On 13 November 2026, India’s Consent Manager rules switch on, and a lot of marketing teams will assume their DPDP deadline has arrived. It hasn’t. The duties that touch every SMS, WhatsApp message and email you send start on 13 May 2027. That gives you about six months, which sounds generous until you count how many systems hold a customer phone number.
This guide to the DPDP Act for marketers is written for the people who run campaigns, not the people who draft privacy policies. It explains what the law asks of you in plain language, and how consent works on each channel. It also covers what a provable consent record looks like and what to do with the old database nobody wants to talk about. It ends with a month-by-month plan you can start this week.
Last reviewed: 10 November 2026. This guide explains the law for planning purposes. It is not legal advice, so confirm decisions about your own data with a qualified lawyer.
Why the DPDP Act Matters for Marketers
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first full data protection law. Its Rules were notified in November 2025 with an 18-month runway for most obligations. Marketing sits close to the centre of it, for one simple reason: almost every campaign uses personal data, and the Act makes consent the default basis for using it.
The penalty ceilings make the point. The Act’s Schedule allows up to ₹250 crore for failing to protect personal data, and up to ₹50 crore for “any other” breach, which is where most consent failures would land, per the penalty schedule.
These are ceilings, not fixed fines. The Board weighs factors like how serious the breach was, whether it was repeated and what the business did to fix it.
The law is not the only pressure. Customers have started asking brands where they got their number, and WhatsApp and telecom operators already punish senders who get blocked or reported. Good consent practice protects your deliverability long before a regulator calls.
Most companies are behind
If your team feels unprepared, it is not alone. EY India surveyed nearly 150 professionals for its report India’s digital privacy crossroads, published in February 2026. The findings are hard to ignore:
- About 80% had not updated or drafted DPDP-aligned privacy policies
- Over 83% had not started end-to-end implementation
- Nearly 77% said they could not adopt privacy technology, such as consent management, in legacy systems
- About 71% said they struggled to interpret the Act and Rules
- Only 48% had completed a basic gap assessment
Marketers should pay most attention to the consent technology figure. Consent lives in CRMs, campaign tools, messaging vendors and spreadsheets. Fixing it is mostly a marketing operations job, not a legal one.
The DPDP Timeline: Which Dates Actually Matter
The DPDP framework is coming into force in three phases. The 2026 and 2027 dates are calculated from the Rules’ phased-commencement wording rather than stated as calendar dates. MeitY’s Secretary has been reported naming 13 May 2027 for the main duties, so treat the table below as the working timeline.
| Date | What starts | What it means for marketers |
| 13 November 2025 | Definitions, the Data Protection Board, procedural rules | The Board exists. No new campaign duties yet. |
| 13 November 2026 | Consent Manager registration (Rule 4, Section 6(9)) | Consent Managers can register. Your own duties do not change on this date. |
| 13 May 2027 | Notice, consent, security, breach reporting, data principal rights, penalties | Every consent-based message you send must meet the Act’s standard. |
Two recent developments are worth knowing about. In October 2026, MeitY issued a Removal of Difficulties Order that tidied the wording of the children’s data and data audit provisions. It does not change marketing consent. Petitions challenging parts of the Act are pending in the Supreme Court, but no stay has been granted, so the framework still applies as notified.
What Counts as Valid Consent Under DPDP
The DPDP Act sets a high bar. Under Section 6(1), consent must be “free, specific, informed, unconditional and unambiguous,” given through a clear affirmative action. It must also be limited to the data needed for the purpose you named. Here is what each word means in a campaign setting:
- Free: Buying a product cannot depend on agreeing to marketing. “Accept offers to continue checkout” fails.
- Specific: Consent covers a stated purpose. Agreeing to order updates is not agreeing to promotions.
- Informed: The person saw a notice explaining what you will do with their data before they agreed.
- Unconditional: No hidden strings, such as consent that also covers sharing data with partners.
- Unambiguous, with a clear affirmative action: They ticked an empty box, tapped a button or replied YES. Silence, pre-ticked boxes and “by continuing you agree” banners do not count.
There is no “legitimate interest” shortcut
Marketers who have worked with Europe’s GDPR often expect a legitimate-interest route for marketing. The DPDP Act has no such route. Section 7 lists a closed set of situations where consent is not needed, such as legal obligations and medical emergencies. Direct marketing is not on that list.
Section 7(a) does allow processing when someone voluntarily gives you data for a specified purpose and has not objected. That covers sending an invoice to the email address a customer gave you for the invoice. It does not cover adding that email to your newsletter list.
