Cold Email Under India's DPDP Act: What B2B Teams Need to Know

Short answer: India's Digital Personal Data Protection (DPDP) Act doesn't ban cold email, but it changes the footing it stands on. A named person's work email and phone number are very likely personal data under the Act. The Act has no "legitimate interest" basis like Europe's GDPR, so you'll rely either on consent or on the exclusion for data the person made public themselves. Most of the obligations apply from around mid-May 2027, and nobody has been fined under the Act yet. The rules on telemarketing calls, though, already apply today.

This guide explains what the Act says, what's still uncertain, and the practical steps B2B sales teams and staffing agencies can take now. It's a summary for business readers, not legal advice. For your specific situation, talk to a lawyer.

The timeline

• August 2023: the DPDP Act is passed.
• 13 November 2025: the DPDP Rules are notified, starting a phased rollout.
• Around November 2026: provisions on registered Consent Managers apply.
• Around mid-May 2027: the main obligations apply. That includes notice, consent, the duties of businesses handling data, people's rights over their data, breach reporting and penalties.

In January 2026 the government floated shortening the 18-month window to 12 months. As of October 2026 that hasn't become law, but it's worth watching.

The Data Protection Board, which will enforce the Act, didn't yet have its Chairperson and Members appointed as of August 2026.

Is a work email "personal data"?

Very likely, yes. The Act defines personal data as any data about an individual who is identifiable by or in relation to that data. An address like priya.sharma@company.com identifies Priya. So does her direct mobile number.

A generic address like sales@company.com or careers@company.com arguably isn't personal data, because it doesn't identify a person.

There's no ruling on this yet. But the safe working assumption is that a named person's business contact details are covered.

Consent, and why there's no "legitimate interest"

Under GDPR, many B2B teams rely on "legitimate interest" for cold outreach. The DPDP Act has no equivalent.

It gives two routes for processing personal data:

1. Consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action.
2. Certain legitimate uses listed in the Act. This is a closed list. The one most relevant to business is where a person voluntarily gives you their data for a specific purpose, like handing you a business card or filling in your form.

Cold outreach to someone who never gave you their details doesn't clearly fit either route. Some lawyers read the Act strictly and say cold outreach without consent, and buying contact lists, won't survive once the main obligations apply. Others point to the exclusion for public data, below. Until the Board issues guidance or rulings, this is unsettled.

The exclusion for publicly available data

The Act doesn't apply to personal data that the person has made publicly available themselves, or that someone else made public because the law required it.

The key test is who published it. A professional who lists their work email on their own website or public profile has arguably made it public. Data a vendor has inferred, guessed or pieced together from patterns is much weaker ground, because the person didn't publish it.

If your outreach relies on this exclusion, document it. For each contact, keep a note of where the details came from.

What applies from May 2027

Once the main obligations apply, a business that processes personal data (a "Data Fiduciary" in the Act's terms) will need to:

• Give a clear notice of what data it holds, why, and how people can exercise their rights, when it asks for consent.
• Make withdrawing consent as easy as giving it, and stop processing when someone withdraws.
• Erase data once the purpose is served or consent is withdrawn, subject to retention rules, and keep certain processing logs for a year.
• Publish a contact for data questions and answer grievances within 90 days.
• Have contracts with processors, such as your CRM, email platform or data vendor.
• Keep reasonable security safeguards.
• Report personal data breaches to the Data Protection Board, with a detailed report within 72 hours, and to affected people.

There's no blanket exemption for small businesses or startups. The Act lets the government notify exemptions, but none had been issued for startups as of October 2026.

Penalties

The Act sets maximum penalties per breach:

These are caps. The Board is expected to consider factors like how serious the breach was and whether it was repeated. No penalty has been imposed under the Act yet.

Cold calling: the rules that apply now

While DPDP obligations are still ahead, TRAI's telemarketing rules already apply. Under the February 2025 amendments:

• Promotional calls must come from 140-series numbers, and service and transactional calls from 1600-series numbers.
• Unregistered telemarketers face serious consequences: for a first offence, all outgoing services can be barred for 15 days. Repeat offences can mean disconnection for a year and blacklisting.
• After someone opts out, you must wait 90 days before asking for their consent again.

If your SDRs make sales calls from ordinary mobile numbers, check with your telecom provider and legal advisor how these rules apply to you.

