DPDP Compliance Checklist for Leads and CRM Data

Full disclosure: we build CRMs and lead systems, and data protection is part of what we design in. This is not legal advice. It quotes the Act and the Rules, links each one, and says where a lawyer should decide.

Most DPDP checklists are written for large companies with a data protection officer. This one follows a lead through a typical Indian sales operation: the ad form, the website form, the WhatsApp chat, the recorded call, the CRM, the export and the audience upload.

What do the DPDP Act and Rules require, and by when?#

The Act (No. 22 of 2023) received assent on 11 August 2023. It and the Rules come into force in three steps, set by two notifications in the Gazette dated 13 November 2025: G.S.R. 843(E)↗ (opens in a new tab) for the Act and G.S.R. 846(E)↗ (opens in a new tab) for the Rules.

The dates are counted from the Gazette date; the government's backgrounder↗ (opens in a new tab) gives the notification date as 14 November 2025 and describes "an eighteen-month period for phased compliance".

Two things to watch. In January 2026 MeitY proposed to industry that significant data fiduciaries, the large data handlers the government notifies as such, get twelve months instead of eighteen, which would bring their deadline forward to 13 November 2026, according to a law firm note published by Chambers↗ (opens in a new tab) (23 February 2026). We found no notified change as of 4 October 2026, but check before you plan around May 2027. And the Board exists in law but, as of LiveLaw's report of 1 August 2026↗ (opens in a new tab), had no Chairperson or Members yet, with nominations sought in May and June 2026.

Which lead data is personal data?#

The Act defines personal data as "any data about an individual who is identifiable by or in relation to such data", and it covers digital data, including paper records you later digitise. For a sales team that is almost everything:

• Form fields: name, phone, email, city, budget, course, the project they asked about.
• Chats and calls: WhatsApp messages, voice notes, call recordings and the notes your team types after a call.
• Identifiers: Meta lead IDs, click IDs and ad platform cookies tied to a lead.
• Derived data: lead scores, tags such as "NRI" or "hot", and a salesperson's comments.
• Hashed uploads: customer lists and conversions sent to Meta and Google. Hashing hides the raw value, but the platforms match it to a person, so treat it as personal data.

Company contacts in a B2B pipeline count too, because they are data about identifiable individuals. The Act doesn't cover data a person has made public themselves, or data an individual processes for personal or domestic purposes.

What must a consent notice say, and in which language?#

Section 5 requires a notice with or before every request for consent, and Rule 3 spells out what it must contain:

• an itemised description of the personal data you collect;
• the specific purpose, and the goods or services or uses it enables;
• a link or other means to withdraw consent "with the ease of doing so being comparable to that with which such consent was given", to exercise rights under the Act, and to complain to the Board.

It must be understandable on its own, "in clear and plain language", and the person must be able to read it in English or any language in the Eighth Schedule to the Constitution, which includes Malayalam (sections 5(3) and 6(3)). Consent itself must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to the data needed for the purpose (section 6(1)). If it is ever disputed, the business must prove the notice was given and consent obtained (section 6(10)).

Not every lead needs a separate consent click. Section 7(a) lets a business use data for "the specified purpose for which the Data Principal has voluntarily provided her personal data", and the Act's own example is a real estate broker: a person messages the broker for help finding a rented flat, the broker may use her details to send suitable options, and must stop once she says she no longer needs help. Replying to an enquiry is fine. In our reading, adding the same person to a marketing list, a lookalike audience or a lead score that drives ad spend is a different purpose, and needs a notice that names it.

For people who gave their consent before these duties start in May 2027, section 5(2) requires a notice "as soon as it is reasonably practicable" describing the data and purpose; until the person withdraws consent, you may carry on.

How should a CRM handle access, correction and erasure requests?#

The rights in sections 11 to 14 turn into CRM features:

• Access (section 11): a summary of the data you hold and what you do with it, plus the other businesses and processors you shared it with. A CRM that can't list which vendors and ad platforms received a lead's data can't answer this.
• Correction and erasure (section 12): correct, complete or update on request, and erase unless retention is needed for the purpose or by law. Rule 8(3) separately requires keeping personal data and processing logs for at least one year from the processing, for specified government purposes; its own example has an e-book platform keeping order records for a year after the customer deletes her account. Ask your lawyer how that year interacts with an erasure request.
• Grievances (section 13): publish how people can complain and answer "within a reasonable period not exceeding ninety days" (Rule 14(3)). People must use your process before going to the Board.
• Who to ask (Rule 9): publish the contact details of a person who can answer questions about your processing, and include them in every reply to a rights request.

