DPDP Act Compliance Guide for Marketing & Data Leaders

By Vinay D · · 18 min read
DPDP Act Compliance Guide for Marketing & Data Leaders

Short answer: India's Digital Personal Data Protection Act, 2023 applies to any organisation processing the digital personal data of people in India, including foreign brands selling into India. Its main obligations start on 13 May 2027. Because the Act has no "legitimate interests" ground, attribution, retargeting, audience building and lookalikes need the customer's consent. Withdrawal must stop processing by you and your vendors, every breach must be reported to the Data Protection Board and to affected customers, and logs must be kept for at least a year. Penalties run up to ₹250 crore per category. For marketing and data teams, the work is less about the privacy policy and more about enforcing consent in the tags, pipelines and syncs that send data to Meta, Google, CRMs and warehouses.

India's Digital Personal Data Protection Act, 2023 has been law since August 2023, and its Rules were notified in November 2025. Most of the obligations that touch a marketing or data stack, however, switch on together on 13 May 2027. That leaves organisations with Indian customers roughly 200 days to make consent, security, retention and rights handling work in production, not just in policy documents.

For marketing and data leaders the hard part is not reading the Act. It is working out what the Act means for a purchase event that fans out to Meta CAPI, Google Ads, GA4, Klaviyo and a warehouse within a few hundred milliseconds. Policies are written by counsel; compliance is executed by tags, pipelines and sync jobs.

This guide sets out what the law requires, where things actually stand in October 2026, and what each obligation means for the systems you run. It closes with a phased action plan to May 2027.

What the DPDP Act is, and who it covers

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's first horizontal data protection law. It received assent on 11 August 2023. The Digital Personal Data Protection Rules, 2025 (G.S.R. 843(E)) were notified on 13 November 2025, with 23 rules and seven schedules that put the Act's obligations into operational detail.

The Act applies to digital personal data processed in India, and to personal data collected in non-digital form and later digitised. It also applies extraterritorially (s.3): processing outside India is covered where it is connected to offering goods or services to Data Principals in India. A US retailer shipping to Mumbai, a Singapore-hosted OTA selling Goa hotel rooms, or a global SaaS platform with Indian sign-ups is in scope.

A few boundaries matter. The Act does not cover personal data that the individual has made public themselves, or that is made public under a legal obligation (s.3(c)). There is no separate "sensitive" category of personal data: all personal data is treated alike, although sectoral regulators can and do add stricter rules. Section 17 provides exemptions for specified situations, such as enforcing legal rights, court functions, prevention and investigation of offences, certain processing in India of non-residents' data under contract with a foreign person, and research or statistical purposes meeting the Second Schedule standards.

The timeline: three phases, and where things stand in October 2026

The Rules commence in three phases. Understanding which phase you are in is the first step in DPDP Act compliance planning.

Phase Commencement What switches on
Phase 1 13 November 2025 Data Protection Board provisions (Act ss.18–26 and related), Rules 1, 2 and 17–21
Phase 2 13 November 2026 Consent Manager framework (Rule 4; Act s.6(9) and s.27(1)(d))
Phase 3 13 May 2027 Notice, consent, security, breach, retention and erasure, children, SDF duties, rights, cross-border transfers (s.16 / Rule 15), penalties (Rules 3, 5–16, 22, 23)

Some advisers cite 12 May 2027 for Phase 3. We use 13 May 2027 throughout. Until then, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 continue to apply.

Four developments shape the picture as of late October 2026:

  1. The Board exists but is not staffed. The Data Protection Board of India was established in law on 13 November 2025, with a Chairperson and up to four Members (s.19). MeitY invited applications on 6 May 2026 and advertised on 6 June 2026. No Chairperson or Members have yet been appointed. The Board is designed as a digital-by-design adjudicatory body, with appeals going to TDSAT.

  2. Consent Managers arrive on 13 November 2026. Registration of Consent Managers with the Board becomes possible from Phase 2. Whether registrations can be processed promptly will depend on the Board being constituted.

