Key DPDP dates and a simple checklist for lead forms, WhatsApp and email marketing.
Key takeaways
- The DPDP Rules 2025 were notified in November 2025 and apply in phases.
- Most business obligations and penalties apply from 13 May 2027.
- Lead forms need a clear notice and a clear, unticked consent step for marketing.
- Send marketing messages only to people who agreed, with an easy opt-out.
- Penalties can reach ₹250 crore for failing to protect data.
This article is general information, not legal advice. For your specific situation, please consult a qualified lawyer.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's main law on personal data. It applies to businesses (called "data fiduciaries") that collect digital personal data such as names, phone numbers and email addresses. The Digital Personal Data Protection Rules, 2025, notified in November 2025, explain how it works in practice.
That includes a small business with an enquiry form on its website, a Facebook lead ad or a WhatsApp list of customers.
Key dates to know
- November 2025: the Rules were notified and the provisions setting up the Data Protection Board took effect.
- November 2026: provisions on consent managers begin to apply.
- 13 May 2027: most business obligations, including notice, consent, security, breach reporting and penalties, apply.
There is time, but changing forms and processes takes a while. Starting now avoids a last-minute rush.
What it means for your lead forms
Give a clear notice
Next to the form, explain in simple words what data you collect, why you collect it and how people can withdraw consent or contact you. Link to an updated privacy policy.
Take clear, specific consent
The Act requires consent to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. In practice, use an unticked checkbox for marketing messages, separate from what is needed to reply to the enquiry itself.
Collect only what you need
If you only need a name and phone number to call back, do not ask for date of birth or address. Less data means less risk.
Make withdrawal easy
People must be able to withdraw consent as easily as they gave it. A "reply STOP" option on WhatsApp or an unsubscribe link in email is a simple start.
What it means for WhatsApp and email marketing
- Send promotional messages only to people who agreed to receive them.
- Record when and how each person gave consent.
- Honour opt-outs quickly and remove those contacts from future campaigns.
- Do not buy or use purchased contact lists.
Security, retention and breaches
Keep lead data in secure tools with strong passwords and two-factor login, give access only to staff who need it, and delete data you no longer need for its purpose. If a personal data breach happens, you must inform the Data Protection Board and the affected people.
Children's data
If you collect data from anyone under 18, for example for a coaching institute or kids' classes, you need verifiable consent from a parent or guardian. The Act also bars tracking, behavioural monitoring and targeted advertising directed at children.
A simple DPDP checklist for small businesses
- List every place you collect personal data: forms, ads, WhatsApp and billing.
- Add a short notice and an unticked marketing consent checkbox to each form.
- Update your privacy policy with contact details for data questions.
- Keep a record of consent for marketing contacts.
- Set up an easy opt-out on WhatsApp and email.
- Secure your tools with two-factor login and limit staff access.
- Decide how long you keep leads and delete old data on schedule.
- Write down what you will do if data is leaked.
Penalties under the Act are serious: up to ₹250 crore for failing to take reasonable security safeguards. If you want help reviewing your website forms and lead flow, start with our free audit.
Elite Growth Marketing is a digital marketing agency based in Madangir, New Delhi, working with local businesses across Delhi. Want a second opinion on your website and Google profile? Start with a free audit.
Sources
- Uniqus: Digital Personal Data Protection Act timelines
- Ministry of Electronics and Information Technology (MeitY)
Frequently Asked Questions
Does the DPDP Act apply to small businesses?
Yes. It applies to any business that collects digital personal data, including small businesses with website forms, lead ads or WhatsApp customer lists.
When do DPDP obligations start for businesses?
The Rules were notified in November 2025 and apply in phases. Most obligations, including notice, consent and penalties, apply from 13 May 2027.
Do I need a consent checkbox on my contact form?
A clear notice and a clear consent step are needed. For marketing messages, use a separate, unticked checkbox so people can choose freely.
Can I send WhatsApp offers to my customers?
Send promotional messages only to people who agreed to receive them, keep a record of that consent and offer an easy way to opt out.
What is the penalty under the DPDP Act?
Penalties depend on the breach. The highest, up to ₹250 crore, applies to failing to take reasonable security safeguards.
Want this handled for you?
We help businesses like yours plan and run digital marketing that actually shows up in results — not just activity.