If you send marketing email to people in India, the Digital Personal Data Protection Act, 2023 (the DPDP Act) now shapes how you collect and use their email addresses. If you also reach people in Europe, the US or Canada, their local rules come into play. This guide explains the practical essentials in plain English, with do’s and don’ts you can act on.
Where Indian law stands
The DPDP Act is India’s first comprehensive law on digital personal data. It covers personal data collected in digital form, which includes email addresses gathered through websites, apps and forms, and data collected offline that is later digitised.
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and set out how the Act works in practice. They are being brought into force in phases, with most obligations for businesses applying after a transition period. Check the official notification for the dates that apply to you, and use the time to get your processes ready rather than waiting for the deadline.
Before the DPDP Act, the main baseline was the Information Technology Act, 2000 and the 2011 rules made under it on reasonable security practices and sensitive personal data. As the DPDP framework takes effect, it replaces parts of that older regime, though the IT Act still matters for areas such as cybersecurity and electronic records.
India has no dedicated anti-spam law for email of the kind the US has with CAN-SPAM. TRAI’s rules on unsolicited commercial communication cover calls and SMS, not email. For email, the DPDP Act’s consent rules are what count.
This guide is general information to help you ask the right questions. It is not legal advice, and the law in this area is still being phased in. For decisions about your business, speak to a lawyer who works on data protection.
Key ideas in the DPDP Act
Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. A pre-ticked box or silence doesn’t count. The Act also provides for substantial monetary penalties, set out in its schedule, for failures such as not protecting personal data properly.
| Term | What it means for email marketers |
|---|---|
| Data Principal | The person the data is about: your subscriber. |
| Data Fiduciary | The business that decides why and how the data is used. That’s you. |
| Data Processor | A service that processes data on your behalf, such as your email platform. You stay responsible for what happens to your data. |
| Consent Manager | A registered intermediary that lets people give, manage and withdraw consent across services. |
| Data Protection Board of India | The body that handles complaints and can impose penalties. |
Collecting consent the right way
- Ask clearly Use an unticked checkbox or a dedicated sign-up form that says what you will send, for example “Email me the weekly offers”. Don’t bundle marketing consent into accepting your terms or completing a purchase.
- Give notice at the same time Tell people what data you collect, why, how to withdraw consent and how to complain. Keep the notice clear and self-contained. The Act also lets people access it in English or in a language listed in the Eighth Schedule of the Constitution.
- Keep a record Note who consented, when, where (which form or page) and to what wording. If a complaint arrives, this record is your evidence.
- Confirm the address Double opt-in, a confirmation email the person must click, proves the address belongs to the person who signed up.
MailNesto stores a consent record with each contact, showing where and when they signed up and what they agreed to. It supports double opt-in on forms, pop-ups and landing pages, and keeps the history when consent changes.
Withdrawal, data requests and retention
The DPDP Act requires that withdrawing consent be as easy as giving it. If someone joined with one click, they should be able to leave with one click.
- Put a working unsubscribe link in every marketing email, and offer a preference centre so people can choose fewer emails rather than none.
- Stop processing promptly once consent is withdrawn, and make sure your processors do the same.
- Be ready to handle requests to access a summary of someone’s data, correct it or erase it, and publish how people can contact you with a grievance.
- Don’t keep data forever. Erase personal data once its purpose is served or consent is withdrawn, unless another law requires you to keep it. Many businesses keep a minimal suppression entry so an opted-out address is never mailed by accident; check with your adviser how that fits your retention policy.
- Protect data with reasonable security safeguards, and have a plan for notifying the Board and affected people if there is a breach.
- Take special care with children. Processing the data of anyone under 18 needs verifiable consent from a parent or guardian, and tracking or targeted advertising aimed at children is not allowed.
Sending to people outside India
Your obligations follow your audience. The DPDP Act can also apply to businesses outside India that offer goods or services to people in India, and the reverse is true too: if you mail people abroad, local laws apply.
| Law | Where | Key points for email |
|---|---|---|
| GDPR (with ePrivacy rules) | European Union; the UK has its own equivalent | You need a lawful basis, which for marketing email is usually consent: opt-in, specific and recorded. People can access, correct and erase their data and object to marketing. Some countries allow limited email to existing customers about similar products, with an easy opt-out. |
| CAN-SPAM Act | United States | Opt-out based, but strict on honesty: no misleading headers or subject lines, identify the message as an ad, include a valid physical postal address, and honour opt-outs within 10 business days. |
| CASL | Canada | Generally requires consent before sending, with records to prove it, plus clear sender identification and an unsubscribe mechanism. |
For a mixed audience, the simplest approach is to meet the strictest common standard everywhere: opt-in consent, clear identification, a postal address, and an easy unsubscribe in every email.
Do
- Collect consent with an unticked box or a dedicated sign-up form
- Keep a consent record for every contact
- Use double opt-in on public forms
- Include your business name, contact details and an unsubscribe link in every email
- Honour unsubscribes straight away and keep a suppression list
- Write down how long you keep data, and why
- Have a data processing agreement in place with your email provider
Don’t
- Buy, rent or scrape email lists
- Assume a business card, WhatsApp chat or invoice equals consent to marketing
- Hide the unsubscribe link or make people log in to leave
- Re-import people who opted out on another platform
- Make marketing consent a condition of buying
- Use misleading subject lines or sender names
Questions
Can I email existing customers without fresh consent?
Order receipts and delivery updates are transactional and are a different matter from marketing. For marketing, the safest course under the DPDP Act is clear consent. The Act allows some processing for certain legitimate uses without consent, but these are narrow and marketing is unlikely to fit. Take advice before relying on anything other than consent.
Does the DPDP Act apply to B2B email?
The Act protects individuals’ personal data. A named work address like priya@company.com identifies a person, so it is generally personal data. Treat B2B contacts with the same care as consumers.
Is my email platform responsible for compliance?
Your platform is usually a processor. You, as the data fiduciary, remain responsible for having consent and handling requests. A good platform gives you the tools (consent records, suppression lists, a preference centre, data request handling) but you have to use them.