India's DPDP Act: The Marketing Checklist Before May 2027

Every Indian business that collects a name, phone number, or email address is collecting personal data. Under the Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules notified in November 2025, how you collect, use, and keep that data now comes with clear duties and serious penalties.

The clock is running. According to the timeline the government stated in Parliament in August 2026, consent manager provisions begin on 13 November 2026, and the main obligations for businesses apply from 13 May 2027 (India Data Law). Penalties under the Act go up to ₹250 crore for failing to protect data, up to ₹200 crore for failing to report a breach, and up to ₹50 crore for other violations (PIB).

Seven months sounds like a long time. For a small business with leads in three spreadsheets, an old email list, a CRM, and a WhatsApp group, it is not.

This article explains the marketing side of DPDP in plain terms. It is not legal advice. Speak to a lawyer for decisions specific to your business.

What the law asks for, in marketing terms

A clear notice when you collect data. Each business must give a separate consent notice that is clear and easy to understand, and says the specific purpose for which the data is collected (PIB). "We may use your data to improve our services" will not do.

Consent you can prove. If you rely on consent, you need a record of when, how, and for what someone agreed. A ticked box with no log is weak evidence.

Easy withdrawal. People must be able to withdraw consent at any time, and it should be as easy as giving it.

Answering requests. People can ask to access, correct, update, or erase their data, and businesses must respond within a maximum of ninety days.

Notice in Indian languages on request. From May 2027, a notice must be available in any of the 22 languages of the Eighth Schedule if the person asks (India Data Law).

Protecting the data and reporting breaches. You need reasonable security safeguards, and if there is a breach, you must tell the people affected without delay.

Where small businesses are most exposed

• Old lists. Contacts bought, scraped, or collected years ago, with no record of consent.
• Forms with no purpose statement. Website forms, landing pages, and event sign-ups that collect data with no clear notice.
• Data scattered across tools. Leads in Excel, Google Sheets, the CRM, the email tool, and personal phones. You cannot honour an erasure request for data you cannot find.
• WhatsApp broadcasts to people who never agreed to marketing messages.
• Agencies and freelancers holding copies of your customer data with no contract covering it.

A checklist for the next seven months

By the end of November

1. Map where personal data lives. List every tool, sheet, and inbox that holds customer or lead data, and who has access.
2. Rewrite your form notices. Each form should say what you collect, why, and how to withdraw. Keep the language plain.
3. Start logging consent. Make sure your CRM or email tool records the date, source, and purpose for every new contact.

By February

4. Clean up old lists. For contacts without a clear consent record, run a re-permission campaign or stop marketing to them.
5. Separate marketing consent from service messages. Someone who gave you a phone number for delivery updates has not agreed to promotions.
6. Add an easy unsubscribe or opt-out to every channel: email, SMS, and WhatsApp.

By May 2027

7. Set up a request process. One inbox or form for access, correction, and erasure requests, with an owner and a 90-day deadline.
8. Sign data processing terms with every agency, freelancer, and software vendor that handles your customer data.
9. Write a simple breach plan. Who decides, who tells customers, and what you say.
10. Train the team. Five rules on one page, covering what not to download, share, or copy.

The upside

Cleaning up for DPDP is not only about avoiding penalties. A smaller list of people who actually agreed to hear from you gets better open rates, fewer spam complaints, and more replies. A CRM with clear consent and sources is also the foundation every AI tool now needs. Our free AI readiness audit checks the same foundations from a different angle.

If you want help, our marketing operations work maps your data, tools, and owners, and our CRM implementation service sets up consent fields, opt-outs, and lead sources so they are recorded from the start.