Quick Answer: DPDP compliance for lead capture means collecting only the data an enquiry needs, telling people why, getting clear opt-in consent for marketing follow-up, and making withdrawal as easy as giving consent.
- Consent manager rules start in mid-November 2026, and the main notice and consent duties for businesses apply from May 2027.
- Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, so pre-ticked boxes do not count.
- CA firms, law firms and BFSI teams also answer to ICAI, Bar Council or RBI rules, which sit alongside the DPDP Act rather than replacing it.
Not sure which of your forms, lists and WhatsApp flows would pass a consent check? Walk through your lead capture with Technocratiq and see which gaps to close first for dpdp compliance. Book a strategy call
Every enquiry form, newsletter sign-up and WhatsApp chat on a CA firm, law firm or bank website collects personal data. Under India’s Digital Personal Data Protection Act, 2023, how that data is collected and used is now a legal question as well as a marketing one.
DPDP compliance is the set of duties that the DPDP Act and the DPDP Rules, 2025 place on any business collecting digital personal data, covering notice, consent, security and withdrawal. This guide explains what those duties mean for lead capture, where ICAI, Bar Council and RBI rules also apply, and how to re-permission lists you already hold. It is a marketing guide, not legal advice, so confirm specifics with your counsel.
What does DPDP compliance mean for lead capture?
For lead capture, dpdp compliance comes down to four duties: tell people what you collect and why, collect only what the purpose needs, get valid consent for anything beyond answering their request, and let them withdraw easily.
Under the DPDP Act, the business collecting the data is a data fiduciary, and the person filling in the form is a data principal. Section 6 sets the consent standard. Consent must be:
- free: not forced, and not bundled with something unrelated
- specific: tied to a stated purpose
- informed: preceded by a notice in clear, plain language
- unconditional: not made a condition of an unrelated service
- unambiguous: given through a clear affirmative action, such as ticking an unticked box
Withdrawing consent must be as easy as giving it, and the business carries the burden of proving that consent was valid.
Not every use needs consent. Section 7(a) allows processing of data a person voluntarily provides for a specific purpose, such as answering the enquiry they sent, unless they object. How far that goes is still debated by Indian lawyers, so treat any marketing beyond the original request as needing consent.
DPDP timeline: what changes in November 2026 and May 2027
The DPDP Rules were published in November 2025 and phase in over 18 months.
| Phase | When | What applies | What it means for lead capture |
|---|---|---|---|
| Phase 1 | November 2025, on publication | Rules for the Data Protection Board of India | The regulator is set up |
| Phase 2 | Mid-November 2026, one year after publication | Rule 4: registration and duties of consent managers | Consent manager platforms can register |
| Phase 3 | May 2027, 18 months after publication | Notice, consent records, security, breach reporting and erasure (Rules 3, 5 to 16, 22 and 23) | Forms, lists and follow-up flows must meet the full standard |
Sources differ by one day: the Gazette notification is dated 13 November 2025, while the Press Information Bureau gives 14 November, so Phase 2 falls on 13 or 14 November 2026.
A consent manager is a platform registered with the Data Protection Board that lets people give, review, and withdraw consent across businesses in one place. People can choose to use one, and your systems may need to accept consents and withdrawals that arrive through a consent manager.
Last verified: 23 October 2026, against the Press Information Bureau’s November 2025 release and summaries by Bar & Bench and EY. Some summaries date parts of Section 6 earlier, so confirm the dates that apply to you with counsel.
Where consent applies in your lead capture
Each channel needs its own purpose and its own record.
| Channel | What consent should cover | Common mistake |
|---|---|---|
| Enquiry or consultation form | A separate opt-in for marketing follow-up | One box covering “updates, offers and partners” |
| Newsletter sign-up | Sending that newsletter | Adding enquiry contacts to the newsletter without asking |
| Messages on WhatsApp specifically | Assuming email consent covers WhatsApp | |
| CRM and automation | Only the purposes recorded at capture | Sequences that keep running after a withdrawal |
Enquiry and consultation forms
Ask only for what you need to respond: a name, one contact detail and a short description of the matter is usually enough. Show a short notice beside the form explaining what you will do with the data, and add a separate, unticked box for marketing follow-up.
Newsletters and email nurture
Email nurture needs its own consent, recorded with the date, the source and the wording shown. Every email should carry a working unsubscribe link that stops all marketing sends. If an email marketing agency in India runs your lead nurture email, it should be able to show the consent record behind each contact.
WhatsApp follow-up
Consent for email does not extend to WhatsApp. Ask for it separately and record the date and wording of the opt-in.
CRM and marketing automation
Your CRM should store the purpose, date and source of each consent, and honour a withdrawal across every tool. If you work with a marketing automation agency on CRM and workflow automation, check that withdrawals reach every sequence and ad audience, and that old exports are deleted.
Where ICAI, Bar Council and RBI rules also apply
Professional and sector rules sit alongside the DPDP Act. They decide what you may say and offer, while DPDP decides how you handle the data.
CA firms
ICAI’s advertising and website guidelines govern what a CA firm can say about itself. The DPDP Act separately governs the forms and newsletters on a CA firm’s website in the same way as for any other business. Keep tax newsletters educational, and ask for consent before adding enquirers to them.
