Short answer: India’s DPDP consent rules are not in force yet. The consent standard, the notice duty and every monetary penalty commence eighteen months after the 13 November 2025 gazette — around 13 May 2027. What binds your marketing messages today is TCCCPR. Build the consent record now, because the Act puts the burden of proof on you.
Almost every guide to the Act tells Indian marketers they are already late. The two gazette notifications say otherwise. We sell voice and messaging campaigns, including the IVR product costed below, so treat the channel comparison as interested.
What is actually in force today
Two notifications were signed the same day by the Ministry of Electronics and Information Technology. G.S.R. 843(E) appoints commencement dates for the Act; G.S.R. 846(E) notifies the DPDP Rules, 2025. Both split their contents into three tranches. Rule 1(4): “Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.”
| Tranche | Act provisions | Rules | What it means for marketing |
|---|---|---|---|
| On publication 13/14 Nov 2025 | s. 1(2), s. 2, ss. 18–26, ss. 35, 38–43, s. 44(1) and (3) | Rules 1, 2, 17–21 | The Data Protection Board exists. The definitions bite. No consent duty on you yet. |
| One year 13/14 Nov 2026 | s. 6(9), s. 27(1)(d) | Rule 4 | Consent Managers can register with the Board. Nothing you must do. |
| Eighteen months 13/14 May 2027 | ss. 3–5, s. 6(1)–(8) and (10), ss. 7–17, s. 27 (except (1)(d)), ss. 28–34, 36, 37, s. 44(2) | Rules 3, 5–16, 22, 23 | Consent, notice, children’s data, data-principal rights — and every penalty. |
Read the third row twice. Section 6, the standard of consent, sits there. So does section 5, the notice duty, and sections 28 to 34, which carry the Board’s power to impose the Schedule’s penalties. On 18 October 2026 there is no DPDP consent obligation on a Data Fiduciary and no DPDP penalty for failing one. Nor is there a gap: section 44(2), which omits the old remedy in section 43A of the Information Technology Act, is itself in the eighteen-month tranche, so that remedy survives while the new regime is dormant.
Every date above hangs on “the date of publication”, and the official sources differ by a day. Both notifications are printed “New Delhi, the 13th November, 2025”, yet their e-gazette references read CG-DL-E-14112025, and the Press Information Bureau says the Rules were notified “on 14 November 2025”. We cannot say which counts as publication, so treat each date as one day wide.
Two different consents, and only one binds today
DPDP’s dormancy is not a licence, because your marketing messages are already regulated — by a different regulator. TCCCPR 2018 defines consent as “any voluntary permission given by the customer to sender to receive commercial communication”, and regulation 9 permits it only “as per the preference(s) or digitally registered consent(s) registered in accordance with these regulations” — held on the access provider’s register, not in your database.
They are not substitutes, and from May 2027 you need both. TCCCPR consent permits commercial communication on a channel; section 6 consent permits processing personal data for a specified purpose, and must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” and “limited to such personal data as is necessary”. Neither implies the other, so collect to the stricter standard. Our notes on message categories and DLT registration cover the TCCCPR side.
| TCCCPR registered consent | DPDP consent | |
|---|---|---|
| What it buys you | Delivery past a DND preference | A lawful basis to process the personal data |
| Who holds the record | The access provider, on its consent register | You, the Data Fiduciary |
| How it is captured | Consent template plus OTP authentication | Clear affirmative action, after a standalone notice |
| What must precede it | Registered header and template | A notice itemising the data and the purpose |
| How it ends | Revocation through the operator | Withdrawal “with the ease of doing so being comparable” to giving it |
| Source | TCCCPR 2018, Schedule-I item 4 and Schedule-II | DPDP Act s. 5, s. 6; DPDP Rules 2025 rule 3 |
There is no legitimate-interest route to marketing
When sections 4 and 7 commence in May 2027, they will not give marketers a shortcut. Section 4 allows processing on consent or on “certain legitimate uses”, and section 7 lists those uses exhaustively: clause (a) covers data the person “has voluntarily provided … for the specified purpose”, and the remaining clauses cover the State, legal obligations, court orders, medical emergencies, epidemics, disasters and employment. Advertising is not on that list, and section 9(3) prohibits “targeted advertising directed at children” outright. An existing customer relationship is a basis to process data for the purpose it was given for, not a basis to market. To send an offer, you will need consent for offers.
