India's data protection law is about to change how every lead form, WhatsApp list and customer upload works. The core obligations start in about six months. Here's what the Rules actually say, and a checklist to get your marketing ready.
The DPDP Rules, 2025 were published on 13 November 2025, with the core duties applying 18 months later, around 13 May 2027. For marketers, that means standalone consent notices, withdrawal as easy as consent, minimum security safeguards, breach reports to the Data Protection Board within 72 hours, no targeted advertising at under-18s, and answering data requests within 90 days. Penalties reach up to ₹250 crore.
- The core DPDP duties apply around 13 May 2027, 18 months after the Rules were published on 13 November 2025.
- Consent must be free, specific, informed and unambiguous, and withdrawing it must be as easy as giving it.
- Breaches must be reported to affected people without delay and to the Data Protection Board in detail within 72 hours.
- The Act bars targeted advertising directed at children (under 18); education and health exemptions don't cover advertising.
- Penalties reach ₹250 crore for weak security safeguards and ₹200 crore for breach-notice or children's-data failures.
What are the DPDP Rules, and when do they bite?
The Digital Personal Data Protection Rules, 2025 put India's Digital Personal Data Protection Act, 2023 into operation. They were published in the Gazette on 13 November 2025 and announced the next day, after consultations in seven cities that drew 6,915 inputs (PIB).
They don't all start at once. The Rules and a separate enforcement notification set out three phases (DPDP Rules, Rule 1; enforcement notification):
| Phase | When | What starts |
|---|---|---|
| 1 | 13 November 2025 | Definitions, the Data Protection Board of India and its procedures |
| 2 | One year later, around 13 November 2026 | Registration and obligations of consent managers |
| 3 | Eighteen months later, around 13 May 2027 | The core duties: notices, consent, security, breach reporting, erasure, children's data, rights and penalties |
So the obligations that change how marketing works land in about six months. That sounds like plenty of time. It isn't, if your leads are spread across forms, spreadsheets, WhatsApp phones, agency tools and three CRMs.
Why marketers should care
Marketing runs on personal data: names, phone numbers, emails, enquiries, browsing behaviour and purchase history. Lead forms, WhatsApp opt-ins, CRM records, retargeting audiences and customer list uploads all involve it. Under the Act, your business is the Data Fiduciary: the one that decides why and how data is processed, and the one that's accountable, even when an agency or software vendor does the processing for you.
The penalties are set out in the Act (PIB backgrounder):
Maximum penalties under the DPDP Act, 2023
The rules that matter most for marketing
Consent has to be real
The Act says consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the data needed for the stated purpose (DPDP Act, section 6). Pre-ticked boxes, bundled consent ("by submitting you agree to everything") and consent buried in terms and conditions don't fit that description.
Notices have to stand on their own
Rule 3 says the notice must be understandable independently of any other information you've provided. It must give an itemised description of the personal data and the specific purpose, including the goods or services involved, and explain how people can withdraw consent, exercise their rights and complain to the Board. Withdrawing consent must be as easy as giving it (DPDP Rules, Rule 3).
Security has a minimum
Rule 6 lists the minimum safeguards: encryption, masking or tokenisation; access controls; logs and monitoring of access; backups; and contracts with processors that require safeguards too. Logs must be kept for at least a year (DPDP Rules, Rule 6). For marketing, the weak points are usually spreadsheets of leads, shared logins and ex-employees or ex-agencies who still have CRM access.
Breaches have a deadline
If personal data is breached, you must tell affected people without delay, in plain language, and tell the Data Protection Board. The detailed report to the Board is due within 72 hours of becoming aware of the breach (DPDP Rules, Rule 7).
Children are off-limits for targeting
Processing a child's data needs verifiable consent from a parent, and the Act bars tracking or behavioural monitoring of children and targeted advertising directed at them (DPDP Act, section 9). A child here means anyone under 18. The Rules exempt educational institutions only for tracking and monitoring for their educational activities or for children's safety, and healthcare providers only for providing health services (DPDP Rules, Fourth Schedule). Neither exemption covers advertising. For schools, coaching institutes and edtech brands whose audience includes under-18s, this changes targeting.
People can ask for their data back
People can access, correct, update or erase their data and nominate someone to act for them. Requests must be handled within a reasonable period of no more than 90 days, and you must publish contact details for a person who can answer questions about your processing (DPDP Rules, Rules 9 and 14).
A marketer's DPDP checklist
- Map your data. List every place you collect personal data (website forms, ad lead forms, WhatsApp, calls, walk-ins, events) and every place it's stored (CRM, spreadsheets, email tools, agency systems, staff phones).
