DPDP Act for Marketers: Consent, Leads and Campaign Rules for BFSI

By Yamm Labs · Updated October 2026 · 13 min read

The lead form for a personal loan campaign has four fields, a box that is already ticked and a line of grey text saying the applicant agrees to be contacted by the lender “and its partners”. The agency built it in an afternoon and the leads arrive by the thousand. Under India’s Digital Personal Data Protection Act, each of those details is now a question the lender has to answer with a record, and the ticked box is the first one it will lose.

What is the DPDP Act for marketers at a bank, insurer or fintech?

The Digital Personal Data Protection Act, 2023 is India’s general law on how organisations collect and use digital personal data. Parliament enacted it on 11 August 2023, and the government notified the DPDP Rules on 14 November 2025, according to the Press Information Bureau’s note on the Rules. Read as the DPDP Act for marketers, the law decides who you may put on a list, what you must tell them first and what you must keep as proof.

Four terms do most of the work. The data fiduciary is the organisation that decides why and how data is processed: your bank, AMC, insurer or NBFC (non-banking financial company). The data principal is the person the data is about. A data processor handles data on the fiduciary’s behalf, which describes your media agency, CRM vendor, call centre and SMS aggregator. A consent manager is a registered platform through which a person can give, review and withdraw consent across organisations.

The Act covers digital personal data processed in India, and it also reaches processing outside India when it is connected to offering goods or services to people in India. A Dubai-based wealth platform running Instagram lead ads at Mumbai investors is inside its scope. A Gulf campaign aimed only at UAE residents falls under the UAE’s own federal data protection law instead.

The detail marketers miss is what the Act leaves out. It lists a short set of “legitimate uses” that allow processing without fresh consent, such as data a person volunteered for a specified purpose, disclosures the law requires to the State, medical emergencies and employment. There is no general “legitimate interests” ground of the kind the EU’s GDPR offers. For promotional messages, cross-sell and remarketing, consent is the basis you will almost always rely on. This is general guidance, not legal advice; your compliance team decides.

Why does the DPDP Act matter more for a regulated brand?

It matters more because the penalties are large and the proof sits with you. The PIB note sets the highest penalty at up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore each for failing to notify a breach and for breaching duties on children’s data, and up to ₹50 crore for other violations. When a dispute turns on consent, the Act puts the burden on the data fiduciary to prove that a notice was given and consent was obtained.

The second reason is that the Act makes the brand responsible for processing done on its behalf, whatever the agency contract says. If a lead vendor keeps calling a person who withdrew consent, the complaint lands on the lender. The Act also allows a fiduciary to use a processor only under a valid contract, so the agency agreement becomes part of your compliance file.

The third reason is that the DPDP Act sits on top of rules your sector already follows. RBI’s digital lending rules, now consolidated in its Master Directions, already limit what a lending app may read from a borrower’s phone. IRDAI’s 2024 regulations on policyholder protection require an insurer’s written approval before a distribution channel issues an advertisement, which means a broker’s lead ad is the insurer’s problem too. TRAI’s commercial communication regulations already require promotional SMS to go through registered headers and templates. A campaign can pass one of these checks and fail another, which is why we treat data consent as one line on the same compliance and creative review that checks disclaimers and claims.

Here is the regulator-driven decision in practice. Take a mutual fund lead ad on Meta. SEBI’s advertising code requires the standard risk warning on the creative, and the DPDP Rules require a notice that can be understood on its own, with an itemised list of the data you collect and the specific purpose. Those two cannot share one line of grey text.

The sequence we use is: the ad creative carries the SEBI warning; the form screen lists each field and why it is needed; a separate consent screen holds unticked boxes, one per purpose; the thank-you screen tells the person how to withdraw. That adds one screen to the form, and the person filling it in can see exactly what they agreed to.

SIGNALNewsletter by Yamm Labs

The next piece, straight to your inbox.

New writing on BFSI brands, B2B and influencer marketing, and AI search.

Email *

Subscribe

Subscription form is not available at the moment

One click to unsubscribe. Privacy policy

How does DPDP compliance work for a campaign, in six parts?