The notice comes first
Section 5 requires a notice with, or before, every consent request. It must explain what data you collect and why, how to withdraw consent and how to complain to the Board. People must be able to read it in English or in any language listed in the Eighth Schedule of the Constitution. If your customers mostly speak Marathi or Tamil, an English-only notice is a weak foundation.
You carry the burden of proof
This is the clause that gives this guide its title. Under Section 6(10), when consent is the basis for processing and it is questioned, the business must prove that a notice was given and valid consent was obtained. If you cannot produce the record, you are treated as if you never had consent. “Our vendor said the list was opted in” is not proof.
How to Collect Consent on Each Channel
This is where DPDP marketing consent gets practical. Each channel already follows someone else’s rules, whether TRAI’s, Meta’s or Gmail’s. DPDP sits on top of them rather than replacing them. A message has to satisfy all of them.
SMS: DPDP plus TRAI’s DLT rules
Commercial SMS in India already runs on TRAI’s Telecom Commercial Communications Customer Preference Regulations (TCCCPR) and the DLT platform. You register your business, your sender headers and your message templates before anything goes out. TRAI’s February 2025 amendment tightened this further. According to Securiti’s summary of that amendment:
- Every promotional message must carry an opt-out option
- After someone opts out, you must wait 90 days before asking for consent again
- Headers carry a suffix showing whether a message is promotional (P), service (S) or transactional (T)
- Spammer action now triggers at 5 complaints in 10 days, down from 10 complaints in 7 days
TRAI has also been piloting digital consent capture with banks. It uses OTP-verified consent and tamper-proof revocation records. That is a strong hint of where proof standards are heading for every sector.
What DPDP adds: TRAI governs whether a telecom network can carry your message. DPDP governs whether you were allowed to use the person’s number in the first place. A DLT-registered consent template does not, on its own, prove DPDP-grade consent for a specific marketing purpose. Keep your own record of the notice shown and the consent captured.
WhatsApp: DPDP plus Meta’s opt-in policy
Meta requires businesses to collect opt-in before messaging people. The opt-in must clearly say that the person is agreeing to receive messages, and it must name your business. You can collect it through your website, an SMS, an IVR flow or a signed paper form. Meta recommends separate opt-ins for different message types, and businesses whose quality stays low get rate-limited.
What DPDP adds: Meta lets the opt-in be general, as long as you follow local law. DPDP’s “specific” requirement means local law now asks for more. Ask separately for promotional WhatsApp messages, and keep that separate from order updates.
This also connects to cost. Marketing templates are the most expensive WhatsApp category, so sending them only to people with clean consent saves money as well as risk. Our guide to WhatsApp Business API pricing in India breaks down those per-message costs.
Email: DPDP becomes the main rule
India has no dedicated email anti-spam statute along the lines of the US CAN-SPAM Act. That makes the DPDP Act the main legal standard for marketing email to people in India from May 2027. Your consent, notice and withdrawal duties apply exactly as they do on other channels.
Mailbox providers add their own technical rules. Google’s email sender guidelines require bulk senders to offer one-click unsubscribe and to process unsubscribes within two days. Meeting that standard also helps you meet DPDP’s “as easy to withdraw as to give” test.
IVR and voice calls
Promotional calls fall under TRAI’s rules, which use the 140 number series for promotional calls and 1600 for service and transactional calls. TRAI’s 2025 amendment also requires telemarketers to disclose when they use auto-dialers or robocalls.
What DPDP adds: If you collect consent by voice, record it. Keep the recording or IVR keypress log with the date, the time, the number and the exact script the person heard. A recorded “yes” with no record of the question asked is weak evidence.
How to Store Consent: The Anatomy of a Provable Record
A provable record is the heart of DPDP marketing consent. It answers one question months later: who agreed to what, when, how and after seeing which notice? If any of those five answers is missing, the record is weak. Every consent you capture should be stored with these fields:
- Who: A customer ID plus the phone number or email address the consent applies to
- What: The specific purpose, such as “promotional WhatsApp messages from [brand]”
- When: A timestamp, ideally with time zone
- How: The channel and method, such as a web form, WhatsApp button, missed call, IVR keypress or paper form
- Which notice: The version ID of the notice text shown, plus the language
- Proof artefact: A form submission ID, OTP log, message ID, call recording or scanned form
- Status history: Every later change, including withdrawals, with timestamps
Keep one consent ledger, not five
Most Indian brands hold consent in several places at once: the CRM, the email platform, the WhatsApp provider’s dashboard and an SMS vendor’s portal. When those disagree, someone eventually messages a person who opted out. Pick one system as the source of truth for consent, and have every channel read from it before sending.
