DPDP for Marketing Teams: Your Lead Lists, Pixels and Campaigns Are Now Regulated
Most marketing teams will meet the DPDP Act through a procurement email, not a regulator's notice.
It usually looks like this. A Thursday evening message lands from the legal team of your biggest enterprise client. Attached is a vendor questionnaire. Question 22 reads: "Confirm that all personal data used in marketing communications to our employees was collected with valid consent under the DPDP Act, 2023. Attach evidence." Reply due Monday.
Your head of marketing opens the email platform and finds 300,000 contacts. Some came from webinars, some from an agency's "partner database", some from an event in 2019, and a few thousand from a spreadsheet nobody can trace. Legal asks Marketing for the consent records. Marketing asks Legal what a consent record is supposed to look like.
The campaign was excellent. The paperwork behind it did not exist.
This article is for the people who run those campaigns. You do not need to become a lawyer. You do need to know what the Act says about your daily work, where marketing teams get stuck, and what to fix first.
Marketing holds more personal data than almost any other function
Finance holds payroll. HR holds employee files. Marketing holds everyone: prospects who never bought, customers from a decade ago, event visitors, app users and people who clicked an ad once, across more tools and third parties, and with less documentation, than any other team.
The Digital Personal Data Protection Act, 2023 does not carve out marketing. It applies to digital personal data, and to non-digital data that is later digitised, which catches the paper form from your trade-show stand the day someone types it into a CRM. It applies to processing in India, and to processing outside India connected with offering goods or services to people in India. There is no turnover threshold and no headcount threshold.
Four words, marketing edition
Four terms carry almost every DPDP conversation.
The one that matters most is the second. Whoever decides why personal data is collected and how it is used is the Data Fiduciary. In marketing, that decision is made in a campaign brief. The brand is the Fiduciary. The agency, the email platform, the CRM and the messaging gateway are Processors, and under Section 8 the Fiduciary stays responsible for compliance even if a Processor fails. A Fiduciary may engage a Processor only under a valid contract. If your agency's contract says nothing about personal data, that is a gap, and it is yours.
The calendar: 195 days and a faster clock
The Act received assent on 11 August 2023. The DPDP Rules, 2025 were notified on 13 November 2025 and brought the Data Protection Board provisions into force. Rule 4, which covers Consent Managers, comes into force on 13 November 2026. The operational core, including notice, consent, security safeguards, breach reporting, retention, children's data and the rights of individuals, applies from 13 May 2027.
As of today that is 195 days. But the statutory date is the slower clock. Enterprise buyers, banks, platforms and agencies are already rewriting contracts and questionnaires around DPDP. The first time your marketing function is asked to prove compliance will probably be commercial, not regulatory.
What the Act actually says about the things you do every day
You can read the whole law, or you can read it through your campaign calendar. This table does the second.
| What marketing does | What the Act and Rules say | What it means in practice |
|---|---|---|
| Collects leads through forms, pop-ups, QR codes | Section 5 and Rule 3: notice with an itemised list of the data, the specific purpose, and a way to withdraw consent, to exercise rights and to complain to the Board | A notice per collection point, in plain language, not a link to page nine of the terms |
| Sends emails, WhatsApp and SMS | Section 6: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to what the purpose needs | No pre-ticked boxes. No marketing consent bundled into a purchase. Consent per purpose |
| Lets people opt out | Section 6(4): withdrawing consent must be as easy as giving it. Section 6(6): processing must stop within a reasonable time, and Processors must stop too | One click to subscribe means one click to leave, in every channel |
| Builds custom and lookalike audiences | Sections 8(1) and 8(2): the Fiduciary is responsible, and Processors need a contract. Section 11: people may ask who their data has been shared with | You must know, and be able to say, which platforms received which lists |
| Targets young audiences | Section 9: verifiable parental consent for anyone under 18, and no tracking, behavioural monitoring or targeted advertising directed at children | Treat any child-facing audience as a different regime |
| Keeps lists indefinitely | Section 8(7): erase data when consent is withdrawn or the purpose is no longer served, unless the law requires retention | A retention clock on every list |
| Suffers a leak | Section 8(5) and (6), Rules 6 and 7: reasonable safeguards, and intimation to the Board and each affected person, with a detailed report to the Board within 72 hours | A breach plan that includes your agency's laptop |
Section 7 lists narrow "legitimate uses", including data a person voluntarily provided for a specified purpose when they have not objected. We would not build a marketing programme on it. Treat consent as your default basis for promotional communication, and take advice before relying on anything else.
