DPDP Act for B2B sales and marketing: what it means in India

The quick answer

The DPDP Act (the Digital Personal Data Protection Act, 2023) is India's law on how businesses collect and use personal data, and it applies to B2B sales and marketing whenever your records name a person: a proprietor's mobile number, a purchase manager's email or a director's name. Company-level facts such as a CIN, a GSTIN or a company's head-office line are not personal data. Most of the duties that matter to a sales team (notices, consent, security, deletion, answering requests, and the penalties) come into force on 13 May 2027, under the commencement notifications published on 13 November 2025. Use the time before then to record where each contact came from, tell people who you are and how to opt out the first time you reach them, protect the file, and delete what you no longer need.

Most pages on this search explain the Act in general terms for lawyers and compliance teams. This guide is for Indian sellers who call, message and email other businesses: manufacturers, distributors, agencies, telecallers and anyone who buys or builds a contact list. It is a plain-language summary, not legal advice; for a large database or anything unusual, ask a lawyer.

What the DPDP Act is, and when each part starts

Parliament passed the Act in August 2023, and it is published by the Ministry of Electronics and Information Technology (MeitY) as Act No. 22 of 2023. It sets out who must do what with "digital personal data": the business that decides why and how personal data is used is the Data Fiduciary, the person the data is about is the Data Principal, and anyone processing data on a fiduciary's behalf (a CRM provider, a calling agency, an email service) is a Data Processor. It covers data collected digitally and paper records later digitised, such as visiting cards typed into Excel.

The Act did not start all at once. On 13 November 2025 the government published three notifications: one appointing the dates on which each section comes into force, one setting up the Data Protection Board of India with its head office in the National Capital Region, and the Digital Personal Data Protection Rules, 2025. The Press Information Bureau's release of 14 November 2025 describes this as an 18-month phased compliance timeline, "allowing organisations time for smooth transition". From the Gazette text we read on 29 October 2026, the dates work out like this:

One caution about dates. In early 2026 MeitY consulted industry on shortening the 18-month window; we found no notification changing the dates in the official texts we read for this guide, and the November 2025 notifications are what the Gazette says. Check MeitY's site before you plan around a date, because the government can amend the schedule by notification.

Does the DPDP Act apply to B2B contact data?

Yes, to the parts that are about people. Section 2(t) defines personal data as "any data about an individual who is identifiable by or in relation to such data". There is no exemption for data used in business-to-business dealings. What matters is whether a row identifies a human being:

• Not personal data: a company's name, CIN, GSTIN, registered address, industry, turnover band, and a general line or email that reaches the business rather than a person (a reception number, an info@ address).
• Personal data: a named contact person, their designation linked to their name, their mobile number, a named email address, and notes about them. A sole proprietor is the hard case: for a one-person shop, the "business mobile" is usually the owner's own phone, so treat it as personal data.

Most useful B2B lists are built around people, because you sell to a person who decides. In Starleads' own catalogue, the purchase and procurement heads list holds 7,19,174 contacts, the business owners and proprietors list 3,27,366 and the company secretaries list 3,21,569. Every one of those rows is about an individual, so whoever uses them for marketing is acting as a Data Fiduciary for that use. (These and the other Starleads figures in this guide are counts of contacts in Starleads' data, published on its Insights page and list pages and checked on 29 October 2026, not an official census.)

The "publicly available" exclusion, and its limits

Section 3(c) says the Act does not apply to personal data processed by an individual for personal or domestic purposes, or to personal data "made or caused to be made publicly available" by the person it relates to, or by someone under a legal obligation to publish it. The Act's own illustration is an individual who blogs her views and makes her personal data public on social media.

Sellers sometimes read this as a blanket permission: "the number was on a directory, so the Act doesn't apply." Be careful. The exclusion covers data the person themselves made public (or that a law requires to be published); it does not obviously cover data someone else copied or compiled, and the Board has not yet decided any case on how far it reaches. The prudent approach is to treat contact data as covered, follow the steps in this guide, and count the exclusion as a possible defence rather than a plan.

Consent and "legitimate uses": the grounds for using a contact

Section 4 allows personal data to be processed for a lawful purpose only on one of two grounds: the person's consent, or one of the "certain legitimate uses" listed in section 7. Unlike Europe's GDPR, the Indian Act has no general "legitimate interests" ground that a business can weigh for itself. For sales, two parts of section 7 matter:

• Section 7(a): data given voluntarily for a purpose. If a person voluntarily gives you their data for a specified purpose and has not said they don't consent, you may use it for that purpose. The Act's illustration is a person who messages a real estate broker asking for help finding a rental and shares her details: the broker may use them to send listings, and must stop when she says she no longer needs help.
• Section 7(i): employment. Data about your own employees for employment purposes. This covers your sales staff's records, not your prospects.

