DPDP Act 2023 for Digital Marketers in India: The 2026 Compliance Checklist (CRM, Ads, WhatsApp, Cookies)

If you do digital marketing in India, the Digital Personal Data Protection (DPDP) Act 2023 is one of the most important regulations you may not have read closely yet. With its Rules notified in November 2025 and its core obligations applying from May 2027, many of the marketing tactics that were routine a few years ago (Custom Audiences, lookalike segments, third-party cookie tracking, scraped lead lists) sit in an increasingly risky position. This guide helps you get ahead of that shift.

This article is general information for marketers, not legal advice. The DPDP Rules were notified in November 2025 and phase in through May 2027; verify specifics against the official DPDP Act 2023 and its notified Rules, and consult qualified legal counsel before making compliance decisions.

This is the practitioner's guide to DPDP compliance for digital marketing in India. Not the legal-team version, which is too abstract to operationalise. The version you can hand to your performance marketer, your CRM admin, and your developer, and get them to make the right decisions.

It covers what each obligation means for each marketing channel, a recommended cookie banner spec, the CRM architecture that's defensible under audit, and a 14-point self-audit checklist your team can run this week.

DPDP Act 2023: What It Means and Where Enforcement Is Headed

The DPDP Act was passed in August 2023. Its operational detail comes through the DPDP Rules and the Data Protection Board of India. The Rules were notified in November 2025 with phased dates: Consent Manager registration rules take effect in November 2026, and the core obligations (notice, consent, security safeguards, breach intimation, children's data, SDF duties and data-principal rights), together with the Board's penalty powers, apply from May 2027. Treat the directions below as preparation for that date rather than a record of past enforcement.

The core obligations to plan around:

1. Consent-based processing: any personal data processing for marketing requires free, specific, informed, unconditional, and unambiguous consent. Pre-ticked checkboxes will not meet this standard once it applies in May 2027.
2. Notice obligations: every consent collection point must show a privacy notice in plain English (or any of the scheduled languages in India). The notice must itemise the personal data and the specific purposes, and explain how to withdraw consent, exercise rights and complain to the Data Protection Board; the consent request must also give contact details of a person able to respond.
3. Breach notification: a personal data breach must be notified to the Data Protection Board and to affected users in the manner and within the timelines prescribed by the DPDP Rules.

Two areas warrant especially early attention:

1. Children's data protections: stricter rules for users under 18 require verifiable parental consent, and a ban on tracking, behavioural monitoring and targeted advertising directed at children (s.9(3)). Edtech and gaming founders should be working on this now.
2. Significant Data Fiduciary (SDF) status: if you process large volumes or sensitive data, you may be designated an SDF, triggering additional obligations such as a Data Protection Officer, Data Protection Impact Assessments (DPIAs), and independent audits.

Once the core obligations and the Board's penalty powers apply in May 2027, the Act's Schedule provides for penalties of up to ₹250 crore. The practical takeaway for marketers: build consent, notice, and deletion capabilities now, because retrofitting them under scrutiny is far more expensive than designing them in.

For the official text, see the Ministry of Electronics and IT publications and the PRS India DPDP analysis.

The 8 Obligations Every Indian Digital Marketer Must Understand

1. Lawful Purpose + Free, Specific, Informed, Unconditional, Unambiguous Consent

Marketing data processing under DPDP requires "consent" of a specific quality. Each of those five adjectives matters:

• Free: consent cannot be a condition for receiving a service unless the data is strictly necessary. You cannot say "consent to marketing or you can't use the app."
• Specific: one consent per purpose. Bundled consent (accept everything to proceed) is high-risk: consent only extends to data necessary for the specified purpose (s.6(1)).
• Informed: a notice must accompany or precede the consent request.
• Unconditional: cannot be linked to unrelated terms.
• Unambiguous: must be an active opt-in. Pre-ticked checkboxes and "by using this site you consent" banners are out.

Operational impact: every lead form, every WhatsApp opt-in flow, every email subscription, every loyalty program signup needs to be redesigned around granular, active consent.

