By DigiBoss Editorial Team · Last updated: October 16, 2026 · 9 min read

What Is the DPDP Act and Why Should Marketers Care?

The Digital Personal Data Protection Act, 2023 is India’s main law on how digital personal data is collected, used and protected. It covers data about an identifiable person that is in digital form, or was collected offline and then digitised. For a marketer, almost every spreadsheet of names, mobile numbers and emails is personal data.

The Act talks about three parties. The Data Principal is the person the data is about, for example a student. The Data Fiduciary is the organisation that decides why and how that data is processed, which can be your coaching institute, college or agency. A Data Processor handles data on behalf of a fiduciary, such as an email platform or calling vendor.

If you decide who to message and what to say, you are acting as a Data Fiduciary. That means responsibility sits with you, not only with the company that sold or sent you the file. Many marketers miss this point.

DPDP Timeline: What Applies When

The government notified the DPDP Rules, 2025 on 14 November 2025 after public consultation. The rollout is phased, so businesses get time to prepare.

Do not read the phase-in as a reason to wait. Systems that capture consent, record sources and handle opt-outs take months to set up. Teams that begin early will also have cleaner data and fewer surprises. For official updates, check the Ministry of Electronics and Information Technology (MeitY) and the Press Information Bureau.

Consent: The Core of DPDP Compliance

Consent under the Act must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. In practice this changes how you design forms and messages.

• Ask for the purpose, not a blanket yes. “We will send you scholarship test updates on WhatsApp” is specific. “We may contact you for any reason” is not.
• No pre-ticked boxes. The person must take a positive step.
• Use plain language. The notice should be clear and easy to understand and, where relevant, available in more than one language.
• Make withdrawal easy. If someone opts in with one tap, they should be able to opt out with about the same effort.
• Keep records. Store when, where and how each person agreed so you can prove it later.

The Act also lists limited “legitimate uses” where consent is not required, such as when a person voluntarily shares data for a stated purpose and has not objected to its use. These are narrow, and marketing teams should not stretch them to cover bulk outreach. When in doubt, take consent or ask a lawyer.

Buying or Licensing Lead Data Under the DPDP Act

This is the question every marketer asks. The Act does not ban lead data, but it puts a duty on you to know where data came from and whether your use matches what people agreed to. Treat the following as a due-diligence list for any vendor, including us:

1. Where did the records come from and under what notice or consent?
2. Were people told their data could be shared with third parties for marketing?
3. When was the data last updated or checked?
4. Does the file include anyone under 18, and how is that segment handled?
5. How can a person ask for removal, and how fast will the vendor act?
6. What happens if a complaint or breach occurs? Is there a contact point?

Put the answers in writing, keep them with your records and decide whether the risk is acceptable for your type of campaign. A vendor who cannot answer these questions clearly should not hold your trust or your budget. For help comparing sellers, read our guide on how to compare student data providers and our database quality audit.

Children’s Data: The Part Education Marketers Must Read Twice

The Act treats a child as anyone under 18. Before processing a child’s personal data, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian. The Act also prohibits tracking or behavioural monitoring of children and targeted advertising directed at them, subject to limited exemptions that the Rules describe.

This matters directly to education businesses because many Class 10, Class 11 and Class 12 students are minors. Practical steps include:

• Direct your messages to parents or guardians where the student is under 18, and say so clearly.
• Avoid ad targeting and profiling built around minors’ behaviour.
• Collect only what you need, such as a name and a guardian contact for a counselling slot.
• Do not make offers that exploit exam anxiety or promise results you cannot guarantee.
• Segment your list so you can apply stricter handling to likely minors.

Rules on how age and guardian verification must work are detailed in the DPDP Rules. Read the current text on the official sites and confirm your process with a legal professional before you run campaigns aimed at school students.

Penalties and Enforcement

The Data Protection Board of India handles complaints and can impose penalties after an inquiry. The Act sets out monetary penalties by type of breach. The highest tier applies to failing to maintain reasonable security safeguards and can reach up to ₹250 crore. Other breaches, such as not notifying a data breach or violating the children’s data duties, carry their own penalty ceilings under the Schedule to the Act.

