DPDP Act for digital marketing in India: the consent checklist to finish before 13 May 2027

Checked against the Gazette notifications and MeitY's published Rules on 28 September 2026. General information for marketing teams, not legal advice: have counsel sign off your notice text.

If you run digital marketing in India, the date that matters in the Digital Personal Data Protection Act (DPDP Act) is 13 May 2027. That is when the notice, consent, withdrawal, children's-data, retention and grievance duties start, together with the Data Protection Board's power to penalise (G.S.R. 843(E), the commencement notification). 13 November 2026 only brings in the rule that lets Consent Managers register. It adds no duty to your lead forms, so use the next seven months to fix consent where you capture it, use it and keep it.

In January 2026, MeitY reportedly proposed moving the May 2027 date to 13 November 2026, at least for the largest data handlers (S.S. Rana & Co.'s note). We found no notification as of 3 October 2026.

From 13 May 2027, valid consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (DPDP Act, s.6(1)). A standalone notice must precede or accompany it (s.5 and Rule 3 of the DPDP Rules). Withdrawing must be about as easy as giving (s.6(4)). If consent is questioned in a proceeding, you are "obliged to prove that a notice was given" and that consent was given (s.6(10)).

What changes on 13 November 2026, and what on 13 May 2027?

The Act commences in stages under G.S.R. 843(E), and the DPDP Rules follow the same clock (Rule 1).

• 13 Nov 2026 — What comes into force: s.6(9) (Consent Managers register with the Board) and s.27(1)(d); Rule 4 and the First Schedule; What it means for marketing: Consent Managers can register. No duty on your forms or campaigns

• 13 May 2027 — What comes into force: ss.3–5, s.6(1)–(8) and (10), ss.7–17, the rest of s.27, ss.28–34 (including s.33 penalties), ss.36, 37 and 44(2); Rules 3, 5–16, 22 and 23; What it means for marketing: Everything in this checklist, and penalties

The notifications are dated 13 November 2025, but the Press Information Bureau announced them on 14 November 2025. On that reading the dates move to 14 November 2026 and 14 May 2027. Plan for the 13th.

What does valid marketing consent look like under DPDP?

Every duty here starts on 13 May 2027. Section 6(1) also limits consent to the data "necessary for such specified purpose". Don't bundle marketing into the consent for your service.

Our reading: a pre-ticked box is hard to square with "a clear affirmative action". A form that won't submit without the marketing tick is hard to square with "unconditional".

The notice. Rule 3 requires a notice that is understandable "independently of any other information". It must give at least an itemised description of the data, the specified purpose and what it enables, and a link to withdraw, exercise rights and complain to the Board. So a privacy-policy link alone won't do (our reading). The request must also give contact details for your Data Protection Officer or another person who can answer (s.6(3)).

Language. People must be able to read the notice "in English or any language specified in the Eighth Schedule to the Constitution" (s.5(3) and s.6(3)). Ask counsel whether English alone is enough for a Hindi, Marathi or Tamil funnel.

No tick needed, within limits. Section 7(a) lets you use data for the purpose it was "voluntarily provided" for, until the person objects. Our reading: a callback request lets you call back. It doesn't cover your newsletter, retargeting or lookalikes.

Startups. Notified startups can be exempted from s.5 notice, but not from s.6 consent (s.17(3)). We found no such notification as of 28 September 2026.

The DPDP Act checklist for digital marketing in India: Capture, Use, Keep, Answer

The Act's duties here start on 13 May 2027.

Capture: where the data comes in.

Check 1. Lead forms, lead ads and event sign-ups

Rule: one unticked, optional checkbox per channel, with the Rule 3 notice beside the form.

Why: This is the consent line I have my IIT Kanpur cohort build (Session 5, "Build the Machine"):

• "Send me [offer] updates on WhatsApp. Reply STOP to leave."

• "Send me [offer] updates by email. One-click unsubscribe."

Where a platform lead form or event registration can't carry the boxes, treat those leads as s.7(a) requests until they opt in (our reading).

Done when: every submission stores "both consent fields and a timestamp" for your s.6(10) evidence.

Check 2. WhatsApp: Click-to-WhatsApp ads and broadcasts

Rule: "A WhatsApp chat is a conversation, not consent. The tick is the consent" (Session 5).

Why: WhatsApp already asks for a clear opt-in that names the business (Meta's WhatsApp opt-in requirements) and says you "must respect all requests" to opt out (WhatsApp Business Messaging Policy).

From 13 May 2027, the DPDP Act adds that on withdrawal you must "cease and cause its Data Processors to cease" processing (s.6(6)). So an opt-out reply has to stop your WhatsApp provider, your customer relationship management (CRM) system and every automation.

Our reading: someone who taps a Click-to-WhatsApp ad and asks about a product can get an answer (s.7(a)). Broadcasts need the tick. Building WhatsApp commerce automation for reorders? Wire the opt-out in before the first send.

Done when: a test opt-out clears the number from every tool within a written deadline.