This is the same discipline good first-party data programs already follow. Our guide to first-party data strategy covers how to build that single customer view.
How long to keep records
The DPDP Rules require businesses to keep personal data, related traffic data and processing logs for at least one year from the date of processing. Sector regulators can require longer, and RBI, SEBI and IRDAI rules often do. Keep consent proof for as long as you rely on that consent, plus the period in which someone could still complain about it.
Large platforms carry an extra duty. E-commerce and social media platforms with at least 2 crore registered users must erase a user’s data after three years of inactivity, and the same applies to online gaming platforms with at least 50 lakh users. They must warn the user at least 48 hours beforehand.
How to Handle Withdrawal and Opt-Outs
Section 6(4) says withdrawing consent must be as easy as giving it. If someone opted in with one tap on WhatsApp, they must be able to opt out with one message. Under Section 6(6), once consent is withdrawn you must stop processing within a reasonable time. You must also make your vendors stop.
In practice, a working withdrawal system looks like this:
- Recognise common opt-out replies automatically, such as STOP, UNSUBSCRIBE, “band karo” and “no more messages,” including regional-language versions
- Treat an opt-out on one channel as a signal to review consent on every channel, and suppress any channel where that purpose was withdrawn
- Push the suppression to every vendor the same day, and get confirmation back
- Send one short confirmation message and then stop
- Log the withdrawal in the consent ledger with its source and timestamp
Withdrawal does not make your earlier messages unlawful, per Section 6(5). It only stops what comes next.
Do Marketers Need a Consent Manager?
A Consent Manager is a registered company that lets people give, manage, review and withdraw consent across many businesses from one interoperable platform. It is not a tool you buy for your own website.
The bar to become one is high. The First Schedule of the Rules requires an India-incorporated company with a net worth of at least ₹2 crore. It must keep consent records for at least seven years and avoid conflicts of interest with the businesses it serves. Registration opens on 13 November 2026.
For most marketing teams the honest answer is this: you do not need to become a Consent Manager, and you may never be required to use one. You should expect some customers to manage their consents through one, though. Make sure your systems can accept consent and withdrawal signals from outside your own forms. Ask your consent or CRM vendor how they plan to integrate.
Vendor Contracts: Your Processors Are Your Problem
Your SMS aggregator, WhatsApp provider, email platform and call centre are Data Processors under the Act. You stay responsible for what they do with your customers’ data. Before May 2027, check that every marketing vendor contract covers:
- Processing only on your instructions and only for your stated purposes
- Honouring withdrawals and suppressions within an agreed time, with confirmation back to you
- Reasonable security safeguards, and breach reporting to you fast enough for you to meet your own deadlines
- Access to opt-in and delivery logs when you need to prove consent
- Deleting or returning data when the contract ends
Breach timelines are tight. Under Rule 7, you must inform affected people and the Board without delay, and file a detailed report with the Board within 72 hours of becoming aware. A vendor that tells you about a breach a week later puts you out of compliance.
Children’s data needs extra care
If your audience includes anyone under 18, Section 9 requires verifiable consent from a parent or lawful guardian. It also bans tracking, behavioural monitoring and targeted advertising directed at children. That has big implications for edtech, gaming, kids’ retail and youth brands. Breaching children’s data obligations carries a penalty ceiling of ₹200 crore.
Real-World Scenarios and How to Fix Them
The scenarios below are illustrative composites built from common situations in Indian marketing teams. They are not specific companies. Each shows where consent breaks and what fixes it.
Editor’s note for Amit: replace or add to one of these with an anonymised example from your own campaign operations before publishing. First-hand detail is what readers and search engines trust most.
Scenario 1: The legacy database
Situation: A lender holds 12 lakh customer numbers collected from 2018 onwards for loan servicing. The growth team wants to cross-sell credit cards to the whole list in 2027.
The problem: The numbers were collected to service loans, not to sell new products. Section 7(a) covers the original purpose, not a new one. Few records show a marketing consent with a timestamp.
The fix:
- Keep using the data for loan servicing, which is the purpose it was collected for
- Under Section 5(2), send a notice to people whose consent predates the Act as soon as reasonably practicable
- Run a re-permission campaign on your cheapest compliant channel, asking customers to opt in to offers
- Market only to customers who say yes, and log each answer as a fresh consent record
Expect a fraction of the list to opt back in. That smaller list will usually engage far better than the full one.
