DPDP Act for marketing: what binds your list from May 2027

Short answer: The DPDP Act 2023 was passed in August 2023, but the duties that touch a marketing list (notice, consent, withdrawal, erasure, children’s data, breach reporting, penalties) come into force eighteen months after the Rules were published in November 2025, which puts the start at 13 May 2027. Use the time to rewrite the opt-in notice, send that notice to contacts who consented earlier, and make withdrawal reach every tool. Bought lists have no fix.

Most Indian small businesses either read “₹250 crore” and freeze, or hear that the law passed in 2023 and assume it has not started. Both are wrong. The honest position is that there is a date and a short job list.

This guide gives both. It sits under our wider guide to marketing automation for small businesses in India, which covers consent in general terms. On 10 October 2026 we read the PIB fact sheet of 17 November 2025 in full, and the wording of the Act and the Rules as reproduced online. The official copies are the DPDP Rules, 2025 and the DPDP Act, 2023 on the ministry’s site, and they are what counts. This is not legal advice. Confirm anything you act on with a qualified adviser and the official text.

The date that matters is 13 May 2027

Parliament enacted the Act on 11 August 2023. The Rules were notified in mid-November 2025 (PIB says 14 November, the gazette notification is dated 13 November). PIB says they “introduce an eighteen-month period for phased compliance”, in three steps under rule 1.

Rules 1, 2 and 17 to 21 came into force on publication. Rule 4, on Consent Managers, follows after one year. Rules 3, 5 to 16, 22 and 23 follow after eighteen months: rule 3 is the notice rule, rule 6 security safeguards, rule 7 breach intimation, rule 8 erasure periods, rule 10 children’s consent and rule 14 rights and grievances.

A separate commencement notification switched on the Act’s own sections in the same three steps. Law firm summaries count from 13 November 2025 and give 13 May 2027 (one gives 12 May 2027). We did not read that notification, so the exact day is theirs, not ours.

What is already in force, and what is not

When	What
In force now	Definitions, the Data Protection Board provisions, rules 1, 2 and 17 to 21
From November 2026	Consent Manager registration (rule 4)
From 13 May 2027	Notice, consent, children’s data, rights, breach reporting, erasure, penalties

The Data Protection Board of India already exists, as a “fully digital” body of four members. People will be able to file complaints online and track them through a portal and mobile app, and appeals go to TDSAT.

So the marketing duties are not in force yet, but the body that hears complaints is. Starting good practice costs nothing. TRAI’s SMS rules and WhatsApp’s own opt-in rules apply today regardless, as our guide to DLT rules for SMS marketing in India explains.

Consent Managers, which must be “companies based in India”, are platforms for giving and withdrawing consent. You do not need to become one. Our view: do not buy consent software now.

What your sign-up notice has to say

The Act asks for consent that is “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, limited to the stated purpose and the data necessary for it. Our marketing automation guide covers that. What it leaves open is the notice, and rule 3 is specific.

The notice must stand on its own, independent of anything else you have told the person, in clear and plain language. PIB calls it “a separate consent notice that is clear and easy to understand.” At minimum it gives:

• An itemised description of the personal data you collect.
• The specified purposes, with a specific description of the goods, services or uses involved.
• The particular link to your website or app, and any other means, for withdrawing consent, exercising rights and complaining to the Board.

Withdrawal must be as easy as the sign-up. Our view: a “withdraw” link buried three pages deep fails that test.

The person must also be able to read the notice and the consent request in English or any Eighth Schedule language, for example Hindi, Kannada, Tamil, Marathi, Gujarati or Bengali. Keep purposes apart, because “appointment reminders” and “offers” are two purposes. Put the notice wherever you collect numbers, including the forms behind your AI lead generation and the opt-in wording in the marketing automation guide.

The list you already have

Section 5(2) covers consent given before the Act commenced. You must give those people the notice “as soon as it is reasonably practicable” after commencement, and you “may continue to process the personal data until and unless the Data Principal withdraws her consent.” The Act’s example is a shopping app sending the notice by email or in-app notification.

