DPDP Act for Marketing Agencies, Ad Tech & Media Companies
Marketing agencies, ad-tech companies, publishers, influencer networks and lead-generation firms work with personal data every day: audience lists, tracking identifiers, leads, CRM exports and campaign data. The DPDP Act and Rules change what you can collect, what you can buy and what you must be able to prove.
Marketing now needs a lawful basis you can show. For most marketing that basis is consent: specific, free, informed and easy to withdraw. Purchased or scraped lists with no consent trail are a liability. Agencies usually act as Data Processors for clients, making written contracts essential, but when an agency uses client data for its own purposes it becomes a fiduciary. Targeting children is barred. Most duties take effect on 13 May 2027.
Who this covers
Brands and advertisers are Data Fiduciaries for their customer and prospect data, including what they give to agencies.
Digital, PR and performance agencies are usually processors for client data and fiduciaries for their own staff and leads.
Ad-tech, DSPs, DMPs and data-enrichment firms are fiduciaries or processors depending on who decides the purpose.
Publishers, news and media companies are fiduciaries for subscriber, reader and ad-tracking data.
Influencer platforms and lead-generation firms collect and pass on personal data at scale.
Personal data you are likely to hold
Key provisions for Media, Advertising & Marketing
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Itemised notice and consent that is specific, free, informed and as easy to withdraw as to give.
Personal data made public by the person herself is outside the Act, but only to that extent. Personal and household use is also outside.
A fiduciary may use a processor only under a valid contract and stays responsible for the processing.
No tracking, behavioural monitoring or targeted advertising aimed at children.
Large ad-tech and media platforms could be notified as Significant Data Fiduciaries.
Consent can be withdrawn, and processing must then stop.
Penalties up to ₹250 crore for security failures and ₹200 crore for breach-reporting failures.
01Marketing consent and purchased lists
Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the purpose and data necessary. For marketing:
- Separate tick-boxes for email, SMS, WhatsApp and calls, and no pre-ticked boxes.
- A record of who agreed, when, to what notice and through which form.
- Withdrawal as easy as giving consent, with a working unsubscribe and prompt action on it.
Bought lists, scraped contacts and lists of unknown origin are a problem because you cannot show consent for them. Build your own opted-in audience, and ask any data supplier for proof of consent and the notice shown.
02Agency and client roles
An agency running campaigns with a client's customer data is normally a Data Processor. Section 8 allows a fiduciary to use a processor only under a valid contract, and the client stays responsible. Expect, and offer, a data processing agreement covering:
- Processing only on the client's instructions and for the agreed campaign.
- Security at the level of Rule 6, including access control and encryption of exports.
- Approval of sub-processors such as email, SMS and analytics tools.
- Deletion or return of data when the campaign or contract ends.
- Prompt breach notice, so the client can meet Rule 7.
If the agency reuses client data to build its own audience database or benchmark products, it decides its own purpose and becomes a fiduciary for that use, so it needs its own lawful basis.
03Cookies, tracking and ad tech
Cookies, pixels, device IDs and advertising IDs identify people, so they are personal data. For non-essential tracking such as cross-site profiling and retargeting, rely on consent, load tags only after consent, and honour refusal. Disclose the main ad-tech partners and what each does.
Make cookie and tracking choices easy to find again and change. If your ad stack involves several partners, check the contracts, because consent collected on a publisher's site has to carry through the chain in a way that can be shown later.
04Children and sensitive audiences
Section 9 bars tracking, behavioural monitoring and targeted advertising directed at children. Brands selling toys, games, education or youth products should review how segments are built, since an audience skewing young could include children. Do not build look-alike audiences from child accounts, and keep campaigns for children contextual, not behavioural.
05Publishers, creators and public data
Publishers hold subscriber lists, reader behaviour, newsletter sign-ups and comments, covered like any other personal data. The Act makes an exception for personal data the person has made publicly available herself (Section 3), but this covers only that data and does not allow you to compile profiles or contact people for marketing. The Act has no dedicated journalism exemption, so check the text and take advice if your newsroom relies on one.
Influencer and creator campaigns should treat follower and engagement data held by platforms as the platforms' data, and collect only what the campaign needs, such as contact details for giveaways, with a proper notice.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Check the client's consent covers the campaign, work only under a written contract, secure the file and delete it when the campaign ends.
Without a consent trail you cannot show a lawful basis. Ask for proof of consent and the notice shown, or build your own list.
Stop sending promptly and update every system and partner that sends on your behalf.
That is a child's data. You need parental consent and cannot use it for targeting.
Tell the client straight away. The client, as fiduciary, then notifies affected people and the Board.
Compliance checklist
Common mistakes to avoid
Assuming a consent collected years ago for something else covers a new campaign.
Buying lists "with consent" and never asking for proof.
Emailing campaign exports around in plain spreadsheets.
Treating the client's data as the agency's own asset.
Ignoring unsubscribe requests in a partner's system.
Common questions
Can we still run email and SMS marketing?
Yes, with valid consent that you can prove, a clear notice and a working way to withdraw. TRAI's rules on commercial communications also continue to apply.
Is an agency a Data Fiduciary or a Data Processor?
Usually a Data Processor for client data, as long as it acts on the client's instructions. It is a fiduciary for its own staff, leads and any data it uses for its own purposes.
Can we use publicly available data for outreach?
The exception covers personal data made public by the person herself, but only to that extent. It does not give you a right to profile people or to contact them for marketing.
Are cookies covered?
Cookie and device identifiers that relate to an identifiable person are personal data, so notice and consent rules apply to non-essential tracking.
Can we target teenagers?
No. Targeted advertising and behavioural monitoring aimed at children are barred unless an exemption applies, and under-18s are children.
What happens if a client's data leaks from an agency tool?
The client, as Data Fiduciary, remains responsible and must notify people and the Board. The agency must tell the client promptly under the contract.