Can Indian sales teams still use purchased lead lists and cold outreach under DPDPA?

Most Indian B2B sales engines run on a purchased or scraped database, a dialer, a WhatsApp Business account and a CRM. The Digital Personal Data Protection Act, 2023 bans none of those tools. What it changes is the question your CRM must answer for each record: on what basis are we holding this person's data, and can we prove it?

Why does a work email count as personal data?

Section 2(t) of the Act defines personal data as any data about an individual who is identifiable by or in relation to it. A name, designation and office email identify a person, so a B2B lead record is personal data. Unlike some marketing regimes abroad, DPDPA draws no line between consumer and business contacts.

One carve-out matters. Section 3(c)(ii) excludes data that the individual has made publicly available themselves. A self-published LinkedIn profile is often cited under this heading. A scraped compilation that adds mobile numbers and personal emails from other sources is a different thing, and the Data Protection Board has not yet ruled on where the line falls.

What are the lawful ways for a lead to sit in your CRM?

Section 4 allows processing only with consent (Section 6) or for a "legitimate use" listed in Section 7. For a sales team, that produces four record types with very different footing.

The fourth row is where the risk lives. A vendor's assurance that "all contacts are opted in" does not transfer consent to you: Section 6 consent is given to a specific Data Fiduciary for a specific purpose. Our eight checks for a DPDPA-ready CRM cover the field-level mechanics; this post is about the sourcing decision before them.

What about the leads already in the CRM?

Section 5(2) gives legacy records a bridge. Where a person consented before the Act commenced, the Data Fiduciary must send a notice "as soon as reasonably practicable" and may continue processing until consent is withdrawn. That covers customers and subscribers who opted in under your old privacy policy. It does not cover records that never had consent; there is no grandfathering for a trade-show list bought from a third party in 2019.

Does DPDPA replace TRAI's rules on calls and SMS?

No, it adds a second layer. TRAI's Telecom Commercial Communications Customer Preference Regulations, 2018 govern the channel: DLT-registered headers and templates, preference registers and promotional versus transactional traffic. DPDPA governs the data behind the channel. A DLT-approved SMS or WhatsApp template does not make the number lawful to hold, and a prospect who withdraws consent must stop receiving messages within a reasonable time under Section 6(6), however the campaign is routed.

What does consent have to look like inside the CRM?

Section 6(1) sets the standard: free, specific, informed, unconditional and unambiguous, with a clear affirmative action, limited to the data necessary for the purpose. Section 6(4) makes withdrawal as easy as giving consent, and Section 8(7) requires erasure once consent is withdrawn or the purpose is served, unless another law requires retention. A single "consent: yes" flag evidences none of this. A PwC India review of 100 Indian enterprise websites, cited by Adgully in September 2026, found only 9% sought consent that was free, specific and informed, and only 48% offered any way to withdraw it. Our guide to consent management under DPDPA explains why spreadsheets will not survive an inspection.

Six steps to clean up a sales CRM before 13 May 2027

1. Tag every record by source and basis. Inbound, opt-in, customer, purchased. Anything untagged is treated as purchased.
2. Send Section 5(2) notices to legacy consented contacts. Itemise the data, the purposes, how to exercise rights and how to complain to the Board, in English or any of the 22 Eighth Schedule languages the person prefers (Sections 5(3) and 6(3)).
3. Quarantine purchased and scraped lists. Decide with counsel whether a one-time notice-and-consent request is defensible for your sector, and erase what does not convert.
4. Rebuild forms for purpose-specific consent. Separate "contact me about this demo" from "send me marketing", with no pre-ticked boxes.
5. Wire withdrawal to suppression everywhere. CRM, marketing automation, dialer and WhatsApp provider must all honour a withdrawal, not just the system where it was clicked.
6. Put processor terms into vendor contracts. Section 8(2) permits engaging a Data Processor only under a valid contract; your CRM, dialer and enrichment vendors are processors.

Is the regime still moving?

Yes, in small ways. On 5 October 2026 MeitY issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 under Section 43(1), correcting the wording of Sections 9(1) and 10(2)(c)(ii). The changes are textual, with no new obligations, but they signal an Act being tidied up for the 13 May 2027 switch-on, not postponed. Consent Manager registration opens on 13 November 2026; see our explainer on Consent Managers versus consent management platforms.

A sales stack that can pass an audit

QQCRM, Qodequay's AI CRM accelerator, carries source, purpose and consent evidence on every lead and pushes withdrawals to connected channels. Paired with DAPro (Data Adhikaar), our DPDPA compliance platform with notices in 22 languages, a tamper-evident Evidence Vault and 25+ connectors, it gives a sales organisation a record it can show the Data Protection Board. Qodequay is ISO 27001:2022 certified. Book a 30-minute CRM readiness review.

This article is for general information and is not legal advice. Confirm obligations against the official texts of the DPDP Act, 2023 and the DPDP Rules, 2025, and consult qualified counsel for your situation.