Quick Answer
Marketing teams are the primary drivers of consent-based data collection under the DPDP Act 2023 — every email campaign, lead magnet, webinar registration, and loyalty programme must have a valid consent mechanism and privacy notice. Consent for marketing cannot be bundled with service terms and must allow granular opt-out per communication type. Marketing databases built before the DPDP Act must be re-consented before use.
Quick AnswerMarketing teams must audit every consent touchpoint, implement granular opt-ins for each channel, review all marketing tech stack integrations, and stop processing personal data of users who withdraw consent.
DPDP Compliance Checklist
- Audit all marketing consent: website forms, checkout opt-ins, event registrations, purchased lists
- Delete or re-consent all marketing lists older than 12 months — stale consent is non-compliant
- Implement one-click unsubscribe for email, SMS, and WhatsApp channels
- Review all MarTech stack: CRM, email platform, CDP, analytics — ensure DPDP-compliant data processing
- Remove third-party data purchases from targeting — require consent provenance documentation
- Review cookie and pixel consent — separate toggles for analytics vs marketing
- Train marketing team: no more 'spray and pray' — only engaged, consented audiences
- Implement campaign DPDP review: check targeting audience and consent basis before every campaign launch
- Audit lookalike audience creation — source data must have ad consent
- Conduct monthly DPDP review of marketing database health
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Can marketing teams use customer purchase data for email campaigns?+
Only with explicit marketing consent. Transactional consent (checkout) does not extend to promotional emails. Separate opt-in is required.
Is purchased email data legal under DPDP?+
Purchased email lists are high-risk. You must verify that each contact on a purchased list has given consent to receive communications from your brand — not just from the original collector.
What happens if a customer unsubscribes under DPDP?+
You must stop processing their data for marketing purposes immediately. Continuing to send marketing after opt-out can attract penalties and damages claims.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
