Most marketing teams are treating this like a 2027 problem. It isn’t. DPDP Act compliance is already unfolding in phases, and the middle phase, Consent Manager registration, activates in November 2026, well before the headline deadline most people have circled. At PROHED, a performance marketing agency in Gurgaon handling lead forms, pixels, WhatsApp campaigns, and CRM data for clients across categories, we’re treating this as infrastructure work that needs to start now, not a compliance task to slot in closer to the deadline.
The Actual DPDP Timeline: Three Dates, Not One
The Digital Personal Data Protection Act received presidential assent back in August 2023, but it stayed largely dormant until the DPDP Rules 2025 were notified on 13 November 2025. That notification set off a three-phase rollout that most compliance content flattens into a single “2027” date, which is a mistake.
Phase | Date | What Activates |
Phase 1 | 13 November 2025 | Data Protection Board of India established, core definitions become operative |
Phase 2 | 13 November 2026 | Consent Manager registration framework opens |
Phase 3 | 13 May 2027 | Full substantive obligations and penalty enforcement come into force |
The middle date is the one most marketing teams haven’t clocked, and by the time this article is being read, it’s likely less than a year away. Waiting until early 2027 to start building consent infrastructure means rebuilding it under live enforcement pressure rather than on your own timeline.
What Counts as Personal Data Under DPDP, and Who’s Responsible
The Act uses two core roles worth understanding before anything else. A data fiduciary is the entity deciding why and how personal data gets processed, meaning most marketing teams and the companies they work for. A data principal is the individual the data belongs to, your lead, your customer, your WhatsApp subscriber.
Purpose limitation is the principle that trips up marketing teams most often: data collected for one stated purpose (say, a lead form for a webinar) can’t automatically be repurposed for something else (like ongoing promotional WhatsApp messages) without separate, specific consent for that new purpose.
What Changes for Lead Forms
Most lead forms today collect broad consent with a single checkbox covering everything from email marketing to WhatsApp to third-party sharing. Under DPDP, that approach doesn’t hold up.
Lead form consent needs to be:
- Specific to purpose, meaning separate consent for marketing communications versus service-related contact versus third-party sharing, rather than one blanket checkbox
- As easy to withdraw as it was to give, so a form that makes opting in a single click but opting out a multi-step process creates real compliance risk
- Recorded with a clear timestamp and version, since you’ll need to demonstrate what someone actually consented to and when, not just that consent exists somewhere
Pre-ticked checkboxes and consent bundled into terms of service someone never actually reads are both squarely in the risk zone here.
What Changes for Pixels and Tracking
Meta and Google pixels collect personal data continuously, often before any consent mechanism has fired, which is exactly the kind of gap DPDP is built to close. First-party data, information you collect directly rather than through a third-party pixel, becomes significantly more valuable under this framework, since it’s data you can actually account for and control.
Practical implications for pixel-based tracking:
- Consent needs to be captured before tracking scripts fire, not after, which means auditing whether your current cookie or consent banner actually blocks scripts pre-consent or just displays a notice
- Retargeting audiences built from pixel data inherit the same consent requirements as the original data collection, so a retargeting campaign built on data collected without proper consent carries the same risk as the original collection
- Data clean rooms, which allow brands and platforms to match audiences without directly sharing raw personal data, are becoming a more attractive middle ground for exactly this reason
What Changes for WhatsApp Marketing
WhatsApp business messaging sits in a particularly exposed spot, since it’s built on a phone number, a piece of personal data by definition, and Indian consumers have gotten used to receiving promotional messages without always explicitly opting in.
WhatsApp opt-in under DPDP needs to move toward genuinely explicit, purpose-specific consent, ideally captured at the same point the phone number is collected, with a clear, easy opt-out mechanism (which WhatsApp’s own business API already supports reasonably well). Brands relying on numbers collected years ago through less rigorous means should treat a re-consent campaign as a near-term priority, not an eventual nice-to-have.
What Changes for CRM Data
CRM systems accumulate personal data from dozens of sources over years, forms, imports, manual entry, third-party lists, often with no clear record of what consent applies to each record.
