What Is the DPDP Act?

The DPDP Act (India's Digital Personal Data Protection Act, 2023) is the law governing how organisations ("data fiduciaries") collect, use, store, share and protect the digital personal data of individuals ("data principals") in India. Its detailed rules are notified by the government, so always check current guidance.

Why it matters for marketers

Marketing runs on personal data: names, phone numbers, emails and behaviour. The DPDP Act expects businesses to:

• Process data for a lawful purpose, generally with consent (with limited exceptions)
• Give clear notice about what's collected and why
• Collect only what's necessary
• Keep data accurate and secure
• Delete it when the purpose is served
• Honour rights such as withdrawing consent, correction and erasure

Practical steps

• Use clear consent checkboxes on forms and checkout
• Keep records of where and when consent was given
• Store leads in a secure CRM, not personal phones
• Make opt-out easy on every channel
• Set data-retention schedules

This is general information, not legal advice.

Example

An e-commerce brand adds an unticked checkbox for WhatsApp offers at checkout, logs consent with a timestamp, and removes numbers immediately when customers reply STOP.

Related terms

Data extraction · List hygiene · DLT registration

Guide: DPDP-safe cold outreach.