Under the DPDP Act, sending marketing messages to individuals generally needs their consent, collected through a separate unticked opt-in with an easy way to withdraw (such as an unsubscribe link). A person who sends an enquiry can be contacted about that enquiry without separate consent, as a legitimate use. Bought or scraped lead lists are risky because the seller's consent rarely covers your use. Calls and SMS must also follow TRAI's commercial communication (DND) rules.
- Promotional messages
- Need consent (opt-in)
- Replying to an enquiry
- Legitimate use (Section 7(a))
- Bought lead lists
- High risk
- Calls and SMS
- Also TRAI TCCCPR, 2018
Inbound leads
- Someone who fills in an enquiry form can be called or emailed about that enquiry: they gave the data for that purpose.
- To add them to newsletters or offers, ask with a separate unticked box: '☐ Send me updates and offers'.
- Record the consent (date, form, notice version) and honour unsubscribes quickly.
Outbound and B2B
- A business contact's name, work email and mobile are personal data, so B2B outreach is covered too.
- Contact details a person made public themselves (for example on their own website or professional profile, for business contact) are outside the Act, but confirm how they were published and keep messages relevant and easy to opt out of.
- Bought databases: ask the seller for proof of consent covering your purpose. If they cannot show it, do not use the list.
- Every message should identify you and offer a one-click opt-out.
WhatsApp, SMS and calls
WhatsApp Business policy already requires an opt-in before you message someone. Promotional calls and SMS are also governed by TRAI's Telecom Commercial Communications Customer Preference Regulations, 2018 (DND registry, registered headers and templates, 140-series numbers for promotional calls). The DPDP Act adds to these rules; it does not replace them.
Existing email lists
For lists built before the Act, send a notice explaining what you hold and why, with an easy opt-out (Section 5(2)), or run a re-permission campaign asking people to confirm they want to stay subscribed.
Frequently asked questions
Can I send cold emails under the DPDP Act?
Cold email to individuals is risky without a lawful ground. Data the person made public themselves is outside the Act, but keep messages relevant to their role, identify yourself and offer an easy opt-out. Bought lists without provable consent should not be used.
Do I need consent to call someone who filled an enquiry form?
No separate consent is needed to respond to their enquiry, as they gave the data for that purpose (a legitimate use under Section 7(a)). Marketing them for other products needs consent.
Is an unsubscribe link enough under DPDP?
It covers withdrawal of consent, which must be as easy as giving it. You still need a valid opt-in to start with, and you must stop processing and erase the data for that purpose after withdrawal.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.