A practical audit sequence:
- Map every data source feeding your CRM, since a record with no traceable consent origin is a genuine liability under the Act
- Tag records by consent purpose, not just consent status, since a “yes” to one purpose doesn’t cover another
- Build a deletion and correction workflow, since data principals have rights to request both under DPDP, and a CRM with no clean way to fulfil that request creates operational risk beyond just legal exposure
DPDP Penalty Exposure Marketers Should Actually Understand
The Act’s Schedule sets four tiers of maximum penalty, all discretionary and decided case-by-case by the Data Protection Board, none enforceable until the May 2027 phase:
- Up to ₹250 crore for failing to implement reasonable security safeguards against a data breach
- Up to ₹200 crore for failing to notify the Board and affected users after a breach, or for violating children’s data obligations
- Up to ₹150 crore for a Significant Data Fiduciary skipping a required DPO appointment, impact assessment, or independent audit
- Up to ₹10,000 for data principals filing frivolous complaints, a much smaller figure included mainly to discourage abuse of the complaint process
These are ceilings, not automatic fines, but the scale signals how seriously this is meant to be taken once enforcement begins.
How PROHED Approaches DPDP Readiness for Marketing Clients
We treat consent architecture as part of the campaign build itself now, not a legal afterthought bolted on separately. That means reviewing lead form consent structure before a campaign launches, auditing whether pixel-based tracking fires before or after consent capture, and pushing clients toward first-party data collection wherever a campaign design allows it, since that data holds up far better under a purpose-limitation framework than third-party pixel data ever will.
As marketing agencies in Gurgaon, our approach isn’t to position this as a legal service we don’t actually provide. It’s to build campaigns, forms, and CRM workflows that won’t need an expensive rebuild once Phase 3 enforcement actually begins.
Conclusion
DPDP compliance isn’t a single deadline sitting comfortably in 2027. It’s already unfolding, with Consent Manager registration opening in November 2026 and full enforcement following six months later. Marketers who wait for the final deadline will be rebuilding lead forms, pixel consent flows, WhatsApp opt-ins, and CRM consent tracking under live regulatory pressure. The ones who start now get to build it once, properly, on their own schedule.
FAQs
1. When does the DPDP Act actually come into full force?
It’s rolling out in three phases rather than one date: the Data Protection Board was established in November 2025, Consent Manager registration opens in November 2026, and full substantive obligations along with penalty enforcement take effect on 13 May 2027. Treating this as a single distant deadline understates how much groundwork the earlier phases already require.
2. What is a data fiduciary under the DPDP Act?
A data fiduciary is the entity that determines the purpose and means of processing personal data, which in practice covers most businesses and marketing teams collecting customer information. This role carries the primary compliance obligations under the Act, including consent management, security safeguards, and breach notification.
3. Do WhatsApp marketing campaigns need explicit consent under DPDP?
Yes, a phone number is personal data, and WhatsApp marketing needs genuinely explicit, purpose-specific consent rather than assumed opt-in from having the number on file. Brands using numbers collected through older, less rigorous methods should prioritise a re-consent effort well before the 2027 deadline.
4. What happens to Meta and Google pixel tracking under DPDP?
Pixel-based tracking needs to fire only after consent is captured, not before, which requires auditing whether your current consent banner actually blocks scripts pre-consent. Retargeting audiences built from pixel data also inherit the consent requirements of the original data collection, so gaps upstream create risk downstream too.
5. What is a Consent Manager under DPDP, and does my business need to register as one?
A Consent Manager is a registered platform that helps individuals manage and track their consent across different data fiduciaries, and registration for this framework opens in November 2026. Most marketing teams won’t need to become a Consent Manager themselves, but will likely need to integrate with one as the ecosystem matures.
6. What are the maximum penalties under the DPDP Act?
Penalties are tiered, reaching up to ₹250 crore for failing to implement reasonable security safeguards against a breach, with lower ceilings for other violations like missing breach notifications or Significant Data Fiduciary obligations. These are discretionary maximums decided by the Data Protection Board case by case, not automatic fines.
7. Why does first-party data matter more under DPDP?
First-party data, collected directly from your own audience rather than through third-party pixels or purchased lists, is easier to trace back to a specific, documented consent event. That traceability matters significantly under a law built around purpose limitation and a data principal’s right to know exactly how their data is being used.
8. Should marketers start DPDP compliance work now or wait closer to 2027?
Starting now is significantly safer, since the Consent Manager framework activates in November 2026 and building proper consent infrastructure, audited lead forms, pixel consent flows, CRM consent tracking, takes real time to implement correctly. Waiting until early 2027 means doing this work under live enforcement pressure rather than on a controlled internal timeline.
Want to audit whether your lead forms, pixels, and CRM data collection would hold up under DPDP? Talk to PROHED, a Gurgaon-based marketing agency helping brands build consent-ready campaigns ahead of the 2027 deadline.
Schedule a Free Strategy Call with PROHED Today