A compliant campaign data flow has six parts. Each one maps to a duty in the Act or the Rules, and each produces something you can show an auditor.

1. Notice before the ask. The DPDP Rules require the notice to be understandable without reference to any other document, to give an itemised description of the personal data and the specific purpose, and to link to the ways a person can withdraw consent, use their rights and complain to the Data Protection Board. The Act gives people the option to read the notice in English or any language in the Eighth Schedule of the Constitution, so a Hindi or Tamil campaign should offer its notice in that language as well.
2. Consent by a clear action. The Act requires consent to be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the data needed for the stated purpose. In our reading, a pre-ticked box or a “by continuing you agree” line does not meet that standard. One box per purpose does: loan processing, product offers from the lender, and sharing with named partners are three separate decisions.
3. Proof of consent. Because the fiduciary must prove notice and consent, every lead needs a record: who, when, which notice version, which purposes, which channel and which source. The Rules also require a fiduciary to keep personal data, traffic data and processing logs for at least one year for purposes the Rules list, so your consent log and your ad platform exports need a retention plan.
4. Withdrawal and rights. Withdrawing must be as easy as giving consent. If consent took one tap in an app, an opt-out buried in a branch form fails. Once a person withdraws, the fiduciary must stop processing within a reasonable time and make its processors stop too. Requests to access, correct, update or erase data must be answered within ninety days, according to the PIB note.
5. Vendors and retention. Every agency, call centre and lead partner needs a contract that covers security safeguards and deletion. The Act requires the fiduciary to erase data once consent is withdrawn or the purpose is no longer served, unless another law requires it to be kept, and to make its processors erase it too. A lender can keep KYC records it is required by banking law to retain, but it cannot keep a cold lead list for years “in case”.
6. Children and breaches. The Act defines a child as anyone under eighteen. It requires verifiable consent from a parent before processing a child’s data and bars tracking, behavioural monitoring and targeted advertising directed at children. That affects student credit cards, minor savings accounts and child education plans. If a breach happens, the Rules require the fiduciary to tell each affected person without delay and to send the Data Protection Board a detailed report within seventy-two hours of becoming aware of it.

Lead sources differ most on parts two and three. The table below scores six common BFSI lead sources on four criteria: who presents the notice, whether you can prove consent per lead, how easy withdrawal is, and how much of the risk sits with you. Score each criterion 0 (weak), 1 (partial) or 2 (strong) for your own setup.

How should a BFSI marketing team start before the deadline?

Most of the DPDP Act for marketers is operational work. Start with an inventory, because most teams do not know how many places collect personal data in their name. Then fix the highest-volume sources first. A practical order:

1. List every collection point: website forms, app sign-ups, EMI and SIP calculators that ask for a phone number, chatbots, WhatsApp flows, event QR codes, partner links and platform lead forms.
2. For each one, name the fiduciary, the processors that touch the data and the purposes it is used for today.
3. Rewrite the notice for each form in plain language, with itemised fields and one purpose per line. Translate it for every campaign language.
4. Split consent into separate unticked boxes and drop fields you do not need. If the loan offer does not need a date of birth at the first step, do not ask for it.
5. Add consent-log fields to your CRM: timestamp, notice version, purposes agreed, source, channel and withdrawal date.
6. Re-paper agency, call-centre and lead-partner contracts to cover security, deletion, breach reporting and consent records per lead.
7. Plan the notice to existing customers. The Act requires a fiduciary to send people who consented before the Act took effect a notice of what data it holds and why, as soon as reasonably practicable; the fiduciary may keep processing their data until they withdraw.
8. Agree a timeline with compliance. Consent manager registration comes into force a year after the Rules were published, and most other duties at eighteen months.

Our compliance-creative cheat sheet covers the disclaimer side of the same review, so your team can check the ad and the form together.

How do you measure DPDP readiness in marketing?

The DPDP Act for marketers comes with no scorecard of its own, so build one from numbers your CFO and compliance head both understand. Five measures cover most of it, each with a name, a formula and what it shows.

