposes the Rules specify, and large e-commerce, gaming and social media platforms must erase inactive users' data after three years, with 48 hours' notice.
Talk to your agencies and vendors. Under the Act, the business remains responsible for processors acting on its behalf, so agencies, CRMs, messaging platforms and ad tech partners need clear contracts and instructions. The rising cost of getting this wrong internationally is covered in data privacy fines are rising in 2026, and brands selling across borders should also track US state privacy laws.
The opportunity inside the obligation
It is easy to see DPDP only as risk. But the brands that prepare well will end up with something valuable: smaller, cleaner, genuinely engaged lists; clearer consent that holds up; and customers who trust them with data. In a market where WhatsApp and SMS are central to marketing, that trust is a competitive advantage. Brands that want consent-first lifecycle messaging designed and built properly often work with a specialist email marketing automation team.
The short version
India's DPDP Rules were notified in mid-November 2025 and take effect in phases: the Board framework immediately, Consent Manager registration around 13 November 2026, and the substantive obligations and penalties, up to ₹250 crore depending on the breach, from 13 May 2027, a date the government proposed bringing forward for large Significant Data Fiduciaries, though no change had been notified by late October 2026. Because the Act has no broad legitimate-interest basis, most marketing depends on consent that is free, specific, informed, unconditional, unambiguous and easy to withdraw, which makes this a marketing deadline, not just a legal one. Key areas are purpose-specific notice and consent, a re-notice plan for existing contacts, withdrawal that reaches every tool, the ban on targeted advertising and tracking directed at under-18s, responsibility for agencies and vendors, retention, rights requests and breach reporting. With about 27 weeks left and a realistic plan using all of them, start mapping your marketing data this month, run workstreams in parallel, and take legal advice for your situation.
Is your customer database ready for DPDP?
We help Indian brands rebuild consent-first email, SMS and WhatsApp marketing.
Explore Email Marketing Automation →Frequently asked questions
When do India's DPDP Rules take full effect?
The Digital Personal Data Protection Rules, 2025 were notified in mid-November 2025 and take effect in three phases. Provisions establishing the Data Protection Board and the framework came into force at notification. The Consent Manager registration framework follows around 13 November 2026, twelve months later. The substantive obligations for businesses, including notice and consent requirements, security safeguards, breach reporting, data principal rights, children's data protections, retention and deletion, along with the penalty provisions, apply from 13 May 2027, eighteen months after the Gazette notifications dated 13 November 2025; some legal commentary gives 14 May, counting from the date in the government's announcement, so aim to comply by 13 May. In January 2026 the government proposed shortening the timeline for large Significant Data Fiduciaries; no amendment had been notified by late October 2026, but businesses should check the current official position rather than assume the dates cannot move. This is general information, not legal advice.
Does the DPDP Act require consent for marketing?
In most cases, yes. Unlike Europe's GDPR, India's DPDP Act does not include a broad legitimate-interest basis that businesses can rely on for marketing. Personal data can be processed either with the individual's consent or for a limited list of legitimate uses set out in the Act, such as where a person voluntarily provides data for a specific purpose, and those uses do not generally extend to promotional marketing beyond that purpose. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and linked to a clear notice describing the data and the purposes it will be used for. People must be able to withdraw consent as easily as they gave it, after which processing must stop, including by vendors acting on the business's behalf. For marketers, this means consent records for email, SMS, WhatsApp, and for tracking and audience targeting that use identifiable data, become central operational assets. This is general information, not legal advice.
What does the DPDP Act mean for marketing to children?
It changes it significantly. Under the DPDP Act, a child is anyone under 18, not under 13 or 16 as in many other regimes. Businesses need verifiable consent from a parent or lawful guardian before processing a child's personal data, and the Rules set out how that verification should work. Separately, the Act prohibits tracking, behavioural monitoring and targeted advertising directed at children, which affects interest-based ads, retargeting and audience building for any campaign that could reach under-18s. The Rules allow limited exemptions for certain classes of organisations and purposes, but these are narrow. Brands in categories popular with teenagers, such as gaming, education, fashion, beauty and snacks, should review how they identify likely minors, which audiences they build, and how their ad platform settings and first-party data practices handle younger users. Penalties for breaching children's data obligations can reach ₹200 crore. This is general information, not legal advice.
What should marketers do now to prepare for DPDP?
Start with a clear picture of your data, then work through the areas where marketing is most exposed. Map what personal data your marketing collects, where it comes from, where it is stored, which tools and agencies process it, and for what purposes. Rewrite notices and consent flows on websites, apps, forms, checkout, WhatsApp and SMS so they are clear, itemised and purpose-specific, and plan the notice the Act requires for consents obtained before its commencement. Processing can continue on that earlier consent until it is withdrawn, but only within its original scope and purpose; the notice doesn't create consent or validate bought lists or unrelated promotional use. Make withdrawal easy and ensure it reaches every system and vendor. Update contracts with agencies and marketing technology providers. Build workflows for access, correction and erasure requests, set retention periods, prepare a breach response plan, and review how you handle children's data and targeting. With roughly six months to go, most organisations have little slack. Take legal advice for your specific situation.
