The DPDP Act for marketers changes how brands collect, manage and use customer data across advertising, ecommerce and customer communications. Lead forms, WhatsApp lists, email databases, retargeting audiences, loyalty programmes and CRM exports all contain personal data. This guide explains in plain language where the DPDP Act touches everyday marketing work, what brands and agencies should start preparing, and which questions to take to your lawyer. It is general information from a marketing agency, not legal advice.
Key takeaways (The TL;DR)
- The DPDP Act applies to digital personal data processed in India, and to processing outside India when goods or services are offered to people in India, so most D2C, FMCG and ecommerce brands are covered.
- Consent must follow a clear notice and can be withdrawn at any time, which affects lead forms, WhatsApp opt-ins, email lists, tracking and retargeting.
- The Act restricts tracking, behavioural monitoring and targeted advertising directed at children, so brands selling kids’ products need extra care.
- Penalties can reach up to Rs 250 crore for failing to maintain reasonable security safeguards, so brands and agencies should map their data and review contracts with a lawyer before the main obligations apply.
What Is the DPDP Act, and How Does It Affect Marketers?
According to the PRS Legislative Research summary of the Act, the Act applies to the processing of digital personal data within India, whether collected online or collected offline and then digitised. It also applies to processing outside India if it is connected to offering goods or services to people in India. Personal data means any data about an individual who can be identified from it, so names, phone numbers, email addresses, addresses and order histories all count.
In the Act’s language, the business that decides why and how data is used is a data fiduciary, the individual is a data principal, and a company that processes data on the fiduciary’s behalf is a data processor. A brand collecting leads is usually the fiduciary. An agency, CRM vendor or messaging provider handling that data for the brand is typically in the processor role. Which label applies in your case depends on the facts, so confirm it with your lawyer.
Where Does the DPDP Act Touch Marketing Work?
| Marketing activity | What to review |
| Lead forms and landing pages | Is there a clear notice stating the purpose? Is consent specific and easy to understand? |
| WhatsApp, SMS and email lists | Do you have proof of opt-in for each purpose, and an easy way to opt out? |
| Retargeting and customer match audiences | Do you have permission to use customer data for ads before uploading lists to ad platforms? |
| Tracking pixels, cookies and analytics | What is collected, why, and is the user informed and given a choice? |
| CRM, loyalty and referral programmes | How long is data kept, and is it erased once the purpose is met? |
| Influencer and contest data | Who collects entrant data, for what purpose, and who holds it? |
| Agency and vendor access | Is there a written contract covering how your data is handled and secured? |
| Marketplace and quick commerce sales | Which customer data do you actually receive from platforms, and what are the platform terms? |
On marketplaces and quick commerce platforms, brands typically see aggregated sales and advertising reports rather than individual customer details, and platform terms govern what data is shared. Check what your own accounts actually provide before assuming you hold personal data there. On your own website, app or WhatsApp channel, you almost certainly do.
What the Law Says About Consent, Children and Security
Notice and consent
The Act allows personal data to be processed for a lawful purpose after consent, and requires a notice describing the data and purpose before consent is sought. Consent can be withdrawn at any time. The Act also lists limited “legitimate uses” where consent is not required, such as data an individual voluntarily provides for a specified purpose. Do not assume marketing falls under those uses without legal advice.
Children’s data
For individuals under 18, consent is given by a parent or legal guardian. The Act also says fiduciaries must not undertake tracking, behavioural monitoring or targeted advertising directed at children. Brands selling toys, kids’ food or education products should review their audience targeting, apps and sign-up flows with this in mind, and check how the Rules apply to their case.
Security, breaches and erasure
Fiduciaries must maintain reasonable security safeguards, inform the Data Protection Board and affected people of a breach, and erase data once the purpose is met and retention is not needed for legal reasons. The Government of India press release on the DPDP Rules, 2025 sets out maximum penalties of up to Rs 250 crore for failing to maintain reasonable security safeguards, up to Rs 200 crore for failing to notify a breach or for child-related violations, and up to Rs 50 crore for other violations. These are ceilings, not typical outcomes.
When Do the Main Rules Apply?
The Government of India notified the DPDP Rules, 2025 in November 2025 and provided an 18-month period for phased compliance. Counting from the notification, the main duties of data fiduciaries, such as notice, consent, safeguards and breach intimation, are generally understood to apply from around mid-May 2027, with consent manager provisions around November 2026. There have been press reports that the government may shorten this timeline, but as of this writing we could not find an official notification changing the dates. Dates and scope can change, so check the Official Gazette and ask your lawyer which dates apply to your business.
A Practical Preparation Checklist for Brands
- Map your data: list every place you collect customer data, why, where it is stored and who can access it.
- Update forms and notices: use plain-language notices stating the purpose, with a clear way to give and withdraw consent.
- Clean your lists: keep records of how and when each contact opted in, and remove contacts you cannot justify keeping.
- Review ad audiences: check the basis on which customer lists are used for retargeting and lookalike audiences.
- Review vendor contracts: agencies, CRM, messaging and analytics tools should be bound by written terms on handling and securing data.
- Plan for requests and breaches: decide who handles access, correction and erasure requests and who responds to a security incident.
- Review children’s audiences: if your products are for children, get legal advice before running tracking or targeted ads.
- Train your team: sales, support and marketing staff should know what customer data can be used for.
How AKOI Can Help
AKOI is a marketing agency, not a law firm, so we do not give legal advice or certify DPDP compliance. What we can do is plan campaigns, tracking and lead capture with consent and data minimisation in mind, so your marketing is easier to align with what your legal team advises. Across ecommerce marketing and PPC work for D2C, FMCG and ecommerce brands, that means clear opt-in on lead forms and WhatsApp, careful use of first-party data and audience lists, and clean reporting that does not depend on collecting more personal data than needed. Brands selling on Blinkit, Zepto, Swiggy Instamart, Amazon Now, Flipkart Minutes and BigBasket can also rely on platform reporting for much of their performance insight. If you would like a marketing-side review of where your brand collects and uses customer data, our team can help you prepare the questions for your lawyer.
Frequently Asked Questions
Does the DPDP Act apply to marketing agencies?
Agencies that handle personal data for brands are typically in a processor role, and brands usually remain responsible as fiduciaries. Written contracts and secure handling matter for both. Ask your lawyer how the roles apply to your arrangement.
Do I need consent to send WhatsApp or email marketing?
The Act generally requires consent after a clear notice, with limited legitimate uses. Because marketing messages may also be covered by telecom and platform rules, confirm the right basis for each channel with your lawyer.
Can I still use retargeting and customer lists for ads?
Possibly, but you should check that you have a proper basis to use the data for that purpose and that the platform terms are followed. Targeted advertising directed at children is restricted by the Act.
What are the penalties under the DPDP Act?
The penalty schedule includes up to Rs 250 crore for failing to maintain reasonable security safeguards, up to Rs 200 crore for failing to notify a breach or for child-related violations, and up to Rs 50 crore for other violations.
When do I need to be compliant?
The Rules provide an 18-month phased period from the November 2025 notification, which points to around mid-May 2027 for most duties. Check the Official Gazette for any change, and ask your lawyer which dates apply to you.
Do small businesses need to comply?
The Act is not limited to large companies, so small brands that collect personal data should also prepare. Ask your lawyer whether any exemptions or relaxations in the Rules apply to your business.