Amounts depend on the nature, gravity and duration of the breach and the steps the organisation took. The practical lesson is that good records, quick opt-out handling and secure storage are not paperwork. They are your best defence.

A Practical DPDP Checklist for Marketing Teams

Pair this checklist with telecom compliance. Read TRAI telemarketing rules for coaching institutes and businesses for calls and SMS, and our complete lead database guide for the wider picture.

What This Means for Everyday Campaigns

• Cold email: include a real sender identity, a clear reason for contact and a working unsubscribe link, and stop sending when asked.
• Calling: say who you are, why you are calling and offer to stop. Respect DND and TRAI rules.
• WhatsApp: message only people who opted in, and use approved templates.
• Lead forms: explain what you will send and how often, and keep proof of consent.
• Data sharing: never forward a purchased file to unrelated parties.

Sample Consent and Notice Wording

Wording must fit your real practice and be reviewed by your lawyer. These examples show the style: specific, plain and tied to a purpose.

Replace the placeholders with your actual practices. Do not copy wording that promises something you do not do.

Common Myths About the DPDP Act

Data Retention, Security and Deletion

The Act expects you to keep personal data only as long as needed for the stated purpose and to protect it with reasonable security. For marketers this means a few simple routines:

• Set a retention period for each list, for example 12 months for inactive contacts, and delete or anonymise afterwards.
• Store files in access-controlled folders and avoid sharing them by open chat groups.
• Remove ex-employees’ access and keep a record of who downloaded each file.
• Use strong passwords and two-step verification on CRM, email and cloud storage.
• Create a short incident plan that names who investigates a leak and who informs affected people.

If you work with agencies or telecallers, put expectations in writing and ask them to delete files after the campaign. Keep a copy of the agreement.

Handling Requests From Data Principals

The Act gives people rights over their data, including access to a summary of what you hold, correction and erasure, and a way to raise grievances. Under the Rules, you should have a clear, easy way for people to make these requests. A small education business can keep this simple:

1. Publish a contact email and phone number for privacy requests on your website and forms.
2. Name one person who receives and tracks every request.
3. Reply in writing, confirm what you did and keep a record of the date.
4. Apply deletions and opt-outs to every tool, including backups and agency files where possible.
5. Review the log every month to find patterns, such as many requests from one campaign.

Speed and honesty matter here. A fast, polite reply turns a potential complaint into a trust moment.

Frequently Asked Questions

Does the DPDP Act apply to small businesses and coaching institutes?

The Act applies to organisations that process digital personal data in India, regardless of size, subject to exemptions and special rules for certain categories of entities. Smaller businesses should still follow the consent, notice and security duties and watch for guidance that may ease some requirements.

Is it illegal to buy a lead database in India?

The Act does not ban buying lead data, but you remain responsible for lawful use. You need a valid basis for processing, such as consent, and you must handle opt-outs, children’s data and security properly. Take legal advice for your specific campaign.

When do the main DPDP duties start?

The DPDP Rules, 2025 were notified on 14 November 2025. Consent Manager registration begins after 12 months, and most substantive obligations apply after 18 months, which is around mid-May 2027. Check official notices for the latest dates.

What counts as valid consent under the DPDP Act?

Consent must be free, specific, informed, unconditional and unambiguous, and shown by a clear affirmative action. A person must be able to withdraw it as easily as it was given.

Can I market to Class 12 students?

Many Class 12 students are under 18. The Act requires verifiable parental consent before processing a child’s data and bars tracking or targeted advertising directed at children. Aim your outreach at parents or guardians and take legal advice.

What should I do right now to prepare?

Map your data, record where each file came from, update forms and notices, build one suppression list for opt-outs, secure your files and review your vendor agreements.

Sources and Further Reading

• MeitY (Government of India) – DPDP Act and Rules
• PIB: DPDP Rules, 2025 notified – official government overview of the Rules
• Press Information Bureau – official press releases on the DPDP Rules