2. Notice in Plain English (or Regional Language)

The notice that precedes consent should be in English or in India's scheduled regional languages (Hindi, Bengali, Marathi, Tamil, Telugu, Kannada, Malayalam, Gujarati, Punjabi, and others). For Bharat-tier users, an English-only notice is functionally weak because the user may not understand it.

The notice should specify:

• What personal data is collected
• The purpose(s) of processing
• How long data will be retained (good practice, not a mandatory notice item)
• Rights available to the user
• How to contact the Data Fiduciary (you) and the Data Protection Board (regulator)

Hidden in 8pt grey footer text doesn't count. The notice has to be prominent, readable, and shown before consent.

3. Right to Withdraw Consent: and What This Means for Your CRM

Users can withdraw consent at any time, as easily as it was given. The "as easily" principle has teeth: if signup is one click, withdrawal should be comparably simple.

Operational impact: your unsubscribe flow can't be a 5-step process. Your email footer "unsubscribe" should work simply. Your WhatsApp opt-out should be processed promptly. And on withdrawal, your CRM must stop processing that user for the consented purpose.

4. Right to Erasure (Impact on CDP/MAP Databases)

Users can request deletion of their personal data. You must erase it unless retention is necessary for the specified purpose or to comply with law (s.12(3)), within the period you publish. The exact period depends on the purpose and on the DPDP Rules; define and document yours.

Architectural impact: your data stack must support deletion across all systems (CRM, MAP (marketing automation), CDP (customer data platform), analytics warehouse, ad-platform Custom Audiences, email lists, backups). Deletion gets hard when the same data is duplicated across many systems with no orchestrated deletion workflow.

5. Children's Data (Under 18): Edtech, Gaming, D2C Watch Out

For users under 18, you need verifiable parental consent. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited (s.9(3)). Mere age-gate checkboxes don't satisfy "verifiable"; the DPDP Rules require checking that the parent is an identifiable adult, using reliable identity and age details you already hold or that the parent provides, or a virtual token such as one issued through DigiLocker.

Edtech, gaming, and certain D2C brands (kids' products) have the biggest exposure. If you market to under-18s without verifiable parental consent flows, your penalty exposure is high.

6. Cross-Border Transfer Rules

Personal data can be transferred outside India subject to restrictions the central government may set, including a list of countries to which transfers are restricted (s.16). This puts foreign-hosted SaaS (e.g. Mailchimp, HubSpot, Kit, formerly ConvertKit) in an area to watch carefully. You may be transferring personal data abroad without having confirmed the position under the Rules.

The pragmatic compliance path: document your transfers, use providers with India-region data residency where available, and obtain user consent to international transfers where relevant. Until the position is settled, this is a sensible best-effort posture; confirm specifics with counsel.

7. Data Breach Notification

A breach of personal data must be notified to the Data Protection Board and to affected data principals in the manner and within the timelines prescribed by the DPDP Rules. "Breach" is broadly understood: accidental disclosure, unauthorised access, and ransomware can all qualify.

For digital marketing, the practical implications: lead-form leaks, accidentally CC'd email blasts containing PII, ad-platform pixel misconfigurations that leak data, and scraped lead lists are all potentially reportable breaches. Document your incident response runbook now and align its timelines to the Rules.

8. Significant Data Fiduciary Status

If you process large volumes of personal data, sensitive personal data, or pose elevated risks to the rights of data principals, you may be designated an SDF. The exact designation criteria are set by the government, so confirm whether they apply to you rather than assuming.

SDF obligations include appointing an India-based Data Protection Officer (DPO), an independent data auditor, and periodic Data Protection Impact Assessments and audits (s.10). If you process large volumes of sensitive personal data, plan now.

DPDP Impact on Each Marketing Channel: Practical Table

Here's what changes for each channel.

