Marketing consent under the DPDP Act
A practical guide for Indian growth, sales and legal teams reviewing marketing consent, suppression workflows and evidence under the DPDP Act.
Data>Nuance
Marketing consent is not a small checkbox wearing a very large hat.
Marketing consent under the DPDP Act should be handled as a real product and growth control, not as decoration at the bottom of a form. Marketing teams often work across websites, CRMs, webinar tools, ad platforms, newsletters, sales outreach and customer-success journeys. If consent is collected in one place but ignored in another, the business creates avoidable privacy risk and weak evidence.
The DPDP Act and DPDP Rules, 2025 should be checked from official sources before final publication or launch decisions. This guide focuses on DPDP notice, consent, withdrawal and record design for Indian teams. Other communication, telecom, platform or sector rules may also need review depending on the channel and campaign.
What to review
Review every marketing collection point. This includes newsletter forms, gated content, demo requests, event registrations, free trials, referral flows, checkout forms, chatbot prompts and offline lead uploads. For each source, identify the purpose, notice text, consent language, system of record and downstream tools.
Review purpose separation. A person requesting a product demo may not be agreeing to every newsletter, partner campaign, event invitation or profiling workflow. If optional marketing purposes are bundled into a general business form, the design should be reviewed before launch.
Review sales and marketing handoffs. Leads often move from a form into CRM, outbound sequences, enrichment tools and account-based marketing platforms. The consent state should travel with the lead, and teams should know when outreach is permitted, paused or withdrawn.
Review withdrawal and suppression. A working marketing-consent model needs suppression lists, preference-centre updates and vendor instructions. Unsubscribing from one list should not leave the same person active in another campaign because the systems do not sync.
Review evidence. The business should be able to show the notice version, consent timestamp, source form, campaign purpose, preference changes and completion of withdrawal requests. Evidence should also identify who approved campaign reuse of older leads.
Implementation steps
Create a marketing consent map. List each lead source, campaign type, data field, purpose, notice layer, consent text, CRM field, marketing tool and owner. Keep the map aligned with actual campaigns rather than a generic policy label.
Define a purpose-level consent record. Instead of one broad marketing flag, consider records that distinguish newsletters, events, product updates, partner communication and optional profiling where relevant. This helps teams respect withdrawal without unnecessarily blocking unrelated service communication.
Build system rules. CRM, email tools, ad audiences, customer-data platforms and webinar tools should receive consistent consent and suppression signals. Assign one authoritative source for marketing preference status and document how other tools update from it.
Train growth and sales teams. They should know which lists require consent review, which messages are service-related, when a fresh notice is needed, and how to handle a person who objects or withdraws consent. Training should include examples from real campaign workflows.
Run a monthly consent hygiene check. Sample recent leads and verify source form, notice version, consent field, campaign inclusion and withdrawal handling. This catches broken forms, manual uploads and vendor sync failures before they become systemic.
Common mistakes
- Treating all form submissions as permission for every marketing channel, campaign and partner use.
- Keeping unsubscribe records in an email tool while CRM, ad audiences or sales sequences continue using the same contact.
- Reusing old lead lists without checking source, notice version, purpose and withdrawal history.
How DataNuance can help
DataNuance can help map marketing consent flows, review notices, design CRM fields, test suppression workflows and prepare records for privacy governance. The practical output is a campaign-ready control model that growth, sales, legal and operations teams can actually use. To review marketing consent workflows, contact DataNuance through our contact page.
FAQs
Does every marketing message need consent?
The answer depends on the purpose, relationship, channel and applicable rules. Under DPDP planning, teams should start by mapping whether consent is the basis for that marketing use.
Can a demo request become a newsletter subscription?
Do not assume that. A demo request and a newsletter subscription may involve different expectations and purposes, so the notice and choice design should be reviewed.
What should a marketing consent record include?
Useful fields include source, notice version, purpose, timestamp, channel, CRM owner, current preference status, withdrawal date and affected tools.
How should old lead lists be handled?
Review the source, notice, purpose, age, withdrawal history and vendor history before use. If the evidence is weak, hold the list for remediation rather than uploading it into campaigns.
Sources
This publication is general information and is not legal advice for a specific organisation or matter.