DPDP Act for Marketers

The DPDP Act (Digital Personal Data Protection Act, 2023) is India's law on how businesses collect and use personal data in digital form. For marketers it decides when you may store a lead's phone number, what you must tell them first, and when you must stop using it. This page is general information, not legal advice.

• Consent: Most marketing use of personal data needs clear, specific consent given by a real action, such as ticking a box.
• Notice: Before or at the time of asking, you must tell people what data you collect and why.
• Purpose: Data may be used only for the purpose you stated, not for anything else you think of later.
• Withdrawal: People can take back consent at any time, and it must be as easy as giving it.
• Children: Data of anyone under 18 needs verifiable consent from a parent or guardian.

This lesson follows one example: a coaching institute in Pune that prepares students for JEE and NEET. It collects leads from Instagram ads, a website form and school seminars. Many students are 15 to 17, so the children's data rules apply.

Key Characteristics of the DPDP Act

• Who it covers: Any business that processes digital personal data of people in India, and in some cases businesses abroad that offer goods or services to people in India.
• Roles: The business is the data fiduciary, the person is the data principal, and an agency working for the business is a data processor.
• Consent standard: Consent must be voluntary, specific, informed, unconditional and unambiguous, and shown by a clear affirmative action. A pre-ticked box does not meet this.
• Legitimate uses: A few purposes do not need consent, such as data a person gives voluntarily for a specific purpose. Plan marketing around consent.
• Regulator: The Data Protection Board of India hears complaints and can impose penalties. The Schedule to the Act sets maximum penalties that run into crores of rupees for serious failures.
• Rules: The DPDP Rules, 2025 fill in the details, such as notice content, breach reporting and Consent Manager registration, and start in phases.

How the DPDP Act Works in a Campaign

1. Give notice: The Pune institute's form shows a short notice: what is collected, why, how to withdraw and how to complain to the Board.
2. Collect consent: A separate unticked checkbox reads "Send me course updates on WhatsApp and SMS".
3. Use for that purpose only: The number is used for the demo class and, if the box was ticked, for course updates.
4. Honour rights: People can ask what data the institute holds, ask for corrections or deletion, and raise a grievance, and must get an answer in time.
5. Allow withdrawal: Every message has a simple way to stop, such as replying STOP.
6. Erase when done: When the purpose is over and no law requires keeping it, the data is deleted from the CRM and ad audiences.

Data Principal Rights and Consent Managers

Data principal rights under the DPDP Act include the right to access a summary of their data, to correct and erase it, to have a grievance addressed, and to nominate someone to act for them. Your CRM must be able to find, fix and delete one person's records quickly.

Consent Managers are companies registered with the Board that let people give, review and withdraw consent across many businesses from one place. If a lead comes through one, your systems must respect the choice it passes on.

Children's Data in the DPDP Act

A child under the Act is anyone under 18. Processing a child's data needs verifiable consent from a parent or lawful guardian. The Act also bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions the government may notify.

For the institute, this changes the plan:

• Ads: Target parents, not students.
• Forms: Ask the parent to fill in the enquiry, and confirm the parent's consent, for example through a one-time password to the parent's number.
• Retargeting: Do not build remarketing audiences from students under 18.

Example: DPDP Act Compliance for a Coaching Institute

• Before: A pre-ticked box on the form allowed "all communication", and seminar numbers went straight into a WhatsApp broadcast list.
• After: The form has a short notice, an unticked marketing checkbox and a line on how to withdraw.
• CRM: Each lead has a consent field with the date, source and purpose, so the team can prove consent later.
• Messaging: WhatsApp broadcasts go only to leads who opted in, following WhatsApp marketing best practice.
• Tracking: The website's Google tags respect the visitor's banner choice through Consent Mode v2.

Benefits of Following the DPDP Act

• Trust: Parents share data more readily when the institute explains why it needs it.
• Cleaner lists: Opted-in leads are more likely to read messages, and fewer mark them as spam.
• Lower risk: Consent records reduce the risk of complaints.
• Better data strategy: Consent-based data is the base of a lasting first-party data strategy.

Limitations and Open Questions

• Phased start: Some duties begin later than others, so what applies today may change.
• Grey areas: Terms such as verifiable consent depend on how the Board reads the Rules.
• Other laws still apply: SMS and calls also fall under TRAI's commercial communication rules, and ads under consumer protection law.

How AI Changes DPDP Act Compliance

What AI Automates Now

AI tools can draft plain notices in English, Hindi and Marathi, find leads with no consent record in a CRM export, and draft replies to access requests. A chat widget built on a large language model can explain the notice to a parent.

What Still Needs a Human

A lawyer or trained privacy lead must approve the final notice and consent flow. A person must also check that a deletion request removed the data from every tool, including ad audiences.

Risk to Watch

Pasting lead lists with names and phone numbers into a public AI tool is itself a use of personal data, and may breach the purpose you told people about. AI tools also hallucinate legal details, such as section numbers and deadlines, so never publish an AI summary of the law without checking the official text.

Do It with AI

Use this prompt to draft a short, clear consent notice for a lead form. It works in ChatGPT, Claude or Gemini. Share no real customer data.

1. Fill in only the purposes the business needs.
2. Run the prompt and edit the draft into the brand's tone.
3. Send it to a lawyer or privacy lead for review.
4. Put it live on every form, and add a consent field to the CRM to record each answer.

Check Before You Use It

• Facts: Match every claim in the notice to what the business actually does with the data.
• Brand fit: Keep the tone warm and plain, as the institute would speak to a parent.
• Compliance: Get legal review, keep marketing consent separate and unticked, and never use bought or scraped lists.