Channel	What's Affected	Operational Change
Meta Ads (Custom Audiences, Lookalikes)	Custom Audience uploads, pixel-based retargeting, lookalike modelling	Consent must cover marketing communication and ad targeting via Meta as specified purposes in your notice. Lookalikes derived from non-consented data is potentially unlawful.
Google Ads (Customer Match, GA4 audiences)	Customer Match uploads, GA4 audience-based campaigns	Same as Meta: consent must cover ad targeting via Google.
Email Marketing	Existing lists, opt-in flows, segmentation	Need clear consent for marketing email. Legacy lists without documented consent are high-risk, because you must be able to prove consent (s.6(10)). Unsubscribe must be simple.
SMS	Existing TRAI/DND rules + DPDP compounding	Both regulations apply. DPDP adds the consent-quality and notice requirements.
WhatsApp Business API	Opt-in flows, template messages, recipient lists	Explicit opt-in with notice. Cannot use phone numbers from CRM without consent for WhatsApp.
Push Notifications	OS-level consent + app-layer consent	Two-layer consent. App-layer consent must be DPDP-aligned.
CRM / CDP / MAP	Purpose limitation, retention, deletion workflows	Purpose tagging, automated retention deletion, consent receipt logging.
Cookies and Pixels	Tracking cookies, Meta pixel, GA4 client ID, etc.	DPDP-aligned cookie banner with active consent for non-essential cookies. "Reject all" parity with "Accept all".
Lead Forms	Notice text, consent checkboxes	Notice in plain language; granular consent if multiple purposes; not pre-ticked.
Influencer Marketing	Data sharing with influencer, attribution	If you receive personal data from influencer (UGC submissions), you need consent. If you share aggregate data with influencer, consent depends on identifiability.

A DPDP-Aligned Cookie Banner: Spec Sheet

The DPDP Act and Rules don't mention cookie banners, so this spec applies the Act's consent standard. Here's the spec we recommend.

Recommended Elements

1. Notice text visible before any consent decision. Plain English or regional language. Lists specific cookie categories and their purposes.
2. Granular controls: separate consent for essential, analytics, marketing, and personalisation cookies. User can accept some categories and reject others.
3. "Reject All" with equal prominence to "Accept All". If "Accept All" is a big green button and "Reject All" is hidden in a sub-menu, it will be hard to show consent was free and unambiguous.
4. No pre-ticked checkboxes. All non-essential categories default to off.
5. Persistent revocation mechanism: a floating "Cookie Preferences" link in the footer that lets users revisit their choices. Same UI prominence as the initial banner.
6. Audit log: server-side logging of consent (timestamp, IP, choices). You need to be able to demonstrate consent on Board inquiry.

Sample Banner Copy

Your privacy choices

This site uses cookies and similar technologies. Essential cookies are required for the site to work. Analytics cookies help us understand usage. Marketing cookies are used to show you relevant ads on other sites. You can accept all, reject all, or customise your preferences. You can change your choices anytime via the "Cookie Preferences" link in the footer.

[Customise] [Reject All] [Accept All]

Privacy Policy • Data Protection Contact

The cookie banner is also where gaps are easy to miss. If your banner has "Accept" as the only prominent button, you likely have a problem to fix.

Building a Consent Management Platform (CMP) for India

Generic IAB-TCF cookie consent platforms (like OneTrust, Cookiebot, Usercentrics) are designed primarily for GDPR. They cover the basics of DPDP but can miss India-specific requirements, particularly notice in regional languages.

You have two options:

Buy: Cookiebot or OneTrust with India-specific notice customisation. Best for companies that want to outsource compliance maintenance.

Build: a lightweight in-house CMP with DPDP-specific consent receipt logging. Best for companies with privacy-conscious users and significant CRM integration.

Indian-built CMP vendors are emerging but the market is still maturing. For many growing companies, the build option gives the most defensibility.

DPDP-Safe CRM and MAP Architecture

Your CRM and marketing automation platform need three architectural changes:

1. Purpose Tagging

Every data field should be tagged with the purpose it was collected for. "Email address collected for newsletter" vs "email address collected for transactional updates": same field, two purposes, two consent states.

HubSpot, Salesforce, Zoho, and LeadSquared all support property-level metadata that can hold purpose tags. Custom workflows enforce purpose-aligned processing.

