Home / Resources / DPDP Act compliance
Consulting · ComplianceDPDP Act 2023 compliance for marketing and AI: what businesses need to know
India's Digital Personal Data Protection Act changes how businesses can collect, store and use customer data — including the data flowing through marketing tools, CRMs and AI automation. Here's what it actually requires, in plain English.
What the DPDP Act covers
It governs how businesses collect, process and store the personal data of individuals in India — names, phone numbers, emails, and anything an AI system might process on your behalf. If your marketing forms, WhatsApp automation or AI assistants touch customer data, the Act applies.
What it requires in practice
| Requirement | What it means for marketing/automation |
|---|---|
| Clear consent | Forms and WhatsApp opt-ins need explicit, specific consent — not buried in fine print |
| Purpose limitation | Data collected for one purpose (e.g. a lead form) shouldn't be silently reused for another without consent |
| Data minimization | Collect only what you actually need — resist the urge to add "just in case" form fields |
| Breach notification | Data breaches involving personal data must be reported |
| Right to erasure | Individuals can request their data be deleted — your systems need a way to actually do this |
Where AI automation adds complexity
If an AI assistant processes customer documents, chat logs or CRM data, you need clarity on where that data goes, whether it's used to train external models, and how long it's retained. A responsible AI vendor should commit to not training on your data and should support data deletion requests — ask directly before signing any AI vendor contract.
A practical compliance checklist
- Review every form and WhatsApp opt-in for clear, specific consent language
- Document what data each system (CRM, marketing tools, AI assistants) collects and why
- Confirm your AI/automation vendors don't train external models on your customer data
- Have a documented process for data deletion requests
This is guidance, not legal advice. Consult a qualified lawyer for your specific compliance obligations — this article covers the practical marketing and automation implications, not a full legal reading of the Act.
How we handle it
Every AI system we build is deployed to your cloud, DPDP-aligned, with a signed DPA and no training on your data — see our AI Automation practice and FAQ for the specifics.
Want the number for your business?
A free audit tells you where your funnel leaks and which fix pays back fastest — a number, not a pitch.
Get my free audit →