What B2B teams can do now

You don't need to stop prospecting. You do need to be able to explain where each contact came from and why you're writing.

1. Keep a source for every contact. Note where the email or number came from and when. This is the single most useful habit.
2. Check your data vendors. Ask how they source data, whether they honour opt-outs, and what their contract says about compliance.
3. Prefer data people published themselves and work emails over personal ones. A tool that returns only verified work contacts, like prospiq, makes this the default.
4. Make opting out easy and fast. Include a simple way to opt out in every email, act on it quickly, and keep a suppression list so people aren't re-added.
5. Be clear in the first message. Say who you are, why you're writing to this person specifically, and how they can stop hearing from you.
6. Collect the minimum. Don't store fields you don't use, and set a rule for deleting old prospect data.
7. Tighten security. Use multi-factor login on your CRM and email tools, and limit who can export lists.
8. Put contracts in place with the tools that process your prospect data.
9. Use the right numbers for calls, as TRAI requires.

What this means for staffing agencies

Agencies handle two kinds of personal data: client contacts (HR heads, TA leaders, hiring managers) and candidate data, which is often far more detailed. Candidate CVs, salary details and ID documents carry more risk than a work email.

Clients are also starting to ask about it. Expect vendor empanelment questionnaires to include how you collect, store and delete candidate data. Having clear answers ready is becoming part of winning the business. Our guide to staffing agency empanelment covers the rest of that process.

Where your contact data comes from matters more now

Under the DPDP Act, the questions shift from "did we find an email?" to "what kind of data is it, and can we stand behind using it?" That's worth thinking about when you choose a data tool.

prospiq is built for this kind of outreach:

• Work contacts only. prospiq finds verified work emails and direct phone numbers. It never returns personal email addresses, so you're reaching people in their professional role.
• Verified before you're charged. Every email is checked with the recipient's mail server first, so your messages reach real inboxes and your sending reputation stays clean.
• A public opt-out. Anyone can ask to be excluded from prospiq's data at prospiq.net/opt-out, which helps you honour objections across your outreach.
• Clean your existing lists. Upload the database you already have and verify it before your next campaign, instead of mailing old addresses blindly.
• Billed in rupees, monthly. Starter is Rs 2,399 a month for 500 credits, plus GST, with no lock-in. A verified email costs 1 credit and you pay nothing when nothing is found.

A data tool doesn't make your outreach compliant on its own. You're still responsible for how and why you contact people, so the steps above apply whatever you use. But starting with verified work contacts makes those steps much easier.

Try prospiq free with 20 credits, no card needed →

FAQ

Is cold email legal in India under the DPDP Act?

The Act doesn't ban cold email outright. But it has no "legitimate interest" basis, so outreach without consent needs another footing, such as the exclusion for data the person made public themselves. How the Board will treat B2B cold outreach hasn't been tested yet. The main obligations apply from around mid-May 2027.

When does the DPDP Act come into force?

The Rules were notified on 13 November 2025. Consent Manager provisions apply around November 2026, and most obligations, including consent, notice, rights and penalties, from around mid-May 2027. A proposal to bring this forward hasn't become law as of October 2026.

Does the DPDP Act apply to business email addresses?

A named person's work email very likely counts as personal data because it identifies them. Generic addresses like sales@ or info@ arguably don't.

What is the penalty for breaking the DPDP Act?

Maximum penalties range up to Rs 250 crore for failing to protect data, Rs 200 crore for not reporting a breach, and Rs 50 crore for other breaches such as consent and notice failures.

Can I still buy contact lists in India?

It's risky. Data the person didn't publish or give you is hard to justify under the Act, and some lawyers say bought lists won't fit once the main obligations apply. At minimum, ask the vendor how the data was sourced and get it in writing.

Do I need consent to cold call in India?

TRAI's telemarketing rules already apply: use 140-series numbers for promotional calls, respect opt-outs and the Do Not Disturb registry, and wait 90 days after an opt-out before asking again. DPDP obligations on personal data will add to this from 2027.

Sources: the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (Ministry of Electronics and IT), and TRAI's Telecom Commercial Communications Customer Preference Regulations as amended in February 2025. This article reflects the position as of October 2026 and may change. It is not legal advice.