DPDP Rules for Indian Marketing Teams: Consent, Pixels, CRM and WhatsApp Checklist
Abhishek Dwivedi
Team Lead, SEO
India’s Digital Personal Data Protection framework changes how marketing teams should document collection, consent, sharing, retention and customer rights. Compliance is not a single cookie banner. It requires a defensible data map across websites, advertising pixels, lead forms, CRM systems, call centres, agencies and WhatsApp workflows. This operational guide is general information and should be reviewed with qualified legal counsel for your organisation.
Start with the phased commencement dates
The DPDP Act and Rules do not all commence on one date. Government notifications dated 13 November 2025 brought some institutional and procedural provisions into force immediately. Many core operational obligations commence on 13 May 2027, eighteen months after notification. Teams should map each obligation to its effective date rather than using a single generic deadline.
Maintain a legal tracker owned by counsel or the privacy function. Marketing should translate that tracker into system, vendor and campaign changes with accountable owners and evidence of completion.
Build a marketing data inventory
List every collection point: website forms, ecommerce checkout, advertising pixels, analytics tags, chat, call recordings, events, offline lists, CRM imports, customer-support tools and messaging platforms. For each, record the data fields, purpose, source, permitted ground under the Act—such as consent or an applicable legitimate use—processors, destinations, retention period and deletion method.
Map data exported to agencies and ad platforms as carefully as data stored internally. Remove fields that are not needed for the stated purpose. Identify old spreadsheets, downloaded lead lists and duplicate audiences that sit outside normal access controls.
Make notices and consent specific
A notice should help the individual understand what personal data is collected and why, how to exercise rights and how to withdraw consent when consent is used. Avoid bundling unrelated marketing purposes into one vague acceptance. Keep records showing the notice version, timestamp, source and action that produced the consent.
Withdrawal should be as practical as giving consent. Connect unsubscribe and preference changes across email, CRM, advertising audiences and messaging workflows so suppression does not depend on one employee remembering a manual task.
Audit pixels, server-side events and CRM activation
Document every tag and server-side event, including the event name, fields sent, hashing, destination and business purpose. Do not assume hashing makes personal data anonymous. Apply data minimisation before information leaves the controlled system, and restrict access to event datasets and audience exports.
For CRM audience activation, establish approved field mappings, upload procedures, match-quality monitoring, retention and deletion processes. Contracts and processor instructions should reflect the actual data flow, including agencies, customer-data platforms and automation vendors.
Review WhatsApp and lead-management workflows
Separate service messages from promotional messaging and preserve the source and scope of opt-in. Define templates, frequency limits, quiet periods, escalation and opt-out handling. When leads move from ads to WhatsApp or a call centre, carry the relevant notice and preference state into the destination system.
Train sales and support teams not to reuse contact details for unrelated campaigns. Apply role-based access, export restrictions and deletion procedures to CRM and messaging tools, including test accounts and archived automation journeys.
Create an evidence-based readiness programme
Prioritise high-volume and high-risk flows, assign owners, update notices and contracts, test consent and withdrawal, minimise payloads, define retention and rehearse incident escalation. Keep screenshots, configuration records, vendor instructions, test results and approval logs as evidence.
Use the official DPDP Rules notification and the separate commencement notification as primary sources. Obtain legal advice for sector-specific duties and final interpretations.
Like what you're reading?
Get a free marketing plan tailored to your brand
Get Your Free Planyes, actually free. we're not kidding.
Key Takeaways
- Track the phased commencement dates for each obligation.
- Inventory every marketing collection and sharing pathway.
- Use specific notices and preserve consent evidence.
- Audit pixels, CAPI payloads, CRM exports and agency access.
- Connect withdrawal and suppression across every channel.
the TL;DR your boss will love
This Isn't Just Theory. We Do This Daily.
Let us show you exactly what we'd do for your brand - strategy, channels, budget, timeline. Free. No pitch deck.
Get Smarter Every Week
Ideas, data, and the occasional hot take. Biweekly, no spam.
we promise not to sell your email to robots
You Might Also Dig These
^ we picked these just for you (okay, the algorithm did)
Google's October 2026 AI Content Guidance: SEO and E-E-A-T Checklist
Google updated its guidance on generative AI content on 1 October 2026, aligning the documentation more closely with its Search Quality Rater Guidelines. The update does not create a special ranking system for AI-written pages. It sharpens the standard that matters: content should serve a clear audience, demonstrate real expertise and make factual claims easy to verify. For Indian marketing teams using AI at scale, the operational question is no longer whether AI may be used. It is whether every published page adds original value, accountable authorship and dependable evidence.
ReadIndia Festive Commerce Playbook 2026: D2C, Quick Commerce and Always-On Growth
India’s festive season remains a major commercial opportunity, but e-commerce demand is no longer limited to a few sale events. NIQ describes a market shaped by both habitual purchases and event-driven peaks, while Meta points to video-first discovery, creators and messaging-led commerce. A useful festive plan connects demand forecasting, channel roles, creative and customer experience from discovery through repeat purchase.
ReadUltimate Guide to AI-First Agency Month: Optimize Performance Marketing ROI Amid Rising Ad Costs in India
Struggling to keep up with rising ad costs and ever-changing Google and Meta algorithms? Indian marketers, startups, and D2C brands are feeling the pressure to scale smarter - not harder. Ready to cut through the noise and supercharge your performance marketing ROI? This guide reveals AI-first strategies, proprietary tools, and proven tactics to help you stay ahead and win big in India’s digital market.
Read