  3. The Removal of Difficulties Order is a drafting fix, not a deadline change. On 5 October 2026 the Central Government issued the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E), under s.43(1), gazetted 6 October 2026). It makes two word-level corrections: s.9(1) now clearly covers persons with disabilities who have a lawful guardian, and the periodic audit for Significant Data Fiduciaries under s.10(2)(c)(ii) is identified as a "data audit". It adds no new duty and moves no deadline.

  4. Timeline compression is proposed, not enacted. In January 2026 MeitY consulted industry on compressing timelines, including bringing SDF obligations forward to 12 months. As of October 2026, no instrument changing commencement dates has been issued. Plan for 13 May 2027, and treat any acceleration as a risk to monitor.

Key roles: who is who under DPDP

The Act's vocabulary differs from GDPR's, and the differences have practical consequences.

Role Definition Marketing-stack example
Data Principal The individual to whom the personal data relates A shopper, policyholder, app user or lead
Data Fiduciary Decides the purpose and means of processing The brand, bank, insurer or retailer
Data Processor Processes personal data on behalf of a fiduciary Server-side tracking vendor, CDP, ESP, cloud warehouse, call-centre BPO
Consent Manager Registered with the Board; lets principals give, manage and withdraw consent through an interoperable platform A third-party consent dashboard a principal chooses to use
Significant Data Fiduciary (SDF) A fiduciary notified by the Central Government based on volume, sensitivity and risk factors None notified as of 13 October 2026

Two points deserve emphasis. First, a fiduciary is liable for processing by its processors irrespective of any agreement to the contrary (s.8(1)), and may engage a processor only under a valid contract (s.8(2)). You cannot contract your way out of a vendor's failure to stop sending data after withdrawal.

Second, Consent Managers are optional for fiduciaries. Principals may choose to use one, and the framework sets demanding conditions: an Indian company with a minimum net worth of ₹2 crore, an interoperable platform, data-blind operation (it cannot read the personal data it routes), independent audits, and records of consents, notices and sharing kept for at least seven years. If a principal manages consent through one, your systems must honour signals arriving from it. We explain the difference between a registered Consent Manager and your CMP in DPDP Consent Manager: what it is and isn’t.

Grounds for processing, and why marketing measurement needs consent

DPDP permits processing on only two grounds: consent (s.6) or certain legitimate uses (s.7). There is no equivalent of GDPR's legitimate interests basis.

The s.7 legitimate uses are narrow. They include data voluntarily provided by the principal for a specified purpose where she has not indicated that she does not consent (s.7(a), for example giving a phone number to receive a receipt), State functions and benefits, legal obligations, court orders, medical emergencies, epidemics and disasters, and employment purposes.

None of these covers attribution, retargeting, audience building or lookalike modelling. If a customer gives you an email address to receive an order confirmation, s.7(a) may support sending that confirmation. It does not support hashing that email and sending it to Google Enhanced Conversions or a Meta Custom Audience. For those purposes, you need consent.

Consent under s.6(1) must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the data necessary for the specified purpose. Pre-ticked boxes, bundled "accept all to continue" walls and consent inferred from scrolling sit uneasily with that standard.

Core fiduciary obligations, mapped to the stack

The obligations below commence on 13 May 2027. For each, we set out what the law says and what it means in systems terms.

Notice (s.5, Rule 3)

The notice must be standalone, in clear and plain language, and give an itemised description of the personal data collected and the specific purposes, together with an itemised description of the goods or services enabled. It must explain how to withdraw consent, how to exercise rights and how to complain to the Board. Principals must have the option to read it in English or any language in the Eighth Schedule (s.5(3)).

For data collected under consent given before commencement, a notice is still required (s.5(2)). That means your existing CRM, loyalty base and email lists need a notice programme, not just new sign-ups.

In practice, your notice's purpose list becomes a specification. If the notice says "measuring ad performance" and "personalised advertising" as separate purposes, your tag and event routing must be able to distinguish them.

Consent and withdrawal (s.6)

Withdrawal must be as easy as giving consent (s.6(4)). After withdrawal, the fiduciary and its processors must stop processing within a reasonable time (s.6(6)).

This is where most marketing stacks are weakest. A consent management platform can record that a user withdrew. It does not, by itself, stop a server-side container forwarding the next purchase event to Meta CAPI, remove the user from a Klaviyo flow, or exclude them from tomorrow's warehouse-to-Google Ads audience sync. Withdrawal has to propagate to every destination that is processing the data.

