DPDP Rules for Marketers: Consent Checklist

Short answer: The DPDP Rules change how Indian businesses can collect and use leads for marketing. From 13 May 2027, you will need a clear notice and specific consent before you add someone to your email, SMS or WhatsApp lists. People must also be able to withdraw that consent as easily as they gave it. The next step of the rollout, for consent managers, starts on 13 November 2026. So now is the time to fix your forms, lists and ad audiences, while you still have six months.

Key takeaways

The Digital Personal Data Protection (DPDP) Rules, 2025 were notified on 13 November 2025 and come into force in three phases.
Consent manager rules start on 13 November 2026. Most duties for businesses, including notice and consent, start on 13 May 2027.
Bought databases and “bulk” lists without proper consent become a serious risk.
Data of anyone under 18 needs verifiable parental consent, and targeted ads to children are not allowed.
Penalties under the DPDP Act go up to ₹250 crore.

DPDP Rules timeline: what starts when

Date	What comes into force	What it means for you
13 Nov 2025	Data Protection Board rules	The regulator is set up. Nothing changes for your marketing yet.
13 Nov 2026	Rule 4: consent managers	Registered consent managers can start operating. Watch for tools your CRM can connect to.
13 May 2027	Notice, consent, security, breach reporting, user rights, children’s data	Your forms, lists and campaigns must be compliant.

What the DPDP Rules change for marketing

Under the DPDP Act, you are a “data fiduciary” when you decide why and how personal data is used. In simple words, if you collect a name, phone number or email address from a lead form, the rules apply to you. Here is what changes in practice.

Clear notice: before collecting data, you must tell people in plain language what you collect and why. The notice must also explain how to withdraw consent.
Specific consent: consent must be free, specific, informed and given by a clear action. A pre-ticked box doesn’t count.
Easy withdrawal: stopping messages must be as easy as signing up. When someone opts out, every tool you use must stop messaging them.
Purpose limit: data collected for a quote cannot quietly be used for unrelated promotions without consent for that purpose.
Breach reporting: if lead data leaks, you must inform the affected people and report details to the Board within 72 hours.
Children: for users under 18, you need verifiable parental consent. Tracking, behavioural monitoring and targeted ads aimed at children are not allowed.

DPDP Rules checklist for marketers

List every place you collect data. Website forms, landing pages, Meta lead ads, Google lead forms, WhatsApp chats, events and walk-ins.
Add a short notice to each form. One or two lines saying what you collect, why, and a link to your privacy policy.
Separate consent for marketing. Add an unticked checkbox such as “Send me offers on WhatsApp and email”. Keep the enquiry itself possible without it.
Record consent. Save the date, source and wording the person agreed to in your CRM. You may need to prove it later.
Make opt-out one step. “Reply STOP” on WhatsApp and SMS, and a one-click unsubscribe in email. Then sync opt-outs to every tool.
Stop using bought lists. If you cannot show how a contact consented, don’t message them.
Check uploads to ad platforms. Customer lists you upload to Meta or Google for targeting should only include people who agreed to it.
Set retention rules. Decide how long you keep cold leads, and delete what you no longer need.
Review vendors. Your agency, CRM and messaging provider process data for you. Make sure your contracts cover security and deletion.
Plan for a breach. Write down who does what if lead data leaks, so you can act within 72 hours.

Example: fixing a typical lead form

Consider a coaching institute in Jaipur. Its current form asks for name, phone and course, and the small print says “By submitting, you agree to receive calls and messages.” After May 2027, this is risky, because consent for marketing is bundled with the enquiry.

A compliant version keeps the same fields but adds a short notice (“We use your details to reply to this enquiry. Privacy policy”) and a separate, unticked box (“Also send me course offers on WhatsApp”). As a result, the institute can still reply to every enquiry. Moreover, it builds a smaller but cleaner marketing list that people actually want to receive.

The good news for marketers

Consent-based lists usually perform better. People who opted in open more messages, block you less often and complain less. In addition, WhatsApp itself limits accounts that get many blocks and reports. Therefore, the DPDP Rules push you towards habits that already improve results. If you run WhatsApp campaigns, see our note on WhatsApp API pricing in 2026 too.

Need help updating your forms, CRM and tracking? Our CRM setup and tracking and analytics teams can set up consent capture properly.

Frequently asked questions

When do the DPDP Rules apply to marketing?

Most obligations for businesses, including notice, consent and data principal rights, apply from 13 May 2027. Consent manager rules start earlier, on 13 November 2026.

Can I still send WhatsApp and email promotions?

Yes, to people who have given clear consent for that purpose. You must also let them withdraw consent easily, and stop messaging them when they do.

Can I use a purchased database for marketing?

It is very risky. If you cannot show that each person consented to receive your messages, you should not use that data once the rules apply.

What is a consent manager?

A consent manager is a company registered with the Data Protection Board that lets people give, manage and withdraw consent through one platform. Their registration framework starts on 13 November 2026.

What is the penalty under the DPDP Act?

Penalties go up to ₹250 crore for failing to take reasonable security safeguards. Failing to report a breach or breaking the rules on children’s data can cost up to ₹200 crore.

This article is general information, not legal advice. Please check your situation with a lawyer. Sources: S.S. Rana & Co., on G.S.R. 846(E) dated 13 Nov 2025; Compliance Hub. Last updated 7 November 2026.