Our reading: that helps only where consent was really given. A number from a visiting card bowl, a bought list or a trade fair sheet with no opt-in has no earlier consent to carry forward. And the Act does not define “reasonably practicable” in days.

Sort the list into three piles now:

1. Contacts who clearly opted in, with a record of when and how.
2. Contacts who gave a number for one purpose, such as a booking, and never agreed to offers.
3. Contacts with no consent trail at all.

Send the new notice to pile one well before May 2027. Treat pile two as service contacts only. For pile three, stop marketing and ask for a fresh opt-in. A bought list has no fix.

A STOP has to reach your WhatsApp provider and your CRM

Section 6(4) says consent can be withdrawn at any time, as easily as it was given. Earlier processing stays lawful (6(5)), but after withdrawal you must, within a reasonable time, stop processing and cause your Data Processors to stop too, unless a law requires or authorises it (6(6)).

So one STOP must update every tool that holds the number. If a customer replies STOP on WhatsApp and your email tool keeps sending offers, the withdrawal did not travel.

If consent is disputed in a proceeding, you “shall be obliged to prove” that notice was given and consent obtained (6(10)). Keep the date, channel, exact notice shown and any withdrawal time.

”The tool is compliant” is not your defence

Section 8(1) makes the Data Fiduciary responsible for compliance, including processing done by a Data Processor on its behalf, “irrespective of any agreement to the contrary.” Section 8(2) allows a processor only “under a valid contract.” A fiduciary decides why and how personal data is processed; a processor processes it on the fiduciary’s behalf.

Our reading: your WhatsApp provider, email tool, CRM and the freelancer who runs your flows are processors, and you are the fiduciary. A “DPDP ready” banner on a sales page does not move the responsibility.

Rule 6 sets minimum security safeguards: measures such as encryption, masking or tokenisation, access controls, access logs and monitoring, backups, keeping logs for one year, and security terms in the contract with any processor. Ask each provider in writing how they meet these, and prefer tools that record consent, as in our guide to the best marketing automation platforms in India. Remove access for the freelancer who finished last year.

Ninety days to answer, and a contact on your website

Rule 14 requires you to publish on your website or app how a person can request to exercise their rights, and to publish your grievance system, responding within a reasonable period not exceeding ninety days. PIB says requests on access, correction, updating or erasure must be addressed “within a maximum of ninety days”. A person may nominate someone to act for them. Section 8(9) also requires you to publish contact details for a Data Protection Officer or another person who can answer questions about processing.

For a small business that is a footer page with a name, an email address and a plain description of how to ask. Our view: ninety days is a ceiling, not a target.

Children: the one place the Act forbids the marketing itself

Before processing a child’s personal data (anyone under 18) you must obtain the verifiable consent of the parent. Section 9 also says you “shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.”

Most of the Act regulates how you market. This section forbids some marketing outright. The Rules set exemptions for certain classes of business and purposes, which PIB summarises as “essential services such as healthcare, education or real-time safety”. Take advice before relying on one.

When to delete, and the three-year rule that is not about you

Section 8(7) says personal data must be erased when consent is withdrawn or as soon as it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, unless a law requires it to be kept. Your processor must erase it too.

You may have heard of a three-year inactivity rule. Rule 8 and the Third Schedule set it, with at least 48 hours’ notice before erasure, but only for e-commerce entities with not less than two crore registered users in India, online gaming intermediaries with not less than fifty lakh, and social media intermediaries with not less than two crore. A small business is in none of them, so section 8(7) governs.

Rule 8 also requires personal data, traffic data and processing logs to be retained for at least one year from the date of processing for the purposes in the Rules, then erased unless another law requires longer. Ask your adviser how that sits with a deletion request. Our view: set a clean-out date for your list instead of waiting to be asked.

If customer data leaks

Under rule 7, once you become aware of a personal data breach you must tell each affected person “without delay”, through their user account or registered mode of communication, in plain language: what happened (nature, extent, timing), the likely consequences, what you are doing to reduce the risk, what they can do to protect themselves, and your contact details.