You probably do not have to re-permission your list
This is the most expensive misreading in circulation, and section 5(2) disposes of it. Where consent was given “before the date of commencement of this Act”, the Data Fiduciary must “as soon as it is reasonably practicable, give to the Data Principal a notice” stating the personal data and the purpose processed — and then, in clause (b), “may continue to process the personal data until and unless the Data Principal withdraws her consent.”
The obligation attached to an existing consented list is therefore a notice, not a fresh opt-in: a one-way message, not a campaign that must win a response. The mass re-permissioning now being sold across the market is, on the face of the Act, the wrong project.
The real obligation is proof — and what the notice must say
Section 6(10) is the clause to design your systems around. Where consent is the basis of processing and a question arises in a proceeding, “the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal” in accordance with the Act. The burden is yours, it covers the notice as well as the consent, and it bites retrospectively: in 2027 you will be proving things about records you are writing now. A boolean and a timestamp will not discharge it.
Rule 3 says what the notice must contain. It must “be presented and be understandable independently of any other information” the Data Fiduciary has made available — ruling out a tick box pointing at a privacy policy. It must give, in plain language, at minimum “an itemised description of such personal data” and the specified purposes. And it must offer withdrawal “with the ease of doing so being comparable to that with which such consent was given”. So “itemised” means a list of fields, not “contact details”; and if consent came from a keypress, an opt-out in an email footer is not comparable.
Consent Managers arrive first, in about four weeks
Rule 4 and section 6(9) commence one year after publication — 13 or 14 November 2026, 26 days from the date on this post. They let a Consent Manager register with the Board so a person can “give, manage, review or withdraw her consent” through one interoperable platform. Part A of the First Schedule sets the bar: a company incorporated in India, independent certification, and a net worth “not less than two crore rupees”. Nothing here obliges a marketer to act — but any vendor offering to be your Consent Manager today is selling a status that does not yet exist.
What collecting consent actually costs
If you do need to ask, the channel is a price decision. Rates verified on 18 October 2026: Plivo publishes ₹0.38 per minute for domestic outbound voice with “Pulse is 30 seconds”, so one pulse is ₹0.19. AiSensy’s India card, effective 1 October 2026, publishes ₹1.09 per delivered marketing message and ₹0.145 for utility.
Which category is a consent request? Meta lists “Opt-In Management on WhatsApp” under utility — but every example confirms a choice already made: “Thanks for confirming opt-in! You’ll now receive notifications via WhatsApp.” Utility templates “must be non-promotional, not containing any promotional or persuasive intent”. Meta publishes no rule on soliciting consent, so we give the wording and leave the conclusion to you — but the cheap rate attaches to confirming consent, not harvesting it.
Then the layer that never appears on an invoice. Meta charges on delivery; a voice pulse is charged only when the call is answered. So for voice, cost per recorded consent is the pulse price divided by the share of answered calls that consent — and the answer rate cancels out entirely, because an unanswered dial costs nothing: ₹0.95 at a 20% consent rate whether 10% or 50% of the list picks up. WhatsApp marketing has no such cancellation — every delivered message is billed, read or not. We publish no opt-in rate and will not estimate one, so the rows below are scenarios, not forecasts.
| Consent rate among reached | IVR, one 30s pulse | IVR, two pulses | WhatsApp marketing | WhatsApp ÷ IVR (1 pulse) |
|---|---|---|---|---|
| 5% | ₹3.80 | ₹7.60 | ₹21.80 | about 5.74× |
| 10% | ₹1.90 | ₹3.80 | ₹10.90 | about 5.74× |
| 20% | ₹0.95 | ₹1.90 | ₹5.45 | about 5.74× |
| 40% | ₹0.475 | ₹0.95 | ₹2.725 | about 5.74× |
On a 50,000-contact list, carriage only and before tax: asking by IVR costs ₹9,500.00 at one pulse per answered dial, and ₹19,000.00 if the script runs past 30 seconds — a 31-second recording doubles the bill. Asking by WhatsApp marketing costs ₹54,500.00. The cheapest shape we can cost is to ask by voice and confirm by utility template: at a 20% consent rate, ₹1.095 per recorded and confirmed consent against ₹5.45 for WhatsApp marketing alone. See pulse rounding, template categories, cost per completed call, the channel comparison, the pricing pillar and our pricing page.