Reasonable security safeguards (s.8(5), Rule 6)

Rule 6 lists the minimum measures: encryption, obfuscation, masking or tokenisation; access control; visibility through logs and monitoring; backups and continuity; retention of logs for at least one year; contractual safeguard clauses with processors; and appropriate technical and organisational measures.

The one-year log requirement is easy to underestimate. If you cannot show, a year later, which systems received a given principal's data and on what basis, you will struggle to demonstrate reasonable safeguards. Failure to take reasonable security safeguards to prevent a breach carries the Act's highest penalty, up to ₹250 crore.

Breach notification (s.8(6), Rule 7)

On becoming aware of a personal data breach, the fiduciary must intimate the Board without delay, then provide a detailed report within 72 hours (the Board may extend this). It must also inform each affected Data Principal without delay, in plain language, covering the nature of the breach, likely consequences, mitigation, steps they can take, and a contact point.

There is no materiality threshold. A misconfigured pixel leaking email addresses in URL parameters to an ad platform is a breach to assess under the same process as a database exfiltration.

Retention and erasure (s.8(7), Rule 8, Third Schedule)

Personal data must be erased once the purpose is no longer served or consent is withdrawn, unless law requires retention. The Third Schedule sets specific periods for three classes:

  • E-commerce entities with at least 2 crore registered users in India

  • Online gaming intermediaries with at least 50 lakh registered users in India

  • Social media intermediaries with at least 2 crore registered users in India

For these, data must be erased three years after the principal last approached the fiduciary or exercised rights, or after the Rules commenced, whichever is latest. The principal must receive 48 hours' notice before erasure. All fiduciaries must retain processing logs for at least one year for the purposes in the Seventh Schedule.

Erasure in a modern stack means more than deleting a CRM row. It includes warehouse tables, CDP profiles, ESP lists and audiences already uploaded to ad platforms.

Children's data (s.9, Rules 10–12, Fourth Schedule)

A child is anyone under 18. Processing a child's data requires verifiable consent of a parent or lawful guardian; following the October 2026 Order, this also clearly covers persons with disabilities who have a lawful guardian. Section 9(3) prohibits tracking or behavioural monitoring of children and targeted advertising directed at children, as well as any processing likely to cause a detrimental effect on a child's well-being.

The Fourth Schedule exempts certain classes (such as clinical establishments and healthcare professionals, educational institutions, and childcare providers) and purposes, strictly limited. For brands in education, gaming, fashion or FMCG with a young audience, the practical question is how to keep under-18 users out of pixels and audience pipelines entirely.

Data Principal rights (Chapter III, Rule 14)

Principals have the right to access a summary of their personal data and processing (s.11), to correction, completion, updating and erasure (s.12), to grievance redressal (s.13), and to nominate another person to act in the event of death or incapacity (s.14). Requests must be answered within a period not exceeding 90 days.

Fiduciaries must also publish the business contact information of a Data Protection Officer or other responsible person (s.8(9), Rule 9). The scale challenge is real for consumer brands.

Cross-border transfers (s.16, Rule 15)

Transfers outside India are permitted except to countries the Central Government restricts by notification, a negative-list approach. Rule 15 makes transfers subject to any requirements the Government may specify by order. Stricter sectoral laws, such as RBI's payment data storage requirements, continue to apply (s.16(2)).

There is no general localisation requirement. Localisation arises only under Rule 13(4) for notified SDFs, in respect of personal data the Government specifies on a committee's recommendation.

Significant Data Fiduciaries (s.10, Rule 13)

SDFs are notified by the Central Government based on factors including the volume and sensitivity of data, risk to principals' rights, sovereignty and integrity of India, electoral democracy, security of the State and public order. There is no automatic threshold, and none had been notified as of 13 October 2026.

If notified, an SDF must appoint a DPO based in India and responsible to its board, appoint an independent data auditor, carry out a DPIA and data audit every 12 months, furnish significant observations to the Board, and conduct due diligence that algorithmic software does not pose risks to principals' rights. Large banks, insurers, marketplaces and platforms should assume they may be candidates.

