Marketing under the DPDP Act: WhatsApp, SMS, email and lead lists

Indian marketing runs on phone numbers. WhatsApp campaigns, bulk SMS and email newsletters reach millions of people every day, often using lists of uncertain origin. The DPDP Act changes the rules.

Marketing needs consent

There’s no legitimate-use ground for marketing in section 7. In practice, sending promotional messages to individuals means you need consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action.

That means:

• A separate, unticked checkbox for marketing at sign-up or checkout.
• A specific purpose: “Send me offers on WhatsApp”, not “I agree to receive communications”.
• No making the purchase conditional on agreeing to marketing.

“They gave us their number at checkout”

The “voluntarily provided” ground in section 7(a) covers the purpose the person gave the data for, such as a delivery update or a payment receipt. It doesn’t extend to marketing. The Act’s own example is a pharmacy using a phone number to send a payment receipt, nothing more.

Bought and rented lists

A purchased database comes with no valid consent for your purpose. Using it exposes you to complaints and penalties. If a vendor claims “consented data”, ask for proof: the notice shown, the purpose, the date, and whether your brand was named. Most can’t provide it.

The TRAI rules still apply

The DPDP Act sits alongside the TRAI regulations on unsolicited commercial communication, the DLT registration system and the Do Not Disturb registry. Complying with one doesn’t satisfy the other. You need both.

Withdrawal must be easy

Every message should carry an easy way out: “Reply STOP”, an unsubscribe link, or a preference centre. Withdrawal must be as easy as consent, and must reach every agency and platform sending on your behalf.

Proof

If a customer complains, you must prove consent (section 6(10)). Keep:

• the version of the notice and checkbox text shown,
• the date, time and channel of consent,
• the purposes agreed to, and
• any later withdrawal.

Agencies and platforms

Your marketing agency, CRM, email platform and WhatsApp Business provider are processors. They need contracts, and they mustn’t use your customer lists for their own purposes.

A lawful campaign in six steps

1. Collect opt-ins with separate, unticked boxes and a clear notice.
2. Record each consent with purpose and timestamp.
3. Check DND and TRAI requirements for SMS and calls.
4. Send only to opted-in contacts, only for the purposes they chose.
5. Include an easy opt-out in every message.
6. Sync opt-outs to every tool within a short, fixed time.

Go deeper

Our courses include a marketing consent clinic with real examples. Browse the courses.

This article is for education and is not legal advice.