Scenario 2: The pre-ticked checkbox
Situation: A D2C brand’s checkout has a pre-ticked box saying “Send me offers on WhatsApp and SMS.”
The problem: A pre-ticked box is not a clear affirmative action. Combining two channels in one box also weakens the “specific” test.
The fix:
- Make the boxes unticked by default
- Offer separate choices for WhatsApp offers, SMS offers and email newsletters
- Link a short notice right next to the boxes, in the shopper’s language
- Store the checkout ID, timestamp and notice version with each consent
Scenario 3: The purchased lead list
Situation: A real-estate developer buys 50,000 “opted-in” leads from a portal for a project launch.
The problem: The seller’s opt-in was given to the seller, for the seller’s purposes. It almost never names your brand or your purpose, and you will carry the burden of proof under Section 6(10).
The fix:
- Do not message bought lists unless the seller can show consent that names your business and purpose
- Move spend to channels where you capture your own consent, such as Click-to-WhatsApp ads, lead forms and site visits
- Write consent warranties and audit rights into any lead-generation contract
Scenario 4: STOP on one channel, offers on another
Situation: A customer replies STOP to a WhatsApp promotion. Two days later the same brand sends them an SMS offer through a different vendor.
The problem: The opt-out sat in the WhatsApp provider’s dashboard and never reached the SMS vendor. For the customer, withdrawal was not as easy as consent.
The fix:
- Route every opt-out into the central consent ledger in near real time
- Make every channel check the ledger before each send
- Run a weekly reconciliation between the ledger and each vendor’s suppression list
Scenario 5: Support chats turned into a marketing list
Situation: A retailer exports 2 lakh numbers of people who contacted support on WhatsApp and uploads them to a festive campaign.
The problem: Those people shared their numbers to fix a problem, not to receive promotions. Using them for marketing is a new purpose that needs consent.
The fix:
- Keep support data in a separate segment that campaign tools cannot select
- At the end of a resolved support chat, offer a clear opt-in button for offers
- Market only to those who tap it
Conversational journeys work best when consent is built into the flow, as we discuss in our piece on real-time intent mapping and mobile AI chatbots.
Scenario 6: The vendor that can’t show proof
Situation: A customer complains about receiving promotional messages. The brand asks its messaging vendor for the opt-in record, and the vendor has delivery logs but no consent logs.
The problem: Delivery proves you sent a message. It does not prove you were allowed to.
The fix:
- Capture consent in your own systems, not only in the vendor’s
- Require vendors to retain opt-in events, message IDs and timestamps, and to hand them over on request
- Test this before you need it: pick ten random customers each quarter and try to produce full consent proof for each
Scenario 7: An edtech brand targeting students
Situation: An edtech company runs retargeting ads and WhatsApp offers to students aged 15 to 17 who downloaded a free exam guide.
The problem: Section 9 requires verifiable parental consent for anyone under 18. It also bans targeted advertising directed at children and behavioural monitoring of them.
The fix:
- Ask for age at sign-up, and route under-18 users to a parental consent flow
- Stop retargeting and behavioural segmentation for anyone flagged as under 18
- Market to parents directly, with their own consent
Scenario 8: Paper forms at an event
Situation: A brand collects 3,000 sign-ups on paper at an expo and plans to load them into WhatsApp campaigns.
The problem: Paper consent is valid if it meets the standard, but it is easy to lose and hard to link to a person later.
The fix:
- Use a QR code to a digital form, or a tablet form, instead of paper
- If you must use paper, print the notice text and version number on the form, scan every page and store the scan ID in the consent ledger
- Send a WhatsApp or SMS confirmation that repeats what they signed up for, with an easy opt-out
How Good Consent Improves Marketing Performance
Consent is also a performance lever, not only a legal one. A consented audience is smaller, but it is also more engaged and cheaper to reach. Every message sent to someone who never wanted it raises block and complaint rates, which drags down your WhatsApp quality rating and SMS sender reputation.
Clean consent data also makes measurement more honest. When you know exactly who opted in and through which source, you can attribute revenue to the campaigns that earned the permission in the first place. That is especially useful for tracing chat-driven sales, which our dark funnel guide shows are easy to miss.
The same applies to AI-driven personalisation. Models trained only on properly consented data carry less legal risk and fewer ethical surprises. We cover that side in ethical AI and data privacy in marketing and in our guide to predictive personalization.
Your Six-Month DPDP Act Readiness Plan for Marketers
This plan runs from November 2026 to May 2027. Adjust the pace to your size, but keep the order.