- Rewrite your consent notices. One clear notice per form: what you collect, why, and how to withdraw. No pre-ticked boxes.
- Separate the purposes. Replying to an enquiry and adding someone to your promotional list are different purposes. Ask for each.
- Log consent. Record when, where and how each person consented, alongside their CRM record.
- Make opting out work. "STOP" on WhatsApp or "unsubscribe" in email should actually stop messages, everywhere, and be recorded.
- Lock down access. Remove access for people and agencies who've left, end shared logins, limit who can export lists.
- Check your processors. Agencies, CRMs, call centres and lead vendors process data on your behalf. Put data protection terms in every contract.
- Review audience uploads. Customer lists uploaded to Google or Meta for targeting or measurement need a lawful basis and a notice that covers that use.
- Stop targeting minors. Exclude under-18s from targeted and behavioural campaigns, and route any campaign aimed at parents through parental consent where you collect children's data.
- Set retention rules. Decide how long you keep old leads, and delete what you don't need.
- Prepare a breach plan. Who decides, who tells customers, who reports to the Board within 72 hours.
- Publish a contact. Name a person or officer who handles data questions and requests.
The ownership problem hiding inside DPDP
Here's what many businesses discover when they start mapping data: they can't see half of it. Leads sit in an agency's form tool, a freelancer's spreadsheet or a vendor's CRM. Yet the business is accountable for all of it.
That's why DPDP readiness and marketing ownership are the same project. If your company owns the CRM, the ad accounts and the lead forms, you can control access, honour withdrawals and answer a request within 90 days. If someone else holds them, you're accountable for data you can't reach. Our 10-point ownership audit is a good place to start.
A coaching institute runs Instagram lead ads targeting students aged 15 to 18, collects numbers through an agency's form tool, and adds every enquiry to a WhatsApp promotional list. Nobody can say who has access to the spreadsheet of past enquiries.
A DPDP-ready version targets parents rather than students, moves the forms into the institute's own CRM with a clear notice and separate consent for promotions, makes "STOP" work on WhatsApp, removes the agency's export access, and sets a rule to delete cold enquiries after a fixed period.
Data protection also shapes how you measure: see how to report revenue, not reach. And for the advertising rules that apply on top of DPDP, read ASCI's rules for admission ads and NMC's guidelines for hospitals and doctors.
This is general information, not legal advice. Check the Act and Rules and take advice on your specific situation.
How Ad Asthra helps you get DPDP-ready
DPDP readiness starts with owning your marketing data. We help you get it back, lock it down and keep it clean.
Frequently asked questions
When do the DPDP Rules come into force?
In phases. The Rules were published on 13 November 2025. Consent manager provisions apply after one year, around 13 November 2026, and the core obligations on notices, consent, security, breaches, children's data and rights apply after 18 months, around 13 May 2027.
What must a DPDP consent notice include?
Under Rule 3, it must stand on its own and give an itemised description of the personal data, the specific purpose and the goods or services involved, plus how to withdraw consent, exercise rights and complain to the Data Protection Board.
Can I still run lead generation ads under DPDP?
Yes, with valid consent. Explain clearly what you collect and why, ask separately for promotional use, record consent, and make opting out as easy as opting in.
Can I target students under 18 with ads?
No. The DPDP Act bars tracking or behavioural monitoring of children and targeted advertising directed at them. Exemptions for educational institutions cover only educational activities and safety, not advertising.
What happens if leads are leaked?
You must inform affected people without delay in plain language and notify the Data Protection Board, with a detailed report within 72 hours of becoming aware of the breach.
Is my business responsible if my agency mishandles our leads?
Yes. Your business is the Data Fiduciary and remains accountable for processing done on its behalf, so put data protection terms in agency and vendor contracts and control their access.
What are the penalties under DPDP?
Up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for failing to report a breach or for breaking children's data obligations, and up to ₹50 crore for other violations.
How does Ad Asthra help with DPDP readiness?
Our Advisory & Governance audit finds where your marketing data lives and who can access it, and our Enablement and AI Suite work moves forms, CRM and data into your own accounts with consent built in.
Sources
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), Ministry of Electronics and Information Technology, Gazette of India, 13 November 2025
- Notification on enforcement of the DPDP Act, 2023 (G.S.R. 843(E)), Ministry of Electronics and Information Technology, Gazette of India, 13 November 2025
- DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use, Press Information Bureau, Government of India, 17 November 2025
- Government notifies DPDP Rules to empower citizens and protect privacy, Press Information Bureau, Government of India, 14 November 2025
- The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), India Code, Government of India, 11 August 2023
Last updated