This is our reading of the rules as of 8 November 2026, written to help sales teams. It isn't legal advice. Check the sources below, and ask a lawyer before you rely on it.
the timeline
| when | what happened |
|---|---|
| August 2023 | The Digital Personal Data Protection Act, 2023 became law. |
| November 2025 | The government notified the DPDP Rules, 2025, which say how the Act works and when each part starts. |
| November 2026 | Rules on consent managers start, about 12 months after notification. |
| May 2027 | The main duties start, about 18 months after notification: notices, consent, people's rights over their data, and breach reporting. |
Sources give the notification date as 13 or 14 November 2025, depending on whether they count the Gazette date or the announcement. The May 2027 start date is the one that matters for outreach.
is a work email personal data?
Usually, yes. The Act covers any data about an individual who can be identified from it. riya.sharma@samplebank.example identifies Riya. A shared inbox like sales@ or info@ is not about one person, so it's a different case.
That's the main difference from how many B2B teams think about this. There's no separate category for business contacts in the Act. If you can tell who the email belongs to, treat it as personal data.
what the Act asks for, once it applies
- Consent that is free, specific, informed, unconditional and unambiguous, given by a clear action. Silence or a pre-ticked box isn't consent.
- A notice that says what data you hold, why, and how the person can withdraw consent or complain.
- Withdrawing consent must be as easy as giving it, and you must stop when it's withdrawn.
- A short list of "certain legitimate uses" where consent isn't needed, like employment, legal duties and emergencies. Marketing isn't on it.
Under GDPR, many B2B teams rely on "legitimate interests" for cold outreach. The DPDP Act has no equivalent general ground. That's the change Indian teams most often miss.
the open question: data people make public
The Act says it doesn't apply to personal data that the person has made publicly available themselves. Someone who lists their work email on their own website or public profile may fall under this. How far the exemption stretches hasn't been tested yet, especially for data copied from a public page into a sales list. If your outreach depends on it, ask a lawyer before May 2027.
penalties
The Data Protection Board can impose penalties after an inquiry. The highest, for failing to keep data secure, goes up to ₹250 crore. Other breaches carry lower maximums set out in the Act's schedule. The Board's inquiry and penalty powers start with the main duties, in May 2027.
what to do now
Even before May 2027, these habits keep your domain out of spam folders and get better replies. They're also most of what the Act will ask for.
- Only email people whose job makes your offer relevant to them, and say in the first line why you're writing to them now.
- Put a clear way to opt out in every email, and honour it the same day. Keep one suppression list across every tool you send from.
- Record where you got each address. You'll need that the day someone asks.
- Don't buy scraped lists. You can't show where the data came from, and they hurt your sending reputation.
- Send from your own domain with SPF, DKIM and DMARC set up. Google and Yahoo require these for bulk senders, along with one-click unsubscribe and low spam complaint rates.
- Before May 2027, decide with a lawyer what consent or exemption you'll rely on, and change your process before the deadline, not on it.
what about calls and WhatsApp?
They're governed by different rules, and stricter ones today. Sales calls and SMS fall under TRAI's rules, which already require registered number series and respect for the Do Not Disturb register. See TRAI rules for sales calls. WhatsApp has its own opt-in policy. See WhatsApp outreach rules.