DPDP Act and Rules: What Indian Marketers Must Change Before May 2027

Before 13 May 2027, Indian marketing teams must rebuild how they collect and use personal data: standalone, plain-language notices on every form; separate, unticked consent for each purpose; one-step withdrawal that reaches every tool; a consent log; contracts with agencies and vendors; retention limits; a 72-hour breach plan; and no tracking or targeted ads aimed at anyone under 18. Consent manager rules start earlier, on 13 November 2026. For a decade Indian marketing ran on loosely collected data (purchased lists, pre-ticked boxes, WhatsApp broadcasts to anyone whose number was captured). The Digital Personal Data Protection Act 2023 and its Rules end that. This guide explains what the law requires, when, and the specific changes to make now.

This article is general information, not legal advice.

What is the DPDP Act, and who does it apply to?

The DPDP Act is India's general data protection law. It applies to digital personal data about an identifiable individual, including data collected offline and later digitised, so almost every marketing team is covered.

• Data Principal: the person the data is about, such as your lead, customer or subscriber.
• Data Fiduciary: the organisation that decides why and how data is processed. If you run the campaign, that is you.
• Data Processor: anyone processing data on your behalf, such as your agency, CRM, email platform or WhatsApp provider. You remain responsible for what they do.
• Consent Manager: a registered entity that lets people give, manage, review and withdraw consent through one platform.

When do the DPDP Rules apply?

In three phases: Board provisions from 13 November 2025, consent manager rules from 13 November 2026, and the core obligations, including penalties, from 13 May 2027.

The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules 2025 on 13 November 2025, as SCC Online reported.

Three points to keep in view. First, in January 2026 MeitY proposed shortening the 18-month runway to 12 months, but as of October 2026 no Gazette amendment had been published and the date in law remained 13 May 2027, according to Privacy Labs. Second, the DPDP (Removal of Difficulties) Order, 2026, published in the Gazette on 7 October 2026, made wording corrections to Sections 9 and 10 that India Briefing describes as editorial rather than new obligations. Third, the Board is still being built: MeitY invited applications for its Chairperson and Members in May 2026, per Mondaq. Do not read a slow start as a reason to wait, and check the Gazette for later changes.

What changes for consent and notices?

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to necessary data. Rule 3 sets out what every notice must contain.

According to the text of Rule 3, a notice must be understandable on its own, in clear and plain language; itemise the personal data collected; state the specific purpose and the goods, services or uses it enables; and give a link to your website or app explaining how to withdraw consent (as easily as it was given), exercise rights and complain to the Board.

1. Unbundle consent. Separate "contact me about this enquiry" from "send me offers" and "share with partners". Never pre-tick.
2. Stop using purchased or scraped lists unless you can prove valid consent for your specific purpose, which in practice you rarely can.
3. Record consent. Store when, where, which notice version and which purposes, for every contact.
4. Make withdrawal one step. An unsubscribe link, a "STOP" keyword on WhatsApp, and a process that pushes the withdrawal to every tool and processor.
5. Collect less. If you do not need date of birth or full address for a webinar sign-up, do not ask.

WhatsApp has its own opt-in rules on top of this; our guide to building a WhatsApp AI chatbot in India covers how the two fit together.

Which marketing systems need to change?

Every place personal data enters or moves: forms, ad lead forms, WhatsApp, the CRM, email and SMS tools, pixels and audiences, and agency workflows.

What are consent managers, and do marketers need one?

Most businesses do not have to use one. But if a customer gives or withdraws consent through a registered consent manager, you must be able to receive and honour that signal.

Consent managers are India-incorporated entities registered with the Data Protection Board that let individuals manage consents across organisations. The First Schedule conditions include a minimum net worth of Rs 2 crore, as ComplianceHub summarises; it also notes the Board was not fully constituted as of August 2026, so registrations may take time. For most small and mid-sized businesses, sound consent management on your own website, app and WhatsApp flows is the practical starting point.

What are the rules for children's data?

Anyone under 18 is a child. You need verifiable parental consent, and you must not track, behaviourally monitor or target advertising at children, subject to narrow prescribed exemptions.

• Verifiable parental consent. Under Rule 10, confirm that consent comes from an identifiable adult parent, using reliable identity and age details you already hold, details the parent provides, a virtual token from an authorised entity, or details made available through a Digital Locker provider.
• No tracking or targeting. Section 9 prohibits tracking, behavioural monitoring and targeted advertising directed at children. Section 9(4) allows exemptions for prescribed classes of fiduciaries or purposes, subject to conditions.

For edtech, gaming, kids' retail and family brands, this is the biggest change. Audit every pixel, SDK and retargeting audience that could touch under-18 users, and redesign sign-up flows to identify minors and route them to parental consent. Penalties here reach Rs 200 crore.

What do the Rules require for security, breaches and retention?

Reasonable safeguards including encryption, access control and one year of logs; breach notice without delay and a full report within 72 hours; and erasure once the purpose is served.

• Security safeguards: Rule 6 lists encryption or masking, access controls, logging and monitoring, backups, processor contract clauses, and retention of logs and personal data for one year unless another law requires otherwise.
• Breach intimation: under Rule 7, tell affected people and the Board without delay, then send the Board a detailed report within 72 hours. Privacy Labs notes the often-quoted 6-hour clock comes from separate CERT-In directions, which apply in parallel.
• Erasure: delete data once the purpose is served, unless law requires retention. For e-commerce and social media intermediaries with 2 crore or more registered users and online gaming intermediaries with 50 lakh or more, the Third Schedule sets erasure after three years of inactivity, as Taxscan explains, and Rule 8 requires notice at least 48 hours before erasure.
• Processor contracts: your agency, CRM and messaging vendors must be bound to the same standards.

What are the penalties under the DPDP Act?

Up to Rs 250 crore for security failures, Rs 200 crore each for breach-notice and children's data failures, and Rs 50 crore for other breaches. The penalty provisions apply from 13 May 2027.

Figures are from the Schedule to the Act. The Board considers the nature, gravity and duration of a breach when setting amounts.

What should marketers do in the next six months?

Map data, fix notices and consent, clean lists, audit tracking for minors, set retention and rehearse a breach response, in that order.

1. Map every place you collect personal data: forms, landing pages, WhatsApp, events, QR codes, ad lead forms, offline registers.
2. List every tool and vendor that stores or processes it, and update contracts.
3. Rewrite notices to Rule 3 standards and unbundle consent checkboxes.
4. Build a consent log and a one-step withdrawal flow that syncs to all tools.
5. Re-permission or retire legacy lists with no consent record.
6. Audit tracking and ad audiences for under-18 exposure.
7. Set retention periods and automate deletion.
8. Write and rehearse a 72-hour breach response plan.

Common mistakes we see: treating the privacy policy page as the notice, letting agencies keep exported lead sheets indefinitely, and adding AI agents that collect more data than the form they replaced. If you are deploying assistants, read our guide to AI agents for Indian SMEs.

How we approach this at Old Port

We treat DPDP readiness as a systems project, not a policy rewrite. We start by mapping data flows from the first form fill to deletion, then fix the places where consent is captured and where it must travel, because a correct notice means little if withdrawal never reaches the email tool. We work alongside the client's legal adviser rather than replacing them. Server-side tracking and cleaner first-party data help; see our guides to server-side tracking and Conversions API and choosing a CRM in India. Our MarTech and automation and web development teams build consent-aware forms, CRMs and tracking. For brands also operating in the Gulf, our UAE web development team builds to the same privacy-first standard.