How India data protection law affects your mailing list
See how the digital personal data protection framework treats a marketing list, what consent has to look like and which lists cannot be salvaged.
What the law sees when it looks at your list
You hold a spreadsheet or a list inside an email platform. Names, email addresses, phone numbers, perhaps a city and a past purchase. To you it is a marketing asset built over years. Under the Digital Personal Data Protection Act it is digital personal data and you are the data fiduciary holding it.
That word matters because the obligations attach to the holder rather than to the collector. It does not help that an intern built the list in 2019 or that a vendor supplied it. If the data is in your platform today the responsibility is yours. The framework also reaches organisations outside India that process the personal data of people in India in connection with offering goods or services to them.
What this does not cover and what compliance costs
It does not cover paper. The Act is about digital personal data and a handwritten visitors book is outside it. It does not cover processing for purely personal or domestic purposes. There are also exemptions including for personal data the individual has themselves made publicly available and for certain processing specified in the Act.
The cost is engineering and discipline rather than fees. Consent has to be captured with a notice attached and that notice version has to be retrievable later. Withdrawal has to be as easy as giving consent was. Erasure has to actually remove the record from the platform and from any export sitting in somebody's downloads folder. A grievance contact has to exist and be published. Where you pay a developer or a consultant for that work the fee attracts GST at 18%. A qualified lawyer should confirm what applies to your own processing.
Whose list is fine and whose is not
A list built from your own customers and from people who filled a form on your own website with a visible notice is in reasonable shape. The work ahead is documentation rather than reconstruction.
A purchased database is not salvageable and this is the part nobody wants to hear. If the contacts never gave you consent then mailing them to ask for consent is itself processing you had no basis for. Agencies sell re-permissioning campaigns for exactly this situation. The honest remedy is deletion. A business whose growth plan rests on a bought list of fifty thousand contacts does not have a compliance problem to fix. It has a plan that needs replacing with one that collects data first hand. Scraped lists sit in the same place however technically clever the scraping was.
How consent is meant to work
Consent under the Act has to be free, specific, informed, unconditional and unambiguous, and it has to be signalled by a clear affirmative action. A pre-ticked box is not an affirmative action. Consent bundled into acceptance of unrelated terms is not specific. The notice accompanying it has to describe the personal data being collected, the purpose it will be used for, how consent can be withdrawn and how a complaint can be made to the Data Protection Board.
Consent is also tied to purpose. Data collected to deliver an order has not thereby been consented for a weekly newsletter. When the purpose is served or consent is withdrawn the data is to be erased unless retention is required for a legal reason. Separate and stricter treatment applies to the data of children including verifiable parental consent and restrictions on tracking and targeted advertising directed at them. Your email platform is a processor acting for you and that relationship is expected to sit under a contract.
Judging whether your list is defensible
The flattering metrics are list size and open rate. A large list with strong engagement can still be entirely undocumented.
The metric that matters is provenance coverage. For what proportion of your contacts can you produce the date of consent, the form or channel it came through and the notice text shown at that moment. Then measure how long a withdrawal request takes to be fully honoured across every system including exports and backups. Those two numbers describe your actual position.
The common mistake
The expensive error is treating the unsubscribe link as the whole of compliance. An unsubscribe facility handles withdrawal. It says nothing about whether consent ever existed and it creates no record of a notice. Businesses assume a working unsubscribe link places them on the right side of the line and it does not.
The cost arrives all at once. When provenance is finally required the only route is a re-permission exercise and a list with weak provenance typically collapses to a small fraction of its size. An owner who discovers this during a diligence exercise or after a complaint is making the discovery at the worst possible moment. Recording consent properly from today costs almost nothing. Reconstructing it later is not possible at all.
A note on timing
The Act was passed in 2023 and its provisions and subordinate rules have been brought into effect in stages. What is enforceable at the moment you read this may differ from what is enforceable now. No penalty figure or compliance deadline is stated here for that reason. A qualified lawyer should confirm the current position for your organisation.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.