Penalties

Penalties are imposed by the Board under s.33 after an inquiry. They are fixed maximums per category, not a percentage of turnover.

Breach Maximum penalty
Failure to take reasonable security safeguards to prevent a breach (s.8(5)) ₹250 crore
Failure to notify the Board or affected principals of a breach (s.8(6)) ₹200 crore
Non-compliance with children's data obligations (s.9) ₹200 crore
Non-compliance with SDF additional obligations (s.10) ₹150 crore
Breach of a voluntary undertaking accepted by the Board (s.32) ₹50 crore
Breach of any other provision of the Act or Rules (e.g. notice, consent, rights) ₹50 crore
Breach of a Data Principal's duties (s.15) ₹10,000

In setting the amount, the Board weighs the nature, gravity and duration of the breach, the type of personal data, whether it is repetitive, gains made or losses avoided, mitigation steps, and proportionality. Because caps apply per category, a single incident can engage more than one line.

What DPDP means for each part of the stack

Most organisations already have a CMP. The gap is usually between where consent is recorded and where data is actually sent. The table below maps the obligations to the systems that execute them.

Stack layer Typical data flow Key DPDP exposure What good looks like by May 2027
Client-side tags and pixels Browser fires Meta Pixel, Google tags, TikTok pixel on page load Data leaves before consent is evaluated; hard to prove what was sent; risk of PII leaking in URLs Tags gated by purpose-specific consent; non-essential pixels removed or moved server-side
Server-side tracking Purchase event forwarded to Meta CAPI, Google Ads, GA4 Server-side can bypass the browser consent banner entirely if not governed Per-event, per-destination consent check; logs of what went where, kept at least one year
CDP Profiles unified; audiences built and activated Audiences built from data lacking consent for that purpose; withdrawn users remain in segments Consent state stored per purpose on the profile; withdrawal removes the profile from activation
Data warehouse Raw events land in Snowflake or BigQuery; reverse-ETL syncs out Indefinite retention; syncs to ad platforms without purpose check Retention schedules enforced; erasure jobs; syncs filtered on consent
CRM and ESP Leads from forms and call centres; Klaviyo or Salesforce flows Pre-commencement data needs a s.5(2) notice; withdrawal not propagated to flows Consent and notice version attached to each contact; suppression on withdrawal
Ad platforms Hashed emails and phones in Enhanced Conversions, Custom Audiences, lookalikes Matching and modelling are not s.7 legitimate uses; uploaded data is hard to recall Only consented identifiers sent; withdrawal and erasure pushed to audiences that received data

A word on hashing. Hashed emails and phone numbers are sent to ad platforms precisely so that they can be matched to individuals. The prudent working assumption is that they remain personal data for DPDP purposes, and that sending them needs a lawful ground.

Sector context changes the emphasis. Banks and NBFCs layer RBI requirements on top; hospitals and diagnostics handle health data with no separate DPDP category but heightened expectations; D2C brands run the most pixels per page.

A phased action plan to 13 May 2027

The following plan assumes you are starting from a typical position in late October 2026: a CMP in place, a mix of client-side and server-side tracking, and a privacy policy drafted for the SPDI Rules.

Phase A: discover (November–December 2026)

  1. Inventory every tag, pixel, SDK, server-side destination, reverse-ETL sync and audience upload that carries personal data of Indian principals. Site Intelligence gives you a free list of the tags firing on your site as a starting point.

  2. For each flow, record the purpose, the ground (consent or a specific s.7 legitimate use), the processor involved, and where the data is stored.

  3. Identify flows with no defensible ground, typically attribution, retargeting and lookalikes running without consent.

  4. Review processor contracts against s.8(2) and Rule 6's requirement for contractual safeguard clauses.

  5. Track the Consent Manager framework from 13 November 2026 and decide whether you will accept consent signals from registered Consent Managers.

Phase B: design (January–February 2027)

  1. Define a purpose taxonomy that your notice, CMP and data pipelines all share.

  2. Draft the Rule 3 notice in English and the Eighth Schedule languages relevant to your customers, plus a s.5(2) notice for your existing base.