You must also tell the Board without delay. Within seventy-two hours of becoming aware (or a longer period the Board allows on written request) you give it updated detail: facts and causes, mitigation, findings on who caused it, remedial steps and a report on the notices sent. Write a one-page breach plan with names now.

A Mysuru dental clinic gets its list ready (hypothetical)

This is an illustration, not a client. A two-dentist clinic in Mysuru holds about 3,000 patient mobile numbers in its appointment software and uses a WhatsApp provider. Some numbers were given on a paper form that only mentioned appointments. Some are parents’ numbers for child patients. A few hundred came from a health camp sheet with no opt-in wording.

Before May 2027 it does this:

1. Sorts the list into the three piles above.
2. Rewrites the notice in English and Kannada, itemising the data and splitting appointment reminders from offers such as a whitening promotion.
3. Sends that notice to the patients who did consent earlier.
4. Stops marketing to the health camp numbers unless they opt in afresh.
5. Makes sure a STOP on WhatsApp also updates the appointment software.
6. Puts a named contact and the request route on its website.
7. Checks the WhatsApp provider’s contract for security terms.

For child patients, reminders and offers go to the parent’s number with the parent’s consent. The clinic takes advice on how the children’s rules and the healthcare exemption apply to it.

What the penalty figures really tell you

PIB lists the maximums: up to ₹250 crore for failing to maintain reasonable security safeguards; up to ₹200 crore each for not notifying the Board or affected individuals of a breach, and for violating obligations relating to children; up to ₹50 crore for any other violation by a Data Fiduciary.

Note “up to”. These are ceilings, not prices, and we have not read any enforcement action under the Act. What the list does show is where the Act puts its weight: security, breach reporting and children. Fix those first.

Section 17(3) lets the Central Government exempt some Data Fiduciaries, “including startups”, from named provisions (5, parts of 8 including 8(7), 10 and 11), but not from consent, security safeguards, breach duties or the children’s section. We did not look for any such notification. Do not assume one covers you unless your adviser can show it to you.

Help lining up your forms, lists and automations is part of our AI automation work.

Frequently asked questions

When does the DPDP Act start applying to my marketing? The duties that touch a marketing list (notice, consent, withdrawal, erasure, children’s data, breach reporting and penalties) come into force eighteen months after the Rules were published in November 2025. Law firm summaries put that at 13 May 2027. We did not read the commencement notification itself. TRAI’s SMS rules and WhatsApp’s own opt-in rules apply today regardless.

Do I have to ask my existing customers for consent again? Our reading: if someone really gave consent before the Act commenced, you must give them the notice as soon as it is reasonably practicable, and you may keep processing their data until they withdraw. The Act does not define that period in days. Numbers with no opt-in, such as bought lists or visiting card bowls, have no earlier consent to carry forward.

What must a DPDP consent notice contain? The notice must make sense on its own, in clear and plain language. It must itemise the personal data and describe each purpose, with the specific goods, services or uses. It must also give a link, and any other means, to withdraw consent as easily as it was given, exercise rights and complain to the Board. Offer it in English or an Eighth Schedule language.

Is my WhatsApp or CRM provider responsible for DPDP compliance? Not in the way you might hope. Under section 8(1), you remain responsible for processing done on your behalf by a Data Processor, irrespective of any agreement to the contrary. Our reading: your WhatsApp provider, email tool, CRM and freelancer are processors and you are the fiduciary. You may engage one only under a valid contract.

Are small businesses or startups exempt from the DPDP Act? Not automatically. Section 17(3) lets the Central Government notify certain Data Fiduciaries, including startups, so some provisions do not apply, such as the notice section and the erasure duty. It does not list consent, security safeguards, breach duties or children’s data. We did not look for any such notification, so do not assume one covers you.

How long do I have to respond when a customer asks to delete their data? Rule 14 says the grievance system must respond within a reasonable period not exceeding ninety days. Separately, erasure is due when consent is withdrawn or the purpose is no longer served, whichever is earlier, and withdrawal means you must stop processing within a reasonable time and have your processors do the same. Do not wait for day ninety.

---

Not sure how your opt-in notice and old contacts would hold up from May 2027? Get a free marketing audit and we will tell you plainly what to fix first.