Consent itself must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)), limited to the data needed for the purpose, and as easy to withdraw as it was to give (section 6(4)). If there is ever a dispute, section 6(10) puts the burden on the business to prove that notice was given and consent obtained. A pre-ticked box or a line buried in terms of sale won't meet that standard.

Here is how the common B2B situations map onto those grounds. It is our reading of the Act's text and illustrations; the Board and the courts will settle the details once the duties are in force.

For cold outreach, the first contact should get a yes or a no. A short first call or email that says who you are, why you are contacting this business, where you got the details and how to opt out gives you a record either way.

The duties of a Data Fiduciary, for a sales team

From 13 May 2027 a business using personal data for sales has the duties below. The section numbers are from the Act and the rule numbers from the DPDP Rules, 2025; the right-hand column turns each one into something a sales manager can do.

Two duties rarely touch a small B2B seller. Children's data (section 9) needs verifiable parental consent, and B2B lists should hold no children. Significant Data Fiduciaries (section 10), notified by the government for the volume and sensitivity of their data, must appoint a Data Protection Officer based in India and an independent data auditor. The three-year automatic deletion schedule in the Rules' Third Schedule applies to large e-commerce entities and social media platforms with at least two crore registered users and online gaming intermediaries with at least 50 lakh, not to an ordinary seller's contact list.

The penalties

The Schedule to the Act sets the maximum penalty for each kind of breach. The Board decides the amount in each case, and these are ceilings, not fixed fines.

For a small seller the biggest exposure is security: a leaked spreadsheet of proprietors' mobile numbers is a personal data breach, and failing to report it is a second one.

How the DPDP Act fits with TRAI's rules for calls and SMS

The DPDP Act does not replace TRAI's rules on commercial calls and SMS; a seller must follow both. They answer different questions. The DPDP Act asks whether you may hold and use a person's data at all, and how. TRAI's Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR) ask whether you may send a commercial call or SMS through the telecom network to that number, and how.

TRAI's advice to senders lists what any business sending bulk communication must complete: registration as a Principal Entity, assignment of a header (an alphanumeric string of up to 11 characters), registration of content templates, sending the entity ID, header and content ID with every message, registration of consent templates, and acquiring consumer consent where needed. Its preference registration page explains how people choose what they receive: by category (such as real estate, health or financial products), by mode (calls, SMS, auto-dialler or robo calls), by time band and by day, registered by SMS or call to 1909, an approved app or a web portal with OTP.

So a promotional SMS campaign to a bought B2B list has to pass both tests: DLT registration and DND scrubbing under TRAI, and a lawful ground, notice and opt-out under the DPDP Act. Our guides to checking DND status and DLT registration for SMS cover the TRAI side step by step. Email falls outside TRAI's rules, but the DPDP Act still applies to named addresses; for deliverability, our guide to SPF, DKIM and DMARC covers those.

Getting your sales data ready before 13 May 2027: step by step

This plan suits a small or mid-sized B2B team with contacts spread across Excel files, a CRM, phones and WhatsApp.

1. Find every copy of your contact data. List where personal data lives: CRM, Excel files on laptops and email, salespeople's phones, WhatsApp groups, marketplace dashboards, your email tool, bought lists in download folders.
2. Merge into one master file or one CRM. Copies on several laptops drift apart and can't be secured. Our guide to building a customer database gives the columns and Excel formulas for cleaning and de-duplicating.
3. Add a source and date to every row. "IndiaMART enquiry, 12 Aug 2026", "Trade fair card, Pragati Maidan, Feb 2026", "Bought list, chemists Surat, Oct 2026".
4. Add consent and preference columns. Record what each person agreed to (calls, SMS, WhatsApp, email), when and how, and their DND status with the date checked. For rows with no consent, mark them "not yet asked".
5. Remove what you don't need. Data minimisation means collecting only what serves the purpose. Delete columns nobody uses (dates of birth, home addresses, personal notes), and delete prospects from finished campaigns who never replied.
6. Write your notice. In plain language: what data you hold (name, business, phone, email), why (to offer your products to businesses like theirs), how to opt out, how to ask for correction or deletion, your contact person for data questions, and that they can complain to the Data Protection Board. Put the full version on your website and a two-line version in first messages and email footers.
7. Rewrite your first-contact scripts. Each first call, email or WhatsApp to a new prospect should say who you are, why you are contacting this business, where you got the details and how to stop further contact. Our telecalling scripts and cold email templates can be adapted with one extra line.
8. Set up the opt-out and request routine. One suppression list that every tool checks before sending; one person who handles access, correction and deletion requests; a register with the date received and the date closed, inside the 90-day limit.
9. Lock down the file. Named logins instead of a shared password, export rights only for one or two people, two-step login on email and CRM accounts, encrypted laptops, no lists sent as email attachments. Keep the access and sending logs for at least a year, as Rule 6 asks.
10. Sign terms with your processors. Your CRM, bulk SMS, email and calling providers process data for you. Make sure their terms cover security, confidentiality and deletion when you stop using them.
11. Write a one-page breach plan. Who decides it is a breach, who tells affected people and how, who reports to the Board without delay and files the detailed report within 72 hours, and how you will stop it happening again.