Law firms
Rule 36 of the Bar Council of India Rules bars advocates from soliciting work, directly or indirectly. That affects follow-up as well as advertising: a promotional message to someone who has not asked for it can raise both a DPDP consent issue and a Rule 36 concern. Keep follow-up to the matter the person enquired about, and keep newsletters informational, as covered in our approach to law firm marketing.
BFSI
Banks and NBFCs already work under the RBI (Digital Lending) Directions, 2025, which require lenders and their lending service providers to collect data only as needed, with prior, explicit consent and an audit trail, and to let borrowers revoke consent or ask for deletion. The DPDP Act adds a general consent standard for all marketing data.
For digital marketing for banks, that means lead forms, loan-interest pop-ups and remarketing lists all need a clear purpose and a consent record. Teams looking for the best digital marketing agency for BFSI lead generation should ask how a partner handles both sets of rules, which our BFSI marketing approach builds into every stage.
How to re-permission old email and WhatsApp lists
Lists collected before the DPDP Act took effect do not all need deleting, but they do need sorting. Section 5(2) of the Act says that where someone gave consent before commencement, the business must send them a notice as soon as reasonably practicable, and may keep processing their data until they withdraw. Contacts with no consent record are a different case.
- List every database: where it came from, when, and what each person agreed to.
- Sort contacts into three groups: consent recorded, data voluntarily provided for one purpose, and no record.
- Send the Section 5(2) notice to the consented group, with a one-click way to withdraw.
- For contacts with no record, check with counsel whether a single request to opt in is appropriate, and stop if they do not reply.
- Ask for WhatsApp consent separately from email consent.
- Delete contacts who withdraw or do not respond, and log what you removed.
An email marketing agency in India can run this process, but the consent record must belong to your firm rather than to the agency’s tool. Re-permissioning is also where dpdp compliance improves list quality, because the contacts who confirm are the ones likely to read and reply.
DPDP compliance questions to ask a lead generation or marketing automation agency
Whether you are shortlisting the best lead generation agency for high-value B2B accounts, a marketing automation agency for lead nurturing workflows, or email automation services for B2B companies, ask these questions:
- Where is consent recorded for each lead, and can we export it?
- How are withdrawals synced across email, WhatsApp, the CRM and ad audiences?
- Which data does each form collect, and why is each field needed?
- How will you handle the lists we already hold?
- Who reviews campaigns against ICAI, Bar Council or RBI requirements before launch?
An agency that cannot answer the first two clearly is passing the compliance risk back to you.
How Technocratiq builds consent into lead capture
Technocratiq Digital plans lead capture for CA firms, law firms, and BFSI brands with consent and professional rules considered from the first form. On BFSI engagements, compliance review checkpoints are part of the plan, RBI, IRDAI, or SEBI requirements are confirmed with the client’s compliance team, and nurture is consent-based. For law firms, follow-up is consent-based, and enquiries are tracked by source. For CA firms, marketing is planned around ICAI norms.
This keeps DPDP compliance, digital marketing for banks, and professional-firm marketing in one plan, instead of leaving consent as a legal clean-up after campaigns go live. Technocratiq does not give legal advice: final sign-off on consent wording and data handling stays with your counsel or compliance team.
Frequently asked questions
When does DPDP compliance become mandatory?
Most duties apply from May 2027. The DPDP Rules, published in November 2025, phase in over 18 months: Data Protection Board rules apply at once, consent manager rules start in mid-November 2026, and notice, consent, security and breach duties apply 18 months after publication. Building consent into forms and lists now avoids a rush before May 2027.
What is a consent manager under the DPDP Act?
A consent manager is a platform registered with the Data Protection Board that lets people give, review and withdraw consent across businesses from one place. Registration rules apply from mid-November 2026. People can choose to give consent through one, so your systems may need to accept consents and withdrawals that arrive this way.
Is a pre-ticked checkbox valid consent?
No. Consent under the DPDP Act must be given through a clear affirmative action, so a pre-ticked box, silence, or inaction does not count. Use an unticked box for each purpose, such as one for the newsletter and one for WhatsApp updates, and record when and how each box was ticked.
Can I keep emailing contacts collected before the DPDP Act?
Yes, if they gave consent. Section 5(2) requires you to send those contacts a notice as soon as reasonably practicable, explaining what data you hold and why, and you may continue until they withdraw. Contacts with no consent record need fresh consent before marketing continues.
Do I need separate consent for WhatsApp follow-up?
Yes. Consent must be specific to a purpose, so email consent does not cover WhatsApp. Replying on WhatsApp to someone who messaged you about their enquiry is different from sending them promotional messages later, and the second needs its own opt-in.
Does DPDP apply to small CA and law firms?
Yes. The DPDP Act applies to businesses that process digital personal data in India regardless of size, so a small firm’s enquiry forms and newsletter lists fall within it.
What are the penalties for DPDP non-compliance?
The Act sets maximum penalties by type of breach. Failing to keep reasonable security safeguards can attract up to ₹250 crore, while other violations, including consent and notice failures, can attract up to ₹50 crore. The Data Protection Board decides the amount in each case.
Next step
Start with your forms, then your lists, then your follow-up flows. If you want help mapping your lead capture against DPDP compliance requirements and your professional rules, book a strategy call with Technocratiq.