  3. Design the withdrawal path: one action for the principal, propagation to every destination within a reasonable time.

  4. Set retention schedules, including Third Schedule periods and the 48-hour pre-erasure notice if you are in a listed class.

  5. Decide how you will identify and exclude under-18 users from tracking and targeting.

Phase C: build (March–April 2027)

  1. Move consent enforcement to the point where data leaves your control: per event, per destination.

  2. Implement logging that shows what was sent where, on what consent, retained for at least one year.

  3. Wire erasure and withdrawal into the CDP, warehouse, ESP and ad-platform audiences.

  4. Stand up the rights workflow with a 90-day service level and publish DPO or responsible-person contact details.

  5. Write and rehearse the breach runbook: initial intimation to the Board, 72-hour detailed report, and principal notices.

Phase D: verify (late April to 13 May 2027)

  1. Test consent states end to end: grant, refuse, withdraw, and confirm what each destination receives.

  2. Run a tabletop breach exercise involving marketing, data, security and legal.

  3. Sample rights requests and erasures through every system.

  4. Brief the board on residual risk, including any exposure to SDF notification or timeline changes.

Where Ingest Labs fits

Ingest Labs sits between consent capture and your destinations. Your CMP, whether OneTrust, Consentmo or a custom build, records consent. Ingest IQ enforces it: every event is checked against the principal's consent for each purpose before it is routed to each of more than 100 integrations, including Meta CAPI, Google Ads, GA4, TikTok, Klaviyo, Snowflake and BigQuery.

That design answers the obligations that policies alone cannot. Purposes from your notice map to destinations. Each event and destination decision is recorded in an audit trail, supporting the logging and visibility expected under Rule 6. When a principal withdraws consent or requests erasure, Ingest IQ propagates that to the destinations that received their data. Processing for Indian principals can be region-pinned, with a documented sub-processor list. Ingest ID provides first-party identity resolution, and Event IQ provides event-level data tooling.

Under DPDP, Ingest Labs acts as your Data Processor and you remain the Data Fiduciary. We hold SOC 2 Type II and support GDPR and CCPA programmes, and the platform is architected for DPDP. Deployment typically takes under 24 hours. See how Ingest IQ enforces consent per event and per destination. Our DPDP resource page sets out the architecture in more detail.

Frequently asked questions

When does DPDP Act compliance become mandatory?

The DPDP Rules, 2025 commence in three phases. Board provisions took effect on 13 November 2025, the Consent Manager framework takes effect on 13 November 2026, and the substantive obligations on notice, consent, security, breach, retention, children's data, rights, cross-border transfers and penalties take effect on 13 May 2027. A proposal to compress timelines was consulted on in January 2026 but has not been enacted.

Does the DPDP Act apply to companies outside India?

Yes. Under s.3, the Act applies to processing outside India where it is connected to offering goods or services to Data Principals in India. A foreign brand selling to Indian customers through its website or app is in scope for that processing.

Can we rely on legitimate interests for analytics and advertising?

No. DPDP has no legitimate interests ground. Processing must rest on consent or one of the specific legitimate uses in s.7, which do not include attribution, retargeting, audience building or lookalike modelling.

Is our CMP enough for DPDP compliance?

A CMP records consent, but the Act requires processing to stop after withdrawal, including by your processors, and requires reasonable security safeguards with logs kept for at least a year. Those obligations are met in the pipelines that move data to destinations, so a CMP needs to be paired with enforcement at the point data leaves your control.

What are the penalties under the DPDP Act?

The Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for breach notification or children's data failures, up to ₹150 crore for SDF obligations, and up to ₹50 crore for other breaches such as notice, consent and rights. Amounts are fixed caps, not a percentage of turnover.

Is the Data Protection Board operational?

The Board was established in law on 13 November 2025. MeitY invited applications in May 2026, but as of October 2026 no Chairperson or Members have been appointed. Organisations should not treat this as a reason to delay, since the obligations commence on fixed dates.

If you would like a structured view of your exposure across tags, pipelines and destinations before May 2027, book a DPDP readiness call.

Sources

This article is general information about the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, current as of October 2026. It is not legal advice. Please take advice from qualified Indian counsel on your specific position.

Back to all articles