Consent, the way the Act means it
Marketers say "consent" and mean "a checkbox exists." The Act means something stricter. Under Section 6(10), the Data Fiduciary must be able to prove that notice was given and consent obtained in line with the law.
| Looks fine, fails in an audit | Holds up | |
|---|---|---|
| The checkbox | Pre-ticked "I agree to receive offers" | Unticked, separate from the terms of service |
| The wording | "Updates, partners and promotions" | "Email me product offers from [Brand]," with each purpose listed separately |
| The notice | Privacy policy linked in the footer | Itemised notice at the point of capture, in plain language, available in the languages of the Eighth Schedule |
| The record | A "subscribed" flag in the ESP | Timestamp, form version, notice version, source and IP stored against the person |
| Withdrawal | "Reply STOP" or email a mailbox nobody reads | One-click link in every message, with confirmation |
| Existing contacts | Assumed to have agreed years ago | Notice sent to legacy contacts, with withdrawal honoured at once |
On that last row, Section 5(2) gives legacy lists a workable path. For consent given before the Act commenced, you must give people notice as soon as reasonably practicable, and you may continue processing until they withdraw. That is not a free pass. If you cannot show where a record came from, you have no consent to carry forward.
Where the data actually lives
One lead can sit in all eight tools at once, and one withdrawal has to reach every one of them.
Seven real challenges, and why they are hard
1. The legacy list problem
Every marketing team has a database it is afraid to look at. The 2019 expo scans. The webinar list that was "exported from the old system". The agency file labelled "warm leads." Nobody remembers the notice shown, the checkbox ticked, or whether anyone ticked anything.
The Act does not care that the list has been profitable. It asks you to demonstrate lawful collection. Where you cannot, the choice is between re-permissioning the contacts and retiring them.
2. Pixels, SDKs and custom audiences
The Act does not mention cookies, but its definition of personal data covers any data about an individual who is identifiable by or in relation to that data. Advertising identifiers, hashed emails and device IDs linked to a person will often qualify. Every pixel on your site is a quiet data transfer to a third party. Every customer list you upload for a custom audience is a disclosure.
The hard part is the sprawl. Tags accumulate over years, installed by different people for different campaigns. A person's right of access under Section 11 includes the identities of those with whom their data has been shared, and you cannot answer that with a tag manager nobody has audited.
3. Agencies, freelancers and the "partner database"
Marketing outsources more personal data processing than any other function: lead-gen agencies, telecalling vendors, survey panels. Many of these relationships run on a purchase order and a brief. Anyone processing on your instructions needs a contract that addresses personal data. Then there is the "partner database": leads an agency says have "opted in" and sells to you. If consent was never captured for your brand and your purpose, you have inherited someone else's gap, and the burden of proof sits with you.
4. Children and targeted advertising
Section 9 treats anyone under 18 as a child and bars tracking, behavioural monitoring and targeted advertising directed at children. This is among the sharpest edges in the Act for marketers, because the penalty for breaching children's obligations sits among the highest in the Schedule.
Brands in education, gaming, fashion and entertainment know teenagers are part of their audience. The exemptions notified in the Rules are narrow and purpose-specific. They are not a marketing carve-out. The first step is unglamorous: find out whether your audiences, lookalike models or app users include minors, and how you would know.
5. Withdrawal that does not propagate
A person unsubscribes from email. Their number is still in the WhatsApp broadcast list, the dialer queue, the CRM nurture sequence and a custom audience on an ad platform. The Act requires that when consent is withdrawn, processing stops within a reasonable time and your Processors stop too.