• Proof coverage. Contactable records with a complete consent log entry, divided by all contactable records. It shows how much of your database you could defend in a complaint.
• Consent rate per purpose. People who ticked a purpose box, divided by people who submitted the form. A low marketing consent rate next to a high loan-processing rate is normal and honest.
• Withdrawal time. Hours from an opt-out to suppression in every system and every vendor. It shows whether your processors stop when you do.
• Rights requests closed on time. Access, correction and erasure requests answered within ninety days, divided by all such requests.
• Cost per consented lead. Media and lead spend divided by leads with a provable, purpose-specific consent record.

Cost per consented lead = total lead spend ÷ leads with a complete consent record

Take a hypothetical NBFC spending ₹15 lakh a month on 10,000 aggregator leads, or ₹150 per lead. If only 6,000 of those arrive with a consent record it can prove, the real cost is ₹250 per usable lead. A cheaper source with no consent logs is often the more expensive one, and the gap only shows up once you count proof.

Report these monthly next to cost per lead. When proof coverage falls, look at the newest source first.

What goes wrong with DPDP consent in campaigns, and what are the early signs?

Most failures start small and show up in operations before they show up in a complaint. The table pairs each common failure with the early signal and the fix.

The pattern behind most rows is the same: a step was added for speed and nobody owned it afterwards. Give each row an owner on the brand side, not only at the agency.

A lead you cannot prove consent for is a cost you have already paid and a risk you still carry.

When is a DPDP consent campaign the wrong choice?

Consent is the right basis for marketing, but a consent drive is the wrong tool in four situations.

The first is processing the law already requires. Regulatory reporting and records a bank must keep under banking law rest on legal duties, not on marketing consent. Asking for consent there confuses customers, because they cannot refuse it in any meaningful way.

The second is service messages. A payment receipt, a premium due reminder or an OTP is part of the service the person asked for. Keep those separate from promotional messages, in your systems and in your SMS templates, so a marketing opt-out never blocks a fraud alert.

The third is a mass “please re-consent” email to a list that never consented properly. Sending it is itself processing data you may not have a basis to hold. For records with no proof and no live relationship, deletion is often the cleaner answer, and your legal team should decide which records qualify.

The fourth is a campaign aimed only outside India. A UAE-only campaign falls under the UAE’s Federal Decree Law No. 45 of 2021 on personal data protection, in force since 2 January 2022, or under the DIFC’s own data protection law if you operate from the financial free zone. Saudi campaigns follow Saudi rules. Build each market’s consent flow to its own law, and treat India’s Act as the stricter template only where your lawyers agree. For the SEBI side of a fund campaign, our SEBI advertising rules FAQ covers the disclaimers.

If your firm is notified as a significant data fiduciary, the Act adds a data protection officer based in India, impact assessments and audits. At that point the marketing flow is one input to a wider programme your compliance team runs.

People also ask

Does the DPDP Act ban buying lead lists in India?

The Act does not name lead lists, but it requires the data fiduciary to prove that each person received a notice and gave consent for the specific purpose. A bought list rarely comes with that proof, so using it leaves the brand exposed. Ask the seller for the notice text and a consent record per lead, or do not buy.

When do the DPDP Rules apply to marketing campaigns?

The Rules were notified on 14 November 2025. Consent manager provisions come into force one year after publication, and most duties on notices, security, breaches and retention eighteen months after it, around May 2027. Campaigns planned now will still be running then, so build the forms to the final standard today.

Is an agency liable under the DPDP Act?

An agency handling leads for a bank or insurer is usually a data processor, and the Act makes the data fiduciary responsible for processing done on its behalf. The brand carries the regulatory exposure, so it should hold the agency to security, deletion and consent-record duties by contract.

Do work email lists for B2B fintech marketing fall under the DPDP Act?

A named work email identifies a person, so it is personal data under the Act. B2B campaigns to bank or NBFC staff need the same notice, consent and withdrawal steps as consumer campaigns. The Act excludes data a person has made public themselves, but that does not cover a scraped contact database.