Check 3. SMS and calls

Rule: DPDP consent and consent under Telecom Regulatory Authority of India (TRAI) rules are separate records. Keep both.

Why: Every promotional SMS must carry an opt-out in the same message (TRAI's commercial communications regulations, Second Amendment, 12 February 2025). Promotional content mixed into a transactional or service message makes the whole message promotional.

The explanatory memorandum to TRAI's Third Amendment (18 September 2026) says revoking TRAI consent "does not, by itself, amount to withdrawal of consent under the DPDP Act".

Done when: your explicit TRAI consents sit in the Consent Register, and a DPDP withdrawal that covers SMS or calls stops them too (our reading of s.6(6)).

Use: where the data gets used.

Check 4. Email and nurture sequences

Rule: treat an email unsubscribe as withdrawal of consent for email marketing, in every tool (our reading).

Why: The same withdrawal duties apply (s.6(4) and s.6(6)).

Done when: one unsubscribe stops email everywhere, CRM and sales sequences included, and no later import adds the person back.

Check 5. Pixels, Conversions API and customer-list uploads

Rule: "Never upload a list you can't trace to a consent line" (Session 5).

Why: Processing includes "sharing, disclosure by transmission" (s.2(x)). The Act never mentions hashing, and the Rules treat "obfuscation, masking" as security for personal data, not an exit from it (Rule 6(1)(a)). Our reading: hashed Custom Audience, Customer Match and Conversions API uploads are still sharing personal data.

Meta's Customer List Custom Audiences Terms note the data is "hashed before you upload", yet you still warrant "all necessary rights and permissions and a lawful basis".

The session names the lists that fail: "purchased lists, order data reused without consent, anyone under 18". A trace is only as good as the notice behind it, so name ad-platform matching as a purpose in your Rule 3 notice.

Done when: every audience has a named source list, and every contact on it traces to a consent line.

Check 6. Children's data (under 18)

Rule: no targeted ads at under-18s, and verified parental consent before you process a child's data.

Why: A child is anyone under 18 (s.2(f)). You need "verifiable consent of the parent" first (s.9(1)). You "shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children" (s.9(3)).

Rule 10 sets how to verify the parent: identity and age details you already hold, details the parent provides, or a virtual token from an authorised entity, including one verified through a Digital Locker service provider.

The Fourth Schedule's exemptions (among them an "educational institution" monitoring children for its educational activities or their safety) permit no advertising to children. Ask counsel whether your edtech company counts as an "educational institution" at all.

Meta's terms bar audiences built on data about children "under the age of 13" (Customer List Custom Audiences Terms). DPDP draws the line at 18. In practice: ad-set ages start at 18, K-12 funnels target parents, and any form a child might fill in asks age first. My BYJU'S case study makes the parent point in one line: "Digital alone could not reach the parent who decides."

From 13 May 2027, breaching the children's obligations carries a penalty that may extend to ₹200 crore (the Schedule to the DPDP Act).

Done when: no ad set or audience includes under-18s, and every child's record has parental consent.

Keep: where the data lives.

Check 7. CRM and legacy databases

Rule: re-notice contacts who consented before the Act; stop using lists with no trail.

Why: For consent given before commencement, send a notice "as soon as it is reasonably practicable" (the Act's example: "email, in-app notification or other effective method"). You may keep processing until the person withdraws (s.5(2)). Ask counsel what "commencement" means when the Act starts in stages.

Bought, scraped or undocumented lists can't meet s.6(10). Self-published personal data is excluded (s.3(c)(ii)); ask counsel before applying that to scraped profiles.

Done when: every contact record has a source and a status (consented, s.7(a) only, legacy awaiting re-notice, unknown), and "unknown" gets no marketing.

Check 8. Retention and erasure of marketing lists

Rule: every list has a purpose and an end date.

Why: Erase data when consent is withdrawn or the purpose is no longer served, and make processors erase it too, unless a law requires you to keep it (s.8(7)). But Rule 8(3) says keep personal data, traffic data and processing logs for at least a year, for the Seventh Schedule purposes.

Ask counsel how the two interact. Our reading: stop marketing at once, keep the consent log and a suppression record, and erase the rest on schedule.

Rule 8(1)–(2) of the DPDP Rules sets a three-year inactivity erasure, with a 48-hour warning. It covers only e-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh.

Done when: every list also has a named owner.

Check 9. Agencies, martech tools and creators

Rule: keep a register of everyone who touches your lead data.

Why: People can ask for "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared" (s.11(1)(b)). Processor contracts need security-safeguard terms (Rule 6(1)(f)).

Creator-collected leads (giveaways, direct messages) are the grey zone: ask counsel who the Data Fiduciary is, and meanwhile send creator traffic to your own form.

Done when: every tool, agency and creator is on the register, with a contract clause and a named person who confirms erasure.

Answer: where people come back to you.

Check 10. The rights and grievance inbox, and your consent records

Rule: publish who answers, how, and how fast.

