DPDP Act 2023: What B2B Data Buyers Must Know

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive law on the processing of digital personal data. For companies that rely on contact databases for sales and marketing, it changes how outreach should be planned, documented and governed. This article is a general overview and not legal advice; consult your legal team for decisions specific to your business.

Who is a data fiduciary?

Under the Act, the organisation that decides the purpose and means of processing personal data is a data fiduciary. When your sales team uses a purchased database to contact individuals, your company determines the purpose of that outreach, so you carry fiduciary responsibilities for how the data is used.

Purpose and lawful use

The Act expects personal data to be processed for a lawful purpose. Before any campaign, document why you are contacting a segment, what you will say, and how the outreach relates to a legitimate business interest. Keep your messaging relevant to that purpose.

Notice and consent

Where consent is the basis for processing, the Act requires it to be voluntary, specific, informed and unambiguous, with a clear notice. In practice, sales teams should introduce themselves transparently, explain why they are reaching out and capture consent before moving a contact into ongoing communication.

Right to withdraw and grievance redressal

Individuals can withdraw consent and raise grievances. Build an opt-out process into every channel: a clear "stop" option on WhatsApp and SMS, an unsubscribe link in email, and a do-not-call flag in your CRM that sales teams respect immediately.

Security and retention

Data fiduciaries must take reasonable security safeguards. Restrict who can download databases, avoid sharing files over personal email, and delete records you no longer need for the stated purpose.

How this fits with TRAI rules

The DPDP Act sits alongside the TRAI Telecom Commercial Communications Customer Preference Regulations. For calling and SMS, scrub numbers against the National Customer Preference Register (DND) and use registered headers and templates where required.

A practical checklist

• Record the purpose for each campaign.
• Scrub every calling list against DND.
• Introduce your company clearly in the first message.
• Honour opt-outs within your CRM at once.
• Limit access to purchased files and set retention periods.

Responsible use of data protects your brand and builds trust with prospects. Treat compliance as part of your sales process and it becomes a competitive advantage.