The Digital Personal Data Protection Act, 2023 is India’s main law on personal data. It applies to digital personal data processed in India, and to processing outside India if it relates to offering goods or services to people in India. Personal data collected offline and later digitised is covered too. For email marketers, the subscriber list is personal data and the business is a data fiduciary.
The Act is built around consent. Before processing, a data fiduciary must give a notice describing the personal data and the purpose, and obtain consent that is free, specific, informed, unconditional and unambiguous. Consent can be withdrawn as easily as it was given. Certain “legitimate uses” allow processing without consent, but they are narrow and generally don’t cover promotional email.
Individuals (data principals) can access a summary of their data, request correction or erasure, and seek grievance redressal. Businesses must protect data with reasonable security safeguards, report personal data breaches, and erase data when it is no longer needed. Processing children’s data needs verifiable parental consent. The Data Protection Board of India can impose penalties of up to ₹250 crore for some failures, such as not taking reasonable security safeguards.
The DPDP Rules were notified in November 2025 and the law is being brought into force in phases. Provisions setting up the Data Protection Board took effect first, rules on consent managers follow after a year, and most obligations for businesses, such as notice, consent and security requirements, apply after a longer transition. Check the current status and take legal advice for your situation; the practical steps for email marketers are the same either way.
A Jaipur jewellery brand reviews its email practices for the DPDP Act. It rewrites its sign-up notice in plain English and Hindi, removes a pre-ticked box at checkout, starts recording consent source and date, adds a preference centre, and writes a short process for handling access and erasure requests within a set time.
MailNesto records consent history for every contact, offers a preference centre with data download, and includes a data-requests log for access, correction and erasure requests with due dates.