Cold email laws
DPDP Act (India): What It Means for Cold Email
Not in force for cold email yet. India's DPDP Act is consent-based with no business contact exemption, but its core duties start 18 months after November 13, 2025. Then emailing professionals in India needs consent unless they made the data public. Consent breaches can cost up to INR 50 crore.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under the DPDP Act?
In short Not regulated yet in practice: the consent, notice and penalty rules start 18 months after November 13, 2025; after that, cold email to individuals in India needs consent unless they made the data public themselves.
The Digital Personal Data Protection Act, 2023 starts in phases under a notification dated November 13, 2025 (G.S.R. 843(E)). The definitions and the Data Protection Board took effect on publication, consent manager rules follow after one year, and the duties that matter for cold email (notice, consent, legitimate uses, rights and penalties) start eighteen months after publication. On October 17, 2026 those duties are not yet in force.
Once they start, the model is consent-based. You may process an individual's personal data only with consent or for a listed legitimate use (section 4), and none of the legitimate uses in section 7 covers marketing. A work email of an identifiable person is personal data, and the Act has no business contact exemption. It does not apply to personal data the person made publicly available themselves (section 3(c)(ii)).
The Act reaches companies outside India that process data in connection with offering goods or services to people in India (section 3(b)). We found no Indian anti-spam statute for email: the telecom regulator's TCCCPR 2018 rules cover voice calls and messages over telecom services.
What Do You Need to Do Under the DPDP Act?
In short 6 rules apply to a cold email program under the DPDP Act.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Lawful ground | Consent, or a listed legitimate use. Marketing is not a listed use. | For individuals in India, plan to rely on consent, or document that the person published the data themselves so the Act does not apply. | DPDP Act s 3(c)(ii), 4(1) and 7 |
| Notice with every consent request | Each consent request needs a notice of the data and the purpose, how to withdraw consent and exercise rights, and how to complain to the Board. | Use a standalone plain-language notice before or with any consent request. | DPDP Act s 5(1); DPDP Rules 2025, rule 3 |
| Valid consent | Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, in clear and plain language. | Use opt-in forms or replies, never pre-ticked or bundled consent. | DPDP Act s 6(1) and 6(3) |
| Easy withdrawal and erasure | Withdrawing consent must be as easy as giving it, and you must erase the data once consent is withdrawn or on request. | Offer a one-click opt-out, then delete the contact. | DPDP Act s 6(4), 8(7)(a) and 12(3) |
| Contact person and grievances | Publish the business contact of a person who answers data questions, and run a grievance process with replies within 90 days. | Put a privacy contact on your site and answer requests within 90 days. | DPDP Act s 8(10) and 13; DPDP Rules 2025, rule 14(3) |
| Responsibility for vendors | You stay responsible for processing done on your behalf, which needs a valid contract with the processor. | Sign contracts with sending platforms and list vendors that process data for you. | DPDP Act s 8(1) and 8(2) |
What Are the Penalties Under the DPDP Act?
In short Maximum penalty: INR 250 crore; INR 50 crore for consent and notice breaches.
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| Breach of any other provision, such as notice, consent or erasure duties | INR 500,000,000 (INR 50 crore) | about USD 5.3 million | DPDP Act s 33 and Schedule item 7 |
| Failure to take reasonable security safeguards | INR 2,500,000,000 (INR 250 crore) | about USD 26.3 million | DPDP Act s 33 and Schedule item 1 |
| Failure to notify a personal data breach | INR 2,000,000,000 (INR 200 crore) | about USD 21.1 million | DPDP Act s 33 and Schedule item 2 |
USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16.
Only the Data Protection Board can impose penalties, after an inquiry, on a breach report, a complaint or a government reference (sections 27 and 33). A person must first use the company's own grievance process (section 13(3)), civil courts have no jurisdiction over matters the Board handles (section 39), and appeals go to the Telecom Disputes Settlement and Appellate Tribunal. The penalty and inquiry sections are not in force yet.
What Enforcement Has There Been Under the DPDP Act?
In short No enforcement action yet; the note below explains why.
None yet. The Board's inquiry and penalty powers start 18 months after November 13, 2025. On August 12, 2026 the government told the Lok Sabha that the advertisement to recruit the Board's chairperson and members was published on June 6, 2026, and it reported no appointments or enforcement.
Cold Email Checklist for the DPDP Act
- List which contacts are individuals in India, and where each address came from.
- Flag addresses the person published themselves; the Act does not apply to that data.
- For everyone else, plan to rely on consent once the core rules start; marketing is not a legitimate use.
- Prepare a plain-language notice for consent requests that lists the data, the purpose and how to withdraw.
- Make withdrawal as easy as giving consent, and delete data when consent is withdrawn.
- Publish a privacy contact and answer grievances within 90 days.
- Sign contracts with sending platforms and list vendors that process data for you.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under the DPDP Act, that will include consent and notices for contacts in India once the core rules start.
FAQ
Is the DPDP Act in force for cold email now?
Not its operative parts. Notice, consent, rights and penalty provisions start eighteen months after the November 13, 2025 notification. Today only the definitions, the Board and rule-making powers are in force.
Does the DPDP Act apply to business email addresses?
Yes. A work email of an identifiable individual is personal data (section 2(t)), and the Act has no business contact exemption. It does not apply to personal data the individual made publicly available themselves (section 3(c)(ii)).
Can I rely on legitimate interest for cold email in India?
No such ground exists. Section 7 lists specific legitimate uses, none of which is marketing, so consent is the default basis (section 4(1)).
Does India have an anti-spam law for email?
We found none. TRAI's TCCCPR 2018 regulations cover voice calls and messages over telecom services, not email marketing.
What is the maximum DPDP fine for a marketing consent breach?
Up to INR 50 crore under item 7 of the Schedule. The top tier, INR 250 crore, is for failing to take reasonable security safeguards.
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- GDPR: What It Means for Cold Email
Legitimate interest; consent rule varies by country
- Singapore PDPA: What It Means for Cold Email
Allowed, opt-out; bulk email needs an <ADV> label and an unsubscribe
- LGPD (Brazil): What It Means for Cold Email
Allowed on legitimate interest, opt-out
- Ken anti-spam policy
Sources
Changelog
- Page published.