2. Consent Receipt Logging

For every consent collected, log: who consented, when (timestamp), what they consented to (specific purposes), how (channel: form, banner, app), and the version of notice they saw. Store this immutably (append-only log) for an appropriate period; the exact retention depends on purpose and the DPDP Rules.

3. Automated Retention Deletion Jobs

Personal data should not be kept beyond the period needed for its purpose. You need scheduled jobs that find and erase data past its documented retention period, while keeping the processing logs the DPDP Rules require you to retain for at least one year.

This is the single hardest engineering job in DPDP compliance because data sprawls. Build a retention orchestrator that calls deletion APIs across CRM, MAP, CDP, warehouse, ad platforms, and backups.

The 14-Point DPDP Marketing Audit Checklist

Run this against your current setup. Each "no" is a compliance gap to close. Save and share with your team.

1. Cookie banner has "Reject All" with equal prominence to "Accept All": yes/no
2. Cookie banner has no pre-ticked non-essential checkboxes: yes/no
3. Privacy notice is shown before the consent decision (not buried in a footer link): yes/no
4. Privacy notice and consent request can be read in English or any of the 22 Eighth Schedule languages, at the user's option: yes/no
5. Lead form consent is granular (separate consent per purpose) and not pre-ticked: yes/no
6. Email unsubscribe is one-click and processed promptly: yes/no
7. WhatsApp opt-in is explicit, with notice; opt-out is one-message: yes/no
8. SMS lists have documented consent for each contact (not just DND compliance): yes/no
9. Custom Audience uploads to Meta/Google use only consented contacts: yes/no
10. CRM has purpose tagging on personal-data fields: yes/no
11. Consent receipts are logged immutably with timestamp, channel, notice version: yes/no
12. Automated retention deletion jobs run across all systems on a defined schedule: yes/no
13. You have a documented data breach response runbook aligned to the timelines prescribed by the DPDP Rules: yes/no
14. If you process under-18 data, you have verifiable parental consent flows: yes/no

Each "no" is a gap to close before the core obligations apply in May 2027.

Common Myths and Traps

"We're B2B, DPDP doesn't apply"

Wrong. DPDP applies to personal data, not just consumer data. B2B contacts (a named person at a company) are personal data. The Act applies, subject to its exclusions, for example, personal data the individual has themselves made publicly available (s.3(c)(ii)).

"Lookalike audiences don't have personal data"

Wrong. Lookalikes are derived from personal data. A reasonable reading is that you need consent for the underlying data to use it for lookalike derivation.

"Implicit consent is fine for existing customers"

Not necessarily. New consent must be unambiguous, but for consent given before the Act's consent provisions commence, s.5(2) requires a DPDP notice as soon as reasonably practicable, after which you may keep processing until the person withdraws consent. Where you cannot evidence any consent, re-consent.

"DPDP is just GDPR-lite"

Mostly true, but watch the differences. DPDP centres consent more heavily and does not mirror GDPR's "legitimate interest" basis. DPDP has stricter children's data rules and India-specific notice language expectations. Penalty structures also differ; see the official Act for the exact schedule.

"Our CRM is in the US, so Indian law doesn't apply"

Wrong. DPDP applies to processing of personal data of individuals in India in connection with offering goods or services to them, regardless of where the data lives. If your CRM is US-hosted, you also need to consider cross-border transfer rules.

Sector Callouts

Fintech

Fintech faces high scrutiny because RBI digital lending rules and DPDP compound: your lending app's marketing has to satisfy both regulators. Consent for KYC data, consent for credit score pulls (typically already captured), and consent for marketing communications about loan products are distinct consent flows.

For deeper fintech-specific marketing guidance, see AI Marketing for Fintech in India on this blog.

Healthcare

The DPDP Act has no separate "sensitive personal data" category, but health data warrants higher protection; other healthcare frameworks may also apply, and the IT Act's Sensitive Personal Data Rules apply until the DPDP provisions that replace them take effect in May 2027. Hospital and clinic marketing teams need legal-counsel-led reviews of their patient marketing flows.