In practice: one place to search a person across leads, deals, chats and recordings; a logged erasure action; role-based access so not everyone can export everything; and an audit trail. Xale, the CRM built by the team behind Marketlube, makes exporting leads a permission set for each role and keeps phone numbers out of exports for staff other than admins, as xale.in describes it↗ (opens in a new tab). Our post on building a CRM that scales covers role-based access and audit logs in more depth.

What about call recordings, WhatsApp chats and audience uploads to Meta and Google?#

Call recordings are personal data with unusually rich content. Tell callers at the start that the call is recorded and why, limit playback by role, and set a retention period. In Xale, call logging and recording↗ (opens in a new tab) stay off for every role until an admin switches them on, as xale.in describes it. Under section 8(7), data must be erased once the purpose is no longer served, unless the law requires otherwise. In the Gulf, take local legal advice before recording calls at all.

WhatsApp chats carry their own rules. The WhatsApp Business Messaging Policy↗ (opens in a new tab) (updated 23 September 2026) lets you message only people who gave you their number and opt-in permission, requires you to honour opt-outs made on or off WhatsApp, and bans asking for full card, bank account or ID numbers in chat. If an AI assistant handles the first reply, the notice applies to it too; our guide to WhatsApp AI chatbots covers consent inside chats, and the WhatsApp CRM guide covers broadcasts and the UAE's telemarketing rules.

Audience and conversion uploads need a legal basis you can show. Meta's Customer List Custom Audiences Terms↗ (opens in a new tab) (effective 3 December 2025) make you warrant that you have "all necessary rights and permissions and a lawful basis" for the data, and require you to remove people who opt out of that use. Google's Customer Match policy↗ (opens in a new tab) allows only data collected in a first-party context, and requires your privacy policy to disclose that you share customer data with third parties for services, with consent where the law requires it. The same logic covers sending CRM stages back for bidding, which our guide to offline conversion tracking explains.

Our own site is set up this way. On marketlube.in, GA4 and Microsoft Clarity load only after a visitor accepts, with every advertising signal denied. The contact form hands the brief to WhatsApp and stores nothing on our server, and the form's links carry nothing the visitor typed until they are clicked. We also keep a consent register recording, for every client name and number on the site, who approved it and whether written client approval is on file.

What do TRAI's rules mean for calls and SMS to leads?#

The DPDP Act sits alongside TRAI's rules on commercial calls and messages. The Telecom Commercial Communications Customer Preference (Second Amendment) Regulations, 2025↗ (opens in a new tab) (12 February 2025) added several things a sales team should know:

• SMS headers end in -P, -S, -T or -G so recipients can tell promotional, service, transactional and government messages apart.
• Promotional calls belong on the 140 series, and TRAI notes that DoT has allotted the 1600 series for service and transactional calls.
• A call to help complete a purchase the person asked about counts as a service call only if it isn't promotional and they gave explicit consent, which lasts seven days unless TRAI directs otherwise.
• Complaints must be made within seven days, and complaints from five or more people within ten days can get the sender's telecom resources suspended pending investigation.

Cold-calling a bought list from staff mobiles is exactly what these rules target. Calling back someone who asked you to is a different matter, but keep the record of their request on the lead.

What counts as reasonable security, what is a breach, and what are the penalties?#

Rule 6 lists the minimum safeguards: encryption, masking or tokens for personal data; access controls; logs and monitoring to detect unauthorised access, kept for a year; backups so work can continue after an incident; security clauses in contracts with processors; and organisational measures that make it all stick. The business stays responsible for what its vendors do on its behalf (section 8(1)). If your CRM, WhatsApp provider or call-tracking tool is custom or self-hosted, these become build requirements, which is where custom software development has to plan them from the first sprint. The CRMs we set up run on Xale (reported by our team), and xale.in's platform page↗ (opens in a new tab) publishes its access controls, hourly backups and admin log.