November 2026: Map your data
- List every place customer contact data lives: CRM, CDP, email tool, WhatsApp provider, SMS and IVR vendors, spreadsheets and agencies
- Record the source and purpose of each dataset
- Name an owner for consent within marketing
December 2026: Audit consent quality
- For each dataset, mark whether you hold provable consent, a legitimate use or nothing
- Pull ten random records per source and try to produce full consent proof
- Flag purchased lists and support-derived lists for exclusion
January 2027: Fix capture points
- Rewrite consent notices in plain language and the main languages your customers use
- Replace pre-ticked and bundled consents with separate, unticked choices per channel and purpose
- Version-control every notice
February 2027: Build the consent ledger
- Choose the system of record for consent
- Connect every sending tool so it checks consent before each send
- Set up automated opt-out capture across channels, including regional keywords
March 2027: Fix vendors and legacy data
- Update vendor contracts for suppression timelines, log access, security and breach reporting
- Send Section 5(2) notices to existing customers, and run re-permission campaigns where you want to keep marketing to them
April 2027: Test and train
- Run a mock complaint: can you produce proof of consent within a day?
- Run a mock withdrawal: does an opt-out reach every vendor within your target time?
- Train campaign, CRM and agency teams on the new rules
May 2027: Go live
- Switch campaign targeting to consented segments only from 13 May 2027
- Start a quarterly consent audit and add the results to your marketing dashboard
Free download: DPDP Consent Readiness Checklist for Marketers (PDF)
Frequently Asked Questions
Does the DPDP Act for marketers apply to B2B campaigns?
Yes, when you process personal data of individuals. A work email or mobile number belongs to a person, so B2B email and WhatsApp outreach to named contacts is covered. Our guide to B2B lead nurturing covers how to build those journeys around permission.
Can I keep messaging existing customers after May 2027?
You can keep processing data for purposes the customer consented to before the Act commenced, as long as you give them a Section 5(2) notice as soon as reasonably practicable. For marketing that was never clearly consented to, run a re-permission campaign and keep only those who opt in.
Is a DLT-registered consent template enough for DPDP?
Not on its own. DLT registration satisfies TRAI’s telecom rules. DPDP requires you to prove that a proper notice was given and that consent was free, specific and affirmative for your purpose. Keep your own consent records alongside DLT.
Do I need a separate consent for each channel?
The Act requires consent to be specific to a purpose. Separate choices per channel and per message type are the safest way to show that, and Meta also recommends category-specific WhatsApp opt-ins.
What is the penalty for sending marketing messages without consent?
The DPDP Act sets ceilings, not fixed fines. Consent failures generally fall under the “any other violation” entry, with a maximum of ₹50 crore. Security failures and breach-notification failures carry higher ceilings. The Board decides the actual amount based on factors including gravity, repetition and mitigation.
Do I need to register as a Consent Manager?
Almost certainly not. Consent Managers are specialised platforms that must be India-incorporated, have at least ₹2 crore net worth and register with the Board. Marketers need to manage their own consent well and be ready to accept signals from Consent Managers.
Does the DPDP Act apply to cookies and ad tracking?
Yes, wherever tracking processes personal data, such as identifiers linked to a person. Consent rules apply, and tracking or targeted advertising directed at children is prohibited outright.
How quickly must I act on an opt-out?
The Act says you must stop within a reasonable time and make your processors stop. TRAI rules and Google’s sender guidelines already set faster expectations for SMS and email. Aim to suppress across all channels within 24 hours.
Sources
- Press Information Bureau: DPDP Rules, 2025 notified
- DPDP Rules: Is the DPDP Act in force? Status, dates and deadlines
- DPDP Act India: Section 5, Section 6, Section 7, Section 9
- dComply: DPDP penalty schedule
- DPDPA: Rule 7, breach intimation and First Schedule, Consent Manager conditions
- TCSA: DPDP Rules 2025 implementation roadmap
- India Briefing: DPDP Removal of Difficulties Order 2026
- MediaBrief: EY India DPDP readiness findings
- TRAI: TCCCPR amendment regulation, February 2025
- Securiti: Key takeaways from TRAI’s latest amendment
- MediaNama: TRAI’s digital consent pilot
- Meta for Developers: Get opt-in for WhatsApp
- Google Workspace Admin Help: Email sender guidelines
Disclaimer: This guide reflects the DPDP Act, 2023, the DPDP Rules, 2025 and related rules as understood on 10 November 2026. It is general information, not legal advice.