Why: Publish the contact details of your Data Protection Officer or "a person who is able to answer" on your website or app (Rule 9). Also publish how to make rights requests (Rule 14(1)) and your grievance response period, which may not exceed 90 days (Rule 14(3)). People must use your route before going to the Board (s.13(3)), so route "remove me" messages from WhatsApp, direct messages and sales calls into it.

Then log what s.6(10) will ask you to prove:

• source (form, ad, event, creator)

• notice version

• purpose and channel

• box state and timestamp

• withdrawal date

• tools updated

Done when: the contact, the rights route and the response period are live, and every lead carries these fields.

What do Consent Managers change for a marketing team?

A Consent Manager is a Board-registered "single point of contact" through which a person can "give, manage, review and withdraw her consent" (DPDP Act, s.2(g)).

A person "may" use one (DPDP Act, s.6(7)). Our reading: from May 2027, honour consents and withdrawals that arrive through a registered one. If a vendor claims a November integration deadline, ask for the section.

The Board registers Consent Managers (Rule 4), and the Board needs members.

"Legal has this", and other objections

"Legal owns DPDP." Legal writes the notice. Marketing ops decides whether the box is unticked, whether opt-outs sync and what goes to Meta. Those are what a complaint would point to.

"The Board has no members yet." LiveLaw reported on 1 August 2026 that none had been appointed, and we found no appointment notice as of 28 September 2026. That is a timing argument, not a defence: the duties start on 13 May 2027 either way, and consent records you didn't keep can't be rebuilt when s.6(10) asks for them.

"Our leads will drop." The form still submits without the ticks, so lead volume shouldn't move; what shrinks is the list you can market to (our reading).

What to do this quarter, and through 13 May 2027

A suggested sequence (my opinion, not a legal timetable):

1. October–November: inventory every capture point, list and tool.

2. December–January: counsel drafts the Rule 3 notice; fix forms and boxes.

3. February–March: wire opt-out and unsubscribe sync and the consent log; clean upload lists.

4. April: send the s.5(2) re-notice; set retention periods.

5. By 13 May 2027: publish the rights and grievance contact.

Want help rebuilding your forms, WhatsApp flows, CRM flags and audience uploads? That is part of my AI marketing consulting work: book a call. Your counsel signs off the notice text.

Frequently asked questions

What is the penalty for marketing without valid consent under DPDP?

Up to ₹50 crore for adults' data and ₹200 crore for children's, from 13 May 2027. For adults, notice and consent fall under "breach of any other provision" in the Act's Schedule. Duties to children (s.9), including the parent's verifiable consent, have their own line. The Board weighs "the nature, gravity and duration of the breach" (s.33(2)).

Does the DPDP Act cover B2B leads and work email addresses?

Yes, when the data identifies an individual. The Act defines personal data as "any data about an individual who is identifiable by or in relation to such data" (DPDP Act, s.2(t)). Our reading: a named buyer's work email and mobile number are personal data, so B2B demo forms need the same consent boxes as consumer forms.

Does the DPDP Act require a cookie consent banner?

Not by name: neither the Act nor the DPDP Rules mention cookies. Our reading: a cookie or pixel that collects data about an identifiable person collects personal data (s.2(t)), so using it for ads needs the same specific, unconditional consent. Name ad tracking in your notice, and let people refuse it and still use the site.

Do I need to buy a DPDP consent management platform?

No. Neither the Act nor the Rules requires one (our reading). The Act requires proof of notice and consent (s.6(10)) and withdrawal about as easy as giving consent (s.6(4)). Your CRM can do both if it logs the Check 10 fields and syncs opt-outs. Registered Consent Managers differ: people "may" use one (s.6(7)); honour what arrives through it.

Does the DPDP Act apply to small businesses?

Yes. Our reading: the Act sets no size or turnover threshold. From 13 May 2027 it covers digital personal data processed in India, including data collected on paper and digitised later (s.3(a)), such as event sign-up sheets. Section 17(3) lets the government exempt notified businesses, including startups, from some duties, like the s.5 notice, but not consent.

Do we need a Data Protection Officer under DPDP?

Only if the government notifies you as a Significant Data Fiduciary (s.10(1)). Such firms must appoint one, based in India (s.10(2)(a)). Others publish contact details of someone who can answer privacy questions (Rule 9). Both start on 13 May 2027; an earlier date for them was reportedly proposed (S.S. Rana & Co.).

What must we do after a data breach under DPDP?

From 13 May 2027, tell the Board and each affected person (s.8(6)): people "without delay", the Board without delay and in detail within 72 hours of becoming aware (Rule 7). Leaks at vendors processing data for you count too (s.8(1)). Penalties: up to ₹250 crore for inadequate security safeguards, ₹200 crore for not notifying (the Schedule).

Can we use marketing tools that store data outside India?

Yes, unless the government restricts transfers to that country (s.16(1)). Our reading: there's no general rule keeping data in India. Significant Data Fiduciaries may have to keep specified data in India (Rule 13(4)), and stricter Indian transfer laws still apply (s.16(2)). These start on 13 May 2027, so note each tool's storage country now.