A personal data breach is "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access" that compromises its confidentiality, integrity or availability. A leaked lead export, a salesperson leaving with a downloaded list or a misconfigured shared drive can all count. Rule 7 then requires you to tell each affected person "without delay", and to tell the Board without delay and send it a detailed report "within seventy-two hours of becoming aware of the breach".

The penalties, from the Schedule to the Act, run up to:

Children deserve a line of their own if you sell admissions or coaching. Before processing data of anyone under 18 you need verifiable consent from a parent (section 9(1), Rule 10), and section 9(3) bans tracking, behavioural monitoring and "targeted advertising directed at children". The Rules' exemption for educational institutions covers tracking and monitoring for their educational activities and the safety of enrolled children, not marketing.

What changes when you sell to the UAE or Saudi Arabia?#

India's Act covers data collected in India wherever your team sits, and it also applies to processing outside India when it is connected to offering goods or services to people in India (section 3(b)). The Gulf adds its own laws:

• UAE: Federal Decree-Law No. 45 of 2021 is the national law, with separate regimes in the DIFC and ADGM free zones. Its implementing regulations "have yet to be issued", according to Chambers' 2026 UAE guide↗ (opens in a new tab) (updated 10 March 2026), but the DIFC and ADGM regimes already apply in their free zones; under ADGM's regulations, for instance, a breach must be notified within 72 hours.
• Saudi Arabia: the Personal Data Protection Law has been in force since 14 September 2023, with a grace period to 14 September 2024, according to SDAIA's guide↗ (opens in a new tab), which also says sensitive data may not be used for marketing even with consent. SDAIA announced 48 decisions against organisations that broke the law, and its review committees can fine up to SAR 5 million, according to Latham & Watkins↗ (opens in a new tab) (15 May 2026).

If a meaningful share of your leads sits in the Gulf, get local advice on consent wording, call recording and where the data is stored.

The checklist#

Frequently asked questions#

When does the DPDP Act come into force for businesses?#

The duties that matter to most businesses, including notice, consent, security, breach reporting and people's rights, apply from 13 May 2027, eighteen months after the Rules were published on 13 November 2025. Consent managers can register from 13 November 2026. The Data Protection Board's provisions have applied since 13 November 2025.

Does the DPDP Act apply to small businesses?#

Yes. The Act sets no size threshold: any business that processes digital personal data in India, or offers goods or services to people in India, must follow it. Section 17(3) lets the government exempt classes of businesses, including startups, from some duties by notification, but we found none notified as of 4 October 2026. Extra obligations, such as impact assessments and audits, apply only to businesses notified as significant data fiduciaries.

Do I need consent to call a lead who filled in my form?#

Usually not for responding to that enquiry, because section 7(a) allows using data a person voluntarily provided for the purpose they provided it. You do need a notice and consent for other purposes, such as marketing messages or ad audiences. Telecom rules apply separately: promotional calls belong on the 140 series under TRAI's regulations.

What are the penalties under the DPDP Act?#

Up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to report a breach or breaking the rules on children's data, up to ₹150 crore for breaking the extra duties of a significant data fiduciary, and up to ₹50 crore for other breaches, according to the Schedule to the Act.

Do I need a data protection officer?#

Only if the government notifies you as a significant data fiduciary. Every business must still publish the contact details of a person who can answer questions about its processing (Rule 9).

What to do next#

Take one recent lead and trace where its data went: the form, the CRM, WhatsApp, the call recording, any export and any ad upload. Each stop is a row in the checklist above. If your CRM can't answer "who has this person's data, and why?", that is the first fix. If you want help building those answers into the system, tell us how your leads flow today; for the legal reading of your own case, involve a lawyer before May 2027.

Changelog#

• 2026-10-12: Added three examples from Xale, the CRM built by the team behind Marketlube, each linked to the xale.in page that describes it: exports as a per-role permission, call recording off until an admin switches it on, and the platform's published access controls, backups and admin log (the CRMs we set up run on it, reported by our team). The link to xale.in's platform page now sits on the words that name that page.