EdTech

EdTech faces particular attention because of children's data exposure. Verifiable parental consent flows are non-negotiable. Behavioural advertising to minors is restricted. Course recommendation engines that profile minors face particular scrutiny.

For edtech-specific implementation guidance, see AI Marketing for EdTech Startups on this blog.

D2C

D2C brands have meaningful risk in CRM-level practices and Custom Audience misuse. The common pattern: legacy email lists collected without granular consent, used for promotional blasts. The fix: send the s.5(2) notice where you can evidence past consent, and re-consent where you can't. Expect some list shrinkage.

Frequently Asked Questions

When does DPDP Act 2023 take effect for digital marketers?

The Act was passed in 2023 and the DPDP Rules were notified in November 2025. Consent Manager registration rules take effect in November 2026; the obligations most relevant to marketers (notice, consent quality, withdrawal, security safeguards, breach intimation, children's data, SDF duties and data-principal rights) apply from May 2027. Plan for them now.

Does DPDP apply to B2B marketing in India?

Yes. DPDP applies to personal data of identifiable individuals regardless of B2B or B2C context. Contact details of business decision-makers (name, work email, work phone) are personal data and generally protected, subject to the Act's exclusions.

What is a Data Fiduciary vs Data Processor under DPDP?

A Data Fiduciary determines the purpose and means of data processing: that's you, the brand. A Data Processor processes data on behalf of the Fiduciary: that's typically your vendors (CRM, MAP, ad platforms). Under the Act the Fiduciary is responsible for compliance, including processing its processors carry out on its behalf (s.8(1)); processors are bound through your contracts (s.8(2)).

Can I still run Meta Lookalike Audiences under DPDP?

Likely yes, provided the underlying seed audience consists of consented contacts. Lookalikes derived from non-consented data carry risk. The safer path: maintain a separate "consented for ad targeting" segment in your CRM, and use only that segment as the seed for lookalikes.

What's the DPDP penalty for sending marketing emails without consent?

Consent and notice breaches fall under the Schedule's residual entry (up to ₹50 crore if the Board finds the breach significant) while security-safeguard failures can reach ₹250 crore; the amount depends on the nature, gravity and duration of the breach (s.33). These provisions apply from May 2027. The practical point is that systemic non-compliance carries real exposure, so it's worth fixing consent gaps early.

Does DPDP apply to data hosted outside India?

Yes. DPDP applies based on the processing of personal data of individuals in India in connection with offering goods or services to them, not based on where the data is hosted. US-hosted CRMs still need DPDP compliance for Indian user data.

How long does DPDP compliance take to implement?

For a typical Indian D2C or SaaS company starting from scratch, the core architecture (cookie banner, lead form redesign, consent receipt logging, retention deletion jobs, breach runbook) is a focused project whose length depends on how many systems hold personal data. Sector-specific overlays (children's data flows for edtech, sensitive data flows for healthtech) add further time.

The Bottom Line

DPDP is not the kind of regulation to ignore until a Board notice arrives. Given the potential for substantial penalties and the reputational risk of a public enforcement action, building compliance in is materially cheaper than retrofitting it under pressure.

The good news: most of the work is achievable in a focused project. The hard parts (CRM purpose tagging, retention deletion orchestration, regional language notice flows) require investment but aren't insurmountable.

If you'd like help reviewing how your marketing stack captures, stores and deletes personal data, our cybersecurity and cloud solutions team can help. You can reach us at +91-8010010000 or via our contact page.

Related reading: the Complete SEO Guide for Indian Businesses, LLM SEO, and AI Chatbot Development Services in India.

Where Brainguru Can Help

Compliance work usually lands across three systems at once: the data you hold, the stack that processes it, and the marketing that touches it. We cover data protection and privacy compliance, governance and compliance engineering, and cybersecurity and cloud security. If the gap is in how consent is captured and stored, that is usually a CRM and automation problem, and AI marketing solutions covers the campaign side.