Sales teams process personal data every day — prospect names, emails, phone numbers, meeting notes — and that processing is covered by India's DPDP Act 2023. Purchased lists, scraped contacts and data used for purposes the prospect never agreed to are the highest-risk practices, because they often lack any lawful basis. This guide checks how your sales team sources, consents for, and stores prospect data, and returns the specific practices to fix so your pipeline is built on personal data you can actually justify holding.
Every lead in your CRM is personal data under the DPDP Act. Check how your team sources, consents for, and stores prospect data — and what to fix.
It is a common misconception in sales that B2B contact data is somehow outside data-protection law because it relates to a work role. Under India's DPDP Act 2023, personal data means data about an identifiable individual, and a named prospect's business email, phone number and the notes your team keeps on them are exactly that. The Act governs the processing of personal data regardless of whether the relationship is B2B or B2C, so a sales pipeline is a collection of personal data that the company, as data fiduciary, must be able to justify holding and using.
This does not mean B2B outreach is banned or that every prospect must formally consent before you can ever contact them — that would be an over-reading. It means the highest-risk practices are the ones to fix: buying or scraping lists where there is no lawful basis for your use, collecting data with no stated purpose, storing it loosely across personal devices, and having no way for a prospect to be removed. Those are the practices hardest to defend, and the easiest to correct.
The most durable fix is to shift the centre of gravity of your lead generation toward first-party sources — inbound, opt-ins, events and referrals where the prospect gave you their details in a context they understood — and to be clear about purpose at the point of collection. Combined with a secured CRM, minimisation, and a reliable opt-out and deletion path, this gives you a pipeline built on personal data you can account for, rather than one that becomes a liability the moment a prospect complains or a diligence team asks.
Niti Bharat helps Indian sales and revenue teams put their prospect-data practices on a compliant footing without killing pipeline — reviewing lead sources, tightening CRM access, and building the opt-out and record-keeping that the DPDP Act expects. Our fixed-price DPDP engagements are designed so that data protection becomes a trust signal in your sales process rather than a risk buried in your CRM ahead of May 2027 enforcement.
A practical checklist for sales leaders — lead-source hygiene, purpose statements, CRM access, minimisation and opt-out handling — to make your pipeline defensible under the DPDP Act.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
