We buy contact lists and run outbound in India. What do the DPDP rules and TRAI's spam rules change for us?
Two sets of rules apply, on different clocks. The Digital Personal Data Protection Act and the DPDP Rules 2025, notified in November 2025, bind fully from 13 May 2027, and a named person's work email or mobile number is personal data like any other, so a cold list is personal data you are processing. Consent has to be specific and as easy to withdraw as to give, and people can ask what you hold on them and have it erased. The Act does not cover data a person has made public themselves, which is where most of the argument about professional profiles sits, but a bought list rarely shows where each record came from, so make vendors state the source of every record and keep it. Calls and SMS are regulated already: since TRAI's February 2025 amendment, promotional calls belong on registered 140-series numbers rather than ordinary ten-digit mobiles, and five complaints in ten days against an unregistered sender can bar every number it holds for 15 days, and disconnect them for a year on a repeat. That can mean your reps' own phones. Before you scale, make one suppression list that every tool respects, record consent where you collect it, delete lists you no longer use, and put your calling on a legal footing.
Go deeper
4 resources, 4 India-specific, 4 link-checked.
📊 Report
✓ Link checkedIndiaFreeBeginner
The government's own plain-language backgrounder on the DPDP Act and the Rules notified in November 2025: what a data fiduciary must do, what rights people have, and what the penalties are.
A short news report of TRAI's February 2025 amendment to the telecom commercial communication rules, which govern every promotional call and SMS a sales or marketing team in India sends.
Telemarketers can no longer use ordinary ten-digit numbers: promotional calls go on the 140 series and service and transactional calls on the new 1600 series.
Action against an unregistered sender now starts at five complaints in ten days, and operators must act within five days.
A first violation bars outgoing services on all of the sender's telecom resources for 15 days; a repeat disconnects them for a year and blacklists the sender.
Customers can now complain up to seven days after receiving spam, up from three.
An Inc42 feature from April 2026 on what the DPDP rollout asks of startups and small companies, with the phased dates and where practitioners say a small team should start.
The DPDP Rules 2025 run on an eighteen-month rollout, with consent manager obligations from November 2026 and core operational requirements from 13 May 2027.
The law applies uniformly, so small companies carry a heavier relative burden than large ones.
Suggested starting point for a small company: find and classify the personal data you hold, handle access and deletion requests, and set purpose and retention rules.
If you sell into Indian enterprises, DPDP is now part of the security review alongside SOC 2. This lays out the obligations that show up in a buyer's DPA: consent, breach notification to the Data Protection Board, deletion rights and cross border transfer limits.
Penalties run up to Rs 250 crore for failing to implement reasonable security safeguards.
A SaaS platform serving Indian users is a data fiduciary, accountable for what it collects, processes and stores.
Consent must be clear, informed and purpose specific, and children under 18 need verifiable parental consent.
Breaches must be reported to the Data Protection Board of India and to affected users, and the government can restrict transfers to countries it notifies.