The penalties, and when they can bite
The Schedule’s figures are real. Failing to take reasonable security safeguards: ₹250 crore. Failing to notify a breach: ₹200 crore. Breaching section 9 on children’s data: ₹200 crore. A Significant Data Fiduciary’s extra obligations: ₹150 crore. Any other breach: ₹50 crore. But section 33(1) is the power to impose them, and section 33 sits in the eighteen-month tranche — so for now those numbers are a planning input, not an exposure.
The checklist
- Keep complying with TCCCPR. It binds today; DPDP’s dormancy changes nothing about headers, templates, number series and preferences, or the consent register.
- Do not mass re-permission on DPDP’s strength alone. Section 5(2) asks for a notice, not a fresh opt-in. Write it now and keep a dated copy of what went to whom.
- Log consent so it can be proved, not merely queried: notice text as displayed, itemised fields, purposes, channel, timestamp, withdrawal route.
- Build the notice to rule 3: standalone, plain language, itemised data, specific purposes, a working withdrawal link — and make withdrawal as easy as consent was.
- Separate the two consents in your data model — channel permission and processing consent are different records.
- Treat purpose as a field, not a sentence — consent is limited to what the specified purpose needs, so a new purpose needs a new ask.
- If you process children’s data, start early. Verifiable parental consent and section 9(3)’s ban on tracking and targeted advertising carry the ₹200 crore band.
- Ignore anyone selling Consent Manager status before 13 November 2026. The register does not exist until rule 4 commences.
Frequently asked questions
Is the DPDP Act in force in India right now?
Partly. As of 18 October 2026 the provisions establishing the Data Protection Board and the definitions are in force. The consent standard, the notice duty, the data-principal rights and every penalty are not: they commence eighteen months after the 13 November 2025 gazette, so around 13 May 2027.
Do I need fresh consent from everyone on my existing list?
Not under the Act, on its face. Section 5(2) requires a notice to people who consented before commencement, and says you may continue processing until they withdraw. TCCCPR obligations are separate.
Is my DLT consent enough for DPDP?
Nothing published says so. They are different records, held by different parties, captured and withdrawn differently. Assume you need both until told otherwise in writing.
Can I use a cheap utility template to ask for marketing consent?
Meta lists opt-in management under utility, but every published example confirms a choice already made, and utility templates must carry no promotional or persuasive intent. Meta publishes no rule on soliciting consent. On the wording, ₹0.145 attaches to confirming consent, not asking for it.
What is the largest DPDP penalty, and who imposes it?
Up to ₹250 crore, for failing to take reasonable security safeguards against a personal data breach. The Data Protection Board imposes it under section 33(1) after an inquiry — and section 33 is in the eighteen-month tranche, so nothing can be imposed before it commences.
How we verified this. Every figure, date and quotation above was checked against a live primary source on 18 October 2026, and we name the source and the date we read it. We publish no engagement, response or opt-in rates of our own, and no xreach51 pricing. Where two official sources disagree — as they do on the publication date — we show both rather than pick one.
What we could not verify. We found no published opt-in or consent-conversion rate for an Indian re-permission campaign, so the table gives scenarios rather than an expected yield. We have no dated Central Board of Indirect Taxes and Customs citation for the 18% GST rate on telecom services, so this post leaves the tax layer out entirely; all rupee figures are carriage only, before tax. We found no instrument stating whether DLT registration extends to WhatsApp traffic, and state that as an absence rather than a conclusion. Meta’s template-guidelines page showed no page-level updated date today. This post is a reading of published instruments, not legal advice.
Sources
- Ministry of Electronics and Information Technology, G.S.R. 843(E) — commencement of the Digital Personal Data Protection Act, 2023, dated 13 November 2025. Read 18 Oct 2026.
- Ministry of Electronics and Information Technology, G.S.R. 846(E) — Digital Personal Data Protection Rules, 2025, dated 13 November 2025. Read 18 Oct 2026.
- India Code, The Digital Personal Data Protection Act, 2023 (Act 22 of 2023). Read 18 Oct 2026.
- Press Information Bureau, “DPDP Rules, 2025 Notified”, 17 November 2025. Read 18 Oct 2026.
- TRAI, Telecom Commercial Communications Customer Preference Regulations, 2018. Read 18 Oct 2026.
- Meta, WhatsApp template guidelines. Read 18 Oct 2026; no page-level updated date shown.
- Plivo, India voice pricing — ₹0.38/min domestic outbound, “Pulse is 30 seconds”. Read 18 Oct 2026.
- AiSensy, pricing — India card effective 1 October 2026, ₹1.09 marketing and ₹0.145 utility per delivered message. Read 18 Oct 2026.