DPDP Act for Marketers: Consent, Notices and a Practical Checklist

India now has a general data protection law, and it applies to the customer data that marketing teams collect every day: phone numbers, email addresses, purchase history, location and behaviour. If you send campaigns, run a loyalty programme or keep a customer list, the Digital Personal Data Protection Act, 2023 affects how you ask for consent, how you store data and how you respond when someone wants to withdraw. This guide explains the Act in plain language from a marketer’s point of view, translates its ideas into a practical checklist and shows how to set up consent and records in your messaging tools. It is general information, not legal advice. Laws, rules and their dates change, so confirm the details with a qualified lawyer before you rely on them.

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is an Indian law that governs the processing of digital personal data. It sets out the rights of individuals, who are called Data Principals, and the duties of organisations that decide why and how personal data is processed, who are called Data Fiduciaries. It applies to personal data collected in digital form, or collected offline and later digitised, and it can reach organisations outside India that offer goods or services to people in India. Detailed rules under the Act and the dates on which its provisions come into force are set by the government, so check the current status when you plan your compliance work. It sits alongside other rules you may already follow, such as telecom regulations for SMS and the European GDPR if you serve customers in Europe.

Key terms for marketers

Most marketing activity relies on consent, so that is where we focus. The wording above is a simplification. Read the Act, or ask your lawyer, for the exact definitions and exceptions.

What the Act means for marketing

• Notice before consent. People should be told, in clear language, what data you collect, why, how to withdraw consent and how to complain. Notices should be available in English and in the languages of the Constitution where required.
• Specific consent. A bundled “I agree to everything” is weak. Ask separately for marketing messages and for each purpose that is not needed for the service.
• Purpose limitation. Use data for the purpose you stated. If you collected a phone number to deliver an order, using it for promotions needs separate permission.
• Data minimisation. Collect only what you need. Every extra field is a liability.
• Accuracy and storage limits. Keep data correct, and delete it when the purpose is served unless you must retain it by law.
• Security safeguards. Protect data against breaches, and be ready to report incidents as required.
• Easy withdrawal. Withdrawing consent should be as easy as giving it, and you should stop the related processing promptly.
• Rights of individuals. People can ask for information about their data, request correction and erasure, and nominate someone to exercise rights on their behalf.
• Children. Processing the data of children needs verifiable consent from a parent or guardian, and tracking or targeted advertising directed at children is restricted. Check current definitions and exemptions.

The Act also provides for a Data Protection Board and for financial penalties that can be very large for serious failures, such as not taking reasonable security safeguards or not notifying a breach. The details are in the Act, and you should review them with your advisor.

A practical compliance checklist for marketing teams

1. Map your data. List what personal data you hold, where it came from, where it is stored and which tools receive it.
2. Check the purpose of each field. If you cannot name a use, stop collecting it.
3. Rewrite your notices. Plain language, what and why, how to withdraw, how to complain.
4. Fix your consent capture. Separate, unticked boxes for marketing, per channel: email, SMS, WhatsApp, calls.
5. Record proof. Store who agreed, when, through which form, and the exact wording shown.
6. Make withdrawal easy. An unsubscribe link in every email, a stop keyword for SMS and WhatsApp and a preference page.
7. Review your vendors. Make sure your processors have contracts, security controls and clear data locations.
8. Set retention rules. Delete or anonymise inactive data after a defined period.
9. Prepare for requests. A simple process to find, correct and delete a person’s data within a set time.
10. Train the team. Marketing, sales and support should know the rules.

How to design consent that holds up

Our guides to email list building, WhatsApp broadcasts and SMS templates show how consent works on each channel, and the customer data platform guide covers how to keep it on one profile.

Setting this up in Flowfox

Flowfox stores consent as part of the contact profile, per channel, with the source and the time it was given. The segment builder can exclude contacts without consent from any audience, and a journey checks consent before each message, so a withdrawal takes effect immediately across email, SMS, WhatsApp and push. Unsubscribe and stop requests update the profile automatically. You can import consent records during a migration, so that history is not lost. For security and data handling, see the security page, the data processing agreement and the privacy policy. These explain what Flowfox does as a processor, and you remain responsible for the notices and consent you collect from your own customers.

{
  "contact_id": "c_8841",
  "consent": {
    "email":    { "status": "granted", "at": "2026-08-02T10:15:00Z", "source": "checkout_form_v3", "text_version": "mkt-email-2026-07" },
    "whatsapp": { "status": "granted", "at": "2026-08-02T10:15:00Z", "source": "checkout_form_v3", "text_version": "mkt-wa-2026-07" },
    "sms":      { "status": "withdrawn", "at": "2026-09-14T08:02:00Z", "source": "reply_stop" }
  }
}

A record like this answers the three questions an auditor or a customer is likely to ask: what did the person agree to, when and how. Keep the versions of your consent wording so that you can show what was displayed at the time.

Channel notes

Telecom rules, platform rules and data protection law apply together. Meeting one does not satisfy the others. A compliant programme starts from the strictest requirement and applies it everywhere.

Two further reading points. The article on information privacy gives the general concepts behind laws like this one, and the page on data protection officers explains a role that some organisations appoint to oversee compliance. Under the Indian Act, some organisations that process large volumes or sensitive categories of data may be classed as significant data fiduciaries with extra duties, such as appointing a data protection officer and carrying out audits. Check whether your scale and type of data put you in that group.

Common mistakes

• Treating a purchase as marketing consent. Order fulfilment and promotion are different purposes.
• Buying lists. You cannot prove consent for strangers. See bounce rate for what else goes wrong.
• Hiding the opt-out. Make it easy and honour it fast.
• Keeping everything forever. Retention limits are part of compliance.
• Leaving it to IT. Marketing decides purposes, so marketing owns the consent design.

Good consent practice is good marketing. People who chose to hear from you are the ones who answer.

This article is general information and not legal advice. For related reading, see customer segmentation, marketing personalization and the blog.