It fails because each tool keeps its own suppression logic and nothing synchronises them.
| Channel | How withdrawal usually happens | Where it typically gets lost | Evidence the Act expects you to hold |
|---|---|---|---|
| Unsubscribe link | CRM sequences and segments built from older exports | Timestamped suppression record | |
| WhatsApp / SMS | "STOP" reply or DLT preference | Broadcast lists in agency tools | Opt-out log with source |
| Paid media | Nothing at all | Audiences refreshed from old exports | Audience refresh log |
| Website and app | Cookie banner toggle | Tags firing before the choice is honoured | Consent receipt per session |
6. Retention: lists that never die
Marketing data tends to be kept because it might be useful. The Act points the other way. Under Section 8(7), data should be erased once the purpose is served or consent is withdrawn. Certain large e-commerce, gaming and social media entities face a specific retention rule under the Rules, including notice before erasure, so check whether you fall into that category.
A marketing retention schedule is simple: how long a cold lead stays, how long a lapsed customer stays, how long event data stays. The difficulty is enforcement across the CRM, the ESP, the warehouse and the agency's folders.
7. Campaign speed versus governance
Campaigns run on deadlines of days. Compliance reviews run on deadlines of weeks. A landing page goes live on Tuesday with a form copied from the last one. A new tool is trialled on a free plan with real customer data.
Under Section 38 the Act applies alongside other laws, and prevails where they conflict. Telecom commercial communication rules and DLT registration do not disappear. They now sit on top of a consent regime you must be able to evidence. The fix is not slowing down. It is making the compliant route the fast one: pre-approved form patterns, a standing notice template, a ten-minute tool-approval checklist.
What is at stake
.png)
The Schedule to the Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach and for breaching children's obligations, and up to ₹50 crore for any other breach. The Board sets the actual amount after weighing the nature, gravity and duration of the breach and the steps taken to mitigate it.
Most marketing failures will sit in the lowest tier: bad notice, weak consent, ignored withdrawal. The highest tier is where an unprotected export or a leaked list lands. Both are fixable with discipline you can start this quarter.
A 90-day plan for a marketing team
You will not be finished in 90 days. You will be defensible, which is what a buyer, an auditor or the Board will ask you to demonstrate. Fix collection before cleaning history, so the problem stops growing while you work through the backlog, and keep the evidence as you go. The team that builds its evidence folder continuously spends days on an audit. The team that assembles it the week before spends weeks, and it shows.
How VaultDef can help marketing teams
Marketing teams do not lack intent. They lack a way to see all their data at once and to prove, with dated records, that they handled it properly. That is the gap VaultDef is built to close. Mapped to the challenges above:
| Marketing challenge | What VaultDef provides |
|---|---|
| "We don't know what we hold or where" | Automated data discovery and classification across systems, so shadow exports and forgotten lists surface |
| "We can't show how a list was built" | RoPA and data mapping that record purpose, source, storage and sharing for each activity |
| "Our consent is a checkbox" | Consent and notice management with versioned notices and timestamped, per-purpose consent records |
| "Pixels and cookies are a free-for-all" | Cookie consent management and tracking of which tags and third parties receive data |
| "Unsubscribes don't travel" | Data principal rights workflows, so a withdrawal or erasure request is logged, assigned and tracked to completion |
| "Agencies are a black box" | Vendor and cross-border tracking, so processors, their contracts and the location of data are recorded in one place |
| "A leak would be chaos" | A breach workflow built around the 72-hour reporting window |
| "Prove it" | A tamper-evident evidence trail, so the answer to a questionnaire is a folder you open, not a fire drill |
VaultDef is built by practitioners with hands-on experience across offensive security, defensive security and compliance, including RBI and CERT-In regimes. The design principle is simple: compliance work should produce evidence as a by-product, not as a last-minute project.
Software does not replace ownership. Someone in marketing must still decide purposes, approve notices and chase agencies. A platform makes that work visible, repeatable and provable at the scale your stack operates at. Process first, tooling to sustain it.
Frequently asked questions
Does the DPDP Act apply to B2B marketing?
Yes. A business contact's name, work email and phone number are personal data about an individual. The fact that you are selling to their employer does not change that.
Can we keep emailing our existing customers?
You can continue processing legacy data under Section 5(2) until a person withdraws consent, but you must give notice as soon as reasonably practicable, and you should be able to evidence where each record came from.
Who is liable when an agency makes a mistake?
Under Section 8, the Data Fiduciary stays responsible for compliance, irrespective of any agreement or any failure by a Processor. Contracts help you recover costs. They do not transfer your obligations.
