DPDP Marketing Consent Program Guide
Manage marketing consent under DPDP. Learn to handle CRM data, campaign opt-ins, and withdrawal requests for Indian data protection compliance.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Marketing Consent Program Guide, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Consent Lifecycle in CRM Systems
Marketing data includes more than just names and phone numbers. It tracks digital footprints like click behavior and IP addresses used for profiling. CRM systems often store this data indefinitely for re-engagement. Under DPDP, you must define a specific end date for marketing use. If a lead does not convert within your defined period, you must delete that record. You cannot rely on implied consent from a business card or a general inquiry.
Marketing Workflows and Data Handling
| Marketing Activity | Data Type | DPDP Risk Level |
|---|---|---|
| Lead Gen Forms | Name, Mobile, Work Email | High |
| Newsletter Opt-ins | Email, Topic Preferences | Medium |
| Event Registration | ID proof, Phone, Designation | High |
| CRM Tracking | Website visits, Click patterns | High |
| SMS Campaigns | Mobile number, Location | Very High |
Managing Withdrawal Requests
DPDP gives users the right to withdraw consent as easily as they gave it. If your signup takes one click, your opt-out must also take one click. Your marketing team must sync the CRM with your email service provider instantly. While you can maintain a suppression list to prevent future contact, you must ensure this data is not used for any other secondary purpose once the user withdraws.
This week
Audit your primary lead capture form. Check that the marketing checkbox is not pre-ticked. Ensure the consent language for marketing is separate from your website terms and conditions.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Can we send marketing emails to customers who bought products before DPDP?
You must send a notice to these existing customers. This notice must explain what data you have and provide a clear way for them to withdraw consent for future marketing.
Do we need a separate consent for SMS and Email?
DPDP requires consent to be specific. Bundling all channels into one box is risky; it is better to let users choose specific channels to avoid total opt-outs.
Is an IP address considered personal data for marketing?
Yes, if the IP address identifies a specific person through your CRM or tracking pixels. You must disclose this digital tracking in your consent notice.