DPDP Act and Marketing: A Plain Guide for Indian Businesses
The DPDP Act, India's Digital Personal Data Protection Act, 2023, changes how businesses can collect and use customer details for marketing. In short, if you gather names, phone numbers, emails or online identifiers to send offers, build remarketing audiences or upload customer lists to ad platforms, you will need a clear notice, valid consent for that purpose, an easy way for people to withdraw, and reasonable security. The Rules that put the Act into practice were notified in November 2025, and the main duties apply from May 2027. This guide explains what DPDP Act marketing compliance means for a small or mid-size business, with a checklist you can start on now. If you run ads that reuse visitor data, our Google Ads remarketing in Coimbatore page shows how we handle it.
This article is general information, not legal advice. For decisions specific to your business, speak to a qualified lawyer.
What the DPDP Act is and when it applies
The Act covers digital personal data: information about an identifiable person that is collected digitally, or collected on paper and later digitised. It applies to processing inside India, and to processing outside India when it is connected with offering goods or services to people in India.
The Act uses two terms you will see often:
- Data Principal: the person the data is about, such as your customer or website visitor.
- Data Fiduciary: the business that decides why and how the data is used. If you run a shop that collects customer numbers for offers, you are a Data Fiduciary.
Agencies, software tools and platforms that handle data on your behalf are Data Processors. You remain responsible for what they do with your customers' data.
Key dates: what is in force and what comes next
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and set out a phased start:
| When | What starts |
|---|---|
| November 2025 (on notification) | Provisions setting up the Data Protection Board of India and its procedures |
| 13 November 2026 | Rules on registration and duties of Consent Managers |
| 13 May 2027 | Core duties: notice, consent, security safeguards, breach intimation, rights of individuals, and related penalties |
That gives most businesses a window to prepare. Building good consent habits now is far easier than cleaning up years of lists later.
What counts as personal data in marketing
More than many owners expect. Common examples:
- Names, phone numbers and email addresses from enquiry forms.
- WhatsApp numbers collected at the billing counter.
- Customer lists exported from your billing software.
- Lead details from Meta lead forms or Google lead form assets.
- Cookie IDs and device identifiers used by analytics and ad pixels, where they can be linked to a person.
- Photos of customers used in social media posts.
Consent and notice: what changes for forms and lists
Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. Two practical consequences for marketing:
Separate the purposes. Taking a phone number to deliver an order is not the same as permission to send promotional messages. Ask for marketing consent separately, with an unticked box or a clear opt-in step.
Give a proper notice. The Rules expect a notice in clear, plain language that lists the personal data being collected, the specific purpose, and how the person can withdraw consent, exercise their rights and complain to the Board. Withdrawing should be as easy as giving consent.
The Act also lets people request access to, correction of and erasure of their data, and to nominate someone to act for them. Plan who in your business will handle such requests.
Children's data
For anyone under 18, you need verifiable consent from a parent or guardian, and the Act prohibits tracking, behavioural monitoring and targeted advertising directed at children. Schools, coaching centres, toy shops and kids' clothing brands should review their ad targeting and lead forms carefully.
Remarketing, pixels and customer lists
Remarketing reaches people who visited your site or interacted with your business before. It relies on cookies, pixels or uploaded customer details, so it falls within data protection thinking.
- Website tags and pixels: use a consent banner that actually controls whether ad tags fire, rather than a decorative one. Google's Consent Mode can pass those choices to Google tags.
- Customer list uploads: platforms such as Google Customer Match and Meta custom audiences hash data before matching, but you still need a lawful basis for using those contacts for advertising. Upload only people who agreed to marketing.
- Retention: remove people from lists once the purpose is served or they withdraw.
If you also run Meta campaigns, the same principles apply to Meta retargeting ads.
Example (illustrative, not a client result): A furniture showroom in Coimbatore has 4,000 phone numbers from years of bills, with no record of marketing consent. Instead of uploading all of them to ad platforms, it starts collecting fresh opt-ins at the counter and on its website, sends existing customers a single message inviting them to join its offers list, and uses only those who opt in for remarketing audiences.
WhatsApp, SMS and email marketing
The DPDP Act sits alongside other rules you may already follow:
- SMS and calls: TRAI's commercial communication rules, including sender registration and Do Not Disturb preferences, still apply.
- WhatsApp Business: Meta's own policies require opt-in before you send marketing messages, and allow users to block or report you.
- Email: include a working unsubscribe link and honour it promptly.
Treat DPDP consent as the base layer and these channel rules as extra requirements on top.
A simple compliance checklist
- Map your data: list every place you collect customer details, from forms and counters to ad lead forms.
- Write a plain notice for each collection point, linked from forms and your privacy policy.
- Add separate marketing opt-ins and record when and how each person agreed.
- Make withdrawal easy: an unsubscribe link, a reply keyword or a simple form.
- Review ad audiences and remove contacts without marketing consent.
- Check your vendors: agencies, CRMs and form tools should have written terms on data handling.
- Secure the data: limit who can export lists, use strong passwords and two-step login.
- Set retention periods and delete data you no longer need.
- Name a contact for privacy questions and requests.
Frequently asked questions
Does the DPDP Act apply to a small shop or startup?
Yes. The Act does not exempt businesses by size. The Rules allow some flexibility for certain classes of businesses, but a small shop that collects customer numbers for offers should still plan for notice, consent and security.
What are the penalties under the DPDP Act?
The Act sets financial penalties by type of breach, with the highest, for failing to take reasonable security safeguards, going up to ₹250 crore. The Data Protection Board decides the amount based on factors such as severity and duration.
Can I keep using leads that came from Meta or Google lead forms?
You can use them for the purpose shown on the form, such as replying to the enquiry. For ongoing promotions, make sure the form's notice and consent covered marketing, or ask for consent when you first contact the lead.
Is a cookie banner enough on its own?
Only if it genuinely controls what tags run and records choices. A banner that loads every tracking script before the visitor chooses does not achieve much. Pair it with a clear privacy notice and settings people can change later.
Build marketing that respects your customers
If you want remarketing that works within consent rules, visit our Google Ads remarketing in Coimbatore page, call +91 93429 52626 or email info@xtrodinry.com.
About the author: Karthik N, Founder of Xtrodinry in Coimbatore and SEO strategist. Connect on LinkedIn · About Xtrodinry
Xtrodinry · 4/175/A, Vijayalakshmi Nagar, Panappatti, Coimbatore, Tamil Nadu 641201 · +91 93429 52626 · info@xtrodinry.com
