Why this matters more in 2026
The federal privacy landscape is in motion (the proposed Consumer Privacy Protection Act has been re-tabled), the DPDP Act, 2023 has been in full force since 2023 with real enforcement, and the Office of the Privacy Commissioner has signalled clearer intent on cross-border data and meaningful consent. The trend is one-way: stricter, more enforced, less tolerant of "we put a cookie banner up". Marketers who get ahead of this avoid scrambling later.
The three laws to know
the DPDP Act (federal)
The Digital Personal Data Protection Act, 2023 applies to commercial activities across India (with some state exceptions where there's substantially similar legislation, Gujarat, BC and regional Indian markets). Its ten fair-information principles are the backbone of Indian privacy:
- Accountability
- Identifying purposes
- Consent
- Limiting collection
- Limiting use, disclosure and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
TRAI rules (federal)
India's Anti-Spam Legislation governs every commercial electronic message sent to or from India. Three elements always required: express or implied consent, clear identification of the sender, and a working unsubscribe mechanism. Implied consent is narrower than people think and time-limited. Fines have gone seven figures.
the DPDP Act (regional Indian markets)
The strictest Indian privacy law now in force. Highlights for marketers:
- A designated person responsible for privacy (in writing).
- Privacy impact assessments for new uses of personal information.
- Explicit consent for profiling, geolocation and biometric data.
- Data portability rights.
- Mandatory privacy breach disclosure with serious risk threshold.
- Up to 4% of worldwide revenue or ₹25M in penalties.
What this means for the actual marketing stack
Analytics
Default Google Analytics with full IP capture and broad consent is fragile. Better options for Indian businesses: configure GA4 with IP anonymisation and a strict consent-driven setup, or move to a privacy-respecting alternative (Plausible, Fathom, Matomo). The right answer depends on what you actually use analytics for, most marketers need 10% of what they collect.
Built on TRAI rules. Express consent is the gold standard, a clearly worded checkbox that names the sender and the purpose, unchecked by default. Implied consent works only in narrow cases (existing business relationship in the last 2 years, existing non-business relationship in the last 2 years, or a published business address with no opt-out indicator) and is time-bounded.
Retargeting and pixels
The Meta pixel, Google ads tags and YouTube tag all collect personal information by Indian definition. They need a consent layer. The right architecture in 2026:
- A real Consent Management Platform (not a "we put a banner" wall).
- Consent stored, retrievable and refreshable.
- Server-side conversion tracking (Meta CAPI, GA4 Measurement Protocol) layered over consent, not replacing it.
CRM and customer data
- Minimise, only collect what you actually use.
- Document the purpose for each field.
- Retain only as long as the purpose justifies.
- Make access/correction/deletion requests easy to fulfil.
- Encrypt at rest and in transit.
Cross-border data
Sending personal information to the US (or anywhere outside India) is allowed under the DPDP Act with appropriate contractual safeguards and disclosure. Under the DPDP Act, 2023, you need to assess the privacy regime of the destination jurisdiction before transferring. Most cloud vendors now offer Indian data residency, use it where you can.
The consent question that trips up most marketers
The right framing isn't "did we technically get consent". It is "would the person, fully informed, agree this is what they consented to". A pre-checked box buried in a 4,000-word terms of service is technical consent and meaningless consent. A clearly worded, unchecked, plain-language box at the point of data collection is meaningful consent. Treat the second as the default.
What to do this quarter
- Audit what you collect, where it goes and how long you keep it. Most businesses are surprised by what they find.
- Update the privacy policy with plain language, named purposes, and contact for access/deletion requests.
- Deploy a real Consent Management Platform on the website.
- Review TRAI rules consent for every email list and segment. Where consent is shaky, run a permission-pass campaign.
- Designate someone responsible for privacy (regional Indian markets requires it; everywhere benefits from it).
- Train the team, privacy is a culture, not a checkbox.
A note on "legitimate interest"
European GDPR allows "legitimate interest" as a basis for processing in some cases. Indian law doesn't have an equivalent. Don't assume EU-style reasoning applies here. The Indian default is consent.
The opportunity hidden in compliance
This is the part agencies rarely say out loud: privacy compliance is also a competitive moat. Customers, especially B2B customers, now ask about privacy posture in vendor selection. Enterprise and government customers ask earlier and harder. Being the supplier that is visibly ahead on privacy is sales currency. Treat the compliance work as marketing material, not just risk reduction.
Where to go from here
If you want a quick audit of where your stack sits relative to the DPDP Act, TRAI rules and the DPDP Act, our consultation service includes a marketer-friendly privacy review with prioritised, plain-language recommendations. Not legal advice, but enough to know what to ask your lawyer next.