Okay, story first.
Some marketing meetup in Delhi, a few weeks back. I’m holding a paper cup of terrible chai when an agency owner comes over, phone already in hand. “Bhai, see this. 400 leads a month. One landing page.”
He wanted me to be impressed. I was, a little. Then I scrolled down.
Name. Phone. Email. Green button saying “Get Offer.” That’s it. No consent line, no mention of purpose, no privacy link. I asked him where the numbers go after the form. He shrugged. “Sheet, then calling, then the email list, then WhatsApp. Normal.”
Normal. Sure. And that’s exactly why I’m writing about the DPDP Act for digital marketers, because our “normal” is going to age badly.
Whose Problem Is It Under the DPDP Act for Digital Marketers?
Everyone’s first question is “wait, am I the one responsible, or is it my client?” Fair question. Annoying answer: it depends.
The business that decides why the data is collected is called the Data Fiduciary. That’s usually your client, since the product and the customers are theirs. You, running the ads and forms, are often just a processor. But if you build your own lists and sell to them yourself, you’re a fiduciary too. Confused? Our explainer on data fiduciary vs data processor sorts it out in a few minutes.
Why does it matter in real life? Because the responsible party is the one who gets the awkward email from an angry customer. Or from the regulator. I’d rather not be that person, and I doubt you want to either.
Lead Forms: Small Thing, Big Deal
Three boxes and a button, how risky could it be? Quite, actually. A form is where you collect personal data, and the Act doesn’t care that it looks tiny.
Say what you’re collecting. Say why. Link a privacy notice (a real one, not a dead link). And drop the pre-ticked marketing checkbox, right now, today. Somebody who gives you a phone number to get a brochure hasn’t agreed to your Monday promo SMS.
Also, ask for less. If a callback needs only a number, why are you collecting date of birth? Because the client “might want it later”? Then don’t collect it. Data you never took can’t leak.
Need help with the notice itself? Our guide on privacy policy drafting under the DPDP Act walks through it.
Email Lists and WhatsApp Broadcasts
I get it, honestly. Client wants results by Friday. There’s an old list sitting in a shared drive, or some guy on LinkedIn is selling “50,000 verified business emails” for a few thousand rupees. Hard to say no.
Say no anyway.
Buying a list doesn’t buy permission. Those people never agreed to hear from you, and the earlier seller’s collection doesn’t hand their consent over to you. It’s a bit like using a stranger’s house key because your friend sold it to you.
The slow route works better. Ask properly, write down who said yes and when, and make unsubscribing painless. Then actually respect it. Why leaving must be as easy as joining is covered in consent withdrawal under the DPDP Act.
Pixels, Remarketing and Cookie Banners
Meta pixel, Google tag, heatmaps, remarketing lists. They follow people across the web. That’s the feature, and it’s also the headache.
Quick checks. Does your site say what’s running? Does the cookie banner offer a real choice, or just one giant “Accept”? Do scripts wait for that choice, or do they fire the second the page loads (many do, sadly)? We went deeper in cookie consent under the DPDP Act.
Custom audiences too. Uploading a customer list to an ad platform means giving that data to another company. Do you have a proper reason? Think about it before you click upload.
Anything Touching Kids
This one’s simple. The Act is stricter about children’s data. Parental consent comes into it, and there are limits on tracking and ads aimed at children. If you run campaigns for coaching classes, apps for teenagers, gaming, anything like that, pause and check the age angle first. Not after.
Your Client Contract Probably Says Nothing
I’ve read a lot of agency agreements. Fees, deliverables, timelines, sometimes a lovely paragraph on “creative ownership.” Data? One line at best.
Add a small clause. Who owns the leads? Where do they sit? Who handles a deletion request? What happens to all of it when you part ways? It protects both sides. The ideas in our post on data processing agreements under the DPDP Act fit right in.
The Boring Habits That Save You
Leaks rarely look like movie hacks. They look like a lead sheet forwarded on WhatsApp. A CSV that’s been sitting in Downloads since April. One shared password for the ad account that six people know. An intern who can open every client’s CRM.
Give people the access their job needs, not more. Use separate logins. Delete exports once the work is done. Yes, boring. Also exactly what prevents that 10 pm panic call.
Before Your Next Launch
Take ten minutes. Does the form say what happens to the data? Is there a clear opt-in for marketing? Where do leads land, and who can see them? Can someone ask to be removed and really get removed? Is the privacy notice live and correct?
If any answer is “umm, not sure,” fix it before launch. Cleaning up later takes far longer.
Read the Act Yourself
Please don’t just trust me. The Ministry of Electronics and Information Technology publishes the Act and the rules. They change now and then, so look at the latest version before you rebuild your process.
Compliance and Conversions Can Coexist
Everyone fears this will kill leads. Mostly it doesn’t. People answer calls from brands they trust. They buy more, and they complain less.
That Delhi agency owner? He added a consent line and a privacy link to every form the same week. Lead numbers dipped a bit. Quality went up. One client stopped losing sleep over a scary email from an unhappy customer. I’d call that a decent trade.
If you want your forms and campaigns checked, book a free consultation. We understand the law and the marketing side, so you won’t walk away with advice that wrecks your funnel.