Buying a contact list after the DPDP Act

Buying business contact lists remains common, and the Act does not ban it, but the buyer becomes responsible for how the data is used. Before you pay any seller, Starleads included, check these points:

• Business contacts only. A seller that also offers lists of consumers, salaried people, investors, patients or students is selling exactly the kind of data that attracts complaints. Starleads doesn't sell these.
• A stated source. The seller should say where the data comes from. Starleads' lists are compiled from business directories and similar sources and cleaned before sale: duplicates are merged and records whose contact details belong to a different business are dropped.
• A removal route. People listed should be able to have their details removed. Anyone can ask Starleads through its Remove my data page; once verified, the number or email goes on a suppression list and is left out of every future sample and download.
• Terms of use. Starleads' privacy policy says lists are provided for business-to-business marketing and prospecting only, under terms that forbid resale and require buyers to respect Do-Not-Disturb preferences and opt-out requests.

The limits: Starleads' lists are not consent lists: the people in them have not agreed to hear from you, so the notice, opt-out, DND check and record-keeping in this guide are your job as the sender. Contact details also change over time.

The channel you plan to use also decides what the DPDP work looks like, and that depends heavily on the trade. In Starleads' data, 99.5% of the 2,12,501 contacts in the grocery and supermarkets list have a mobile number but only 5.4% an email, so you will be giving notice by phone or SMS, under both the DPDP Act and TRAI's rules. For the 1,08,764 importers, 94.7% have an email, so a written first email with an opt-out link is practical. Among chartered accountants and tax consultants (47,994 contacts), 97.1% have a mobile and 83.0% an email; among lawyers and legal firms (67,756), only 45.8% have a mobile. Across the whole catalogue Starleads holds 1,59,87,535 contacts in 201 industries, sold as 6,908 lists. A city, state or specialisation list costs ₹499 and All-India bulk data for an industry ₹1,999, plus 18% GST. See also buying business leads.

Questions people ask

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India's law on the processing of digital personal data. It gives individuals rights over their data, places duties on the businesses that decide how it is used (Data Fiduciaries), sets up the Data Protection Board of India, and allows penalties of up to ₹250 crore. The DPDP Rules, 2025 fill in the details.

When does the DPDP Act come into force?

In phases, under notifications published on 13 November 2025. The definitions and the Data Protection Board started that day; Consent Manager registration starts on 13 November 2026; the main duties, rights and penalties start on 13 May 2027. Check MeitY's site for any later change.

Does the DPDP Act apply to B2B data?

To the parts that identify a person, yes: a contact person's name, a mobile number that belongs to an individual, a named email address. Company-level facts such as a CIN, GSTIN or a switchboard number are not personal data. Data a person has made public themselves falls outside the Act, but how far that reaches for compiled directories has not been tested.

Can I still cold call or email businesses under the DPDP Act?

The Act does not ban cold outreach, but it needs a lawful basis, a clear notice and an easy opt-out, and from 13 May 2027 the Board can enforce that. Treat the first contact as the moment to tell the person who you are and how to stop, then record their answer. Promotional calls and SMS must also respect TRAI's DND preferences and DLT rules, which are in force now.

When must a data breach be reported under the DPDP Act?

Under Rule 7, a business must tell each affected person without delay, and tell the Data Protection Board without delay, followed by a detailed report within 72 hours of becoming aware of the breach (or a longer period if the Board allows it on a written request).

Is it legal to buy a contact list in India under the DPDP Act?

Buying a list of business contacts is not banned, but you become responsible for using it lawfully: give notice and an opt-out at first contact, check DND before promotional calls and SMS, keep the data secure, and delete it when the purpose is over. Avoid sellers of consumer or personal lists. Starleads sells business and professional contacts only, and anyone can ask to be removed from its data.