Do you need fresh consent for the customers already in your CRM under DPDPA?

Consent Manager registration under the DPDP Rules, 2025 opens on 13 November 2026, nine days from now, and the full notice-and-consent regime follows on 13 May 2027. For most Indian sales and marketing teams the hardest question is not the new lead form but the old database: years of contacts collected under the IT Act's SPDI Rules, 2011, on paper forms, at trade shows and through sign-ups whose privacy policy nobody read. Do you have to ask every one of them again? The Act answers more precisely than most summaries suggest, and the answer depends on how each record came into your CRM.

What does Section 5(2) of the DPDP Act say about data you collected before the Act?

Section 5(2) deals directly with the legacy problem. Where a Data Principal gave consent for the processing of her personal data before the commencement of the Act, the Data Fiduciary must, as soon as it is reasonably practicable, give her a notice stating three things: the personal data and the purpose for which it is being processed, the manner in which she may exercise her rights under Section 6(4) (withdrawal of consent) and Section 13 (grievance redressal), and the manner in which she may make a complaint to the Data Protection Board of India. The proviso to Section 5(2) then says the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent.

Three consequences follow. First, there is no re-consent requirement for data collected with consent: the Act asks for a notice, not a new tick-box. Second, the notice is a one-time obligation per Data Principal, not a recurring one, although a new purpose would need a fresh Section 5(1) notice and consent. Third, the continuation right is conditional on a real withdrawal path: Section 6(4) requires that withdrawing consent be as easy as giving it, and Section 6(6) requires processing to stop within a reasonable time once it is withdrawn.

Which CRM records qualify for the legacy notice and which do not?

Section 5(2) applies only where consent was given. That single condition splits a typical Indian CRM into five buckets, each with a different route to 13 May 2027.

CRM record type	Consent evidence	DPDPA route	Action before 13 May 2027
Customers and users who signed up through a form with a privacy notice and tick-box, or signed a contract	Documented consent	Section 5(2) legacy notice; processing continues	Send the notice once, log delivery, honour withdrawals
Inbound leads who voluntarily shared details to get a quote, demo or callback	Voluntary provision for a specified purpose	Section 7(a) legitimate use for that purpose only	Tag the purpose; obtain consent before adding them to marketing lists
Contacts under old terms that said "by using this site you agree"	Bundled or implied; hard to evidence	Grey zone: Section 5(2) notice is arguable but weak	Send the notice and run an active re-permission campaign for marketing
Purchased lists, scraped profiles, LinkedIn exports	None	No legacy route; Section 5(2) presupposes consent	Fresh Section 5(1) notice and consent, or erase under Section 8(7)
Business-card scans and event badge scans with no notice given	None documented	Treat as no consent	Re-permission with a compliant notice, then erase non-responders

The two bottom rows are where most of the risk sits. We examined the purchased-list problem in detail in our analysis of whether Indian sales teams can still use purchased lead lists under DPDPA; the short version is that no notice can create a consent that was never given.

What must the legacy notice contain, and in which languages?

Section 5(2) sets the minimum: the data and purpose, the way to exercise rights, and the way to complain to the Board. Rule 3 of the DPDP Rules, 2025 then specifies how every Section 5 notice must be written. It must be presented and be understandable independently of any other information, so a link to a 4,000-word privacy policy does not qualify. It must carry an itemised description of the personal data, the specified purpose, and an itemised description of the goods, services or uses enabled by the processing. It must include the communication link to your website or app, and a description of any other means, through which the person can withdraw consent, exercise rights and complain to the Board.

Section 5(3) gives the Data Principal the option to receive the notice in English or in any language specified in the Eighth Schedule to the Constitution, 22 in all. In practice a Maharashtra-heavy customer base needs the notice in English, Marathi and Hindi at minimum; a national B2C database needs most of the schedule. Match the channel to how the person was onboarded: email for web sign-ups, SMS or WhatsApp for mobile-first customers, in-app for product users. Keep the delivery record, because the notice is also the evidence that your continued processing is lawful. The consent rules for the messaging channels themselves are covered in our guide to WhatsApp and SMS marketing under DPDPA.

When does "as soon as reasonably practicable" actually fall?

The Act sets no fixed date, but the calendar does. Sections 3 to 17 of the Act and Rule 3 of the Rules take effect on 13 May 2027. From that day, processing pre-Act personal data on the strength of old consent without having given the Section 5(2) notice is a breach of Section 5, which sits under the general penalty cap of ₹50 crore per instance in the Schedule to the Act. In January 2026 MeitY consulted industry on compressing the 18-month window to 12 months, which would bring the date forward to 13 November 2026; as of late October 2026 no amendment had been gazetted, so 2027 stands, but the proposal is a reason not to leave the campaign to the final quarter.

Reasonably practicable also has a practical reading. A company with two lakh contacts needs time to inventory sources, draft and translate notices, build the withdrawal flow, send in waves and process the withdrawals that follow. In our experience that is a two- to three-month programme for a mid-size business, so a campaign that starts after January 2027 is already late. The retention side of the same question, how long records may stay in the CRM at all, is addressed in how long an Indian company can keep customer data in its CRM under DPDPA.

How should a sales team run a legacy-notice campaign without losing its pipeline?

Six steps, in this order, keep the campaign lawful and the pipeline intact.

1. Inventory the source of every record. Add two fields to the CRM: how the contact was collected (web form, contract, event, referral, purchased) and what consent evidence exists (form snapshot, signed agreement, none). Section 8(7) erasure and Section 5(2) notices both depend on this map.
2. Segment into the five buckets above. Only the first bucket gets a plain legacy notice. Section 7(a) leads are restricted to the purpose they came in for. Everything without consent goes into quarantine: no outreach until re-permissioned.
3. Draft the notice to Rule 3 and translate it. Itemised data, itemised purposes, withdrawal link, rights and Board complaint route, in standalone plain language, in the languages your customers actually speak.
4. Build the withdrawal and erasure flow before you send. One click to withdraw (Section 6(4)); suppression across the CRM, the email tool, the dialler and the WhatsApp provider; erasure by you and by your Data Processors (Section 8(7)); and a log of each action.
5. Send in waves and record everything. Delivery, bounces, language chosen, withdrawals and the time taken to act on them. Store the notice version alongside each record so an auditor can see exactly what each person was told.
6. Re-permission the quarantine and set a cut-off. Run a compliant Section 5(1) notice-and-consent campaign for the no-consent buckets, then erase non-responders by a date you fix well before 13 May 2027.

Expect some withdrawals. A smaller list of people who have been told what you hold and have chosen to stay is worth more than a larger one you cannot lawfully email, and it is the only one a Board inquiry will accept. Our eight-point DPDPA CRM checklist covers the controls that should already be in place before the campaign starts.

What does this mean for the CRM you buy or build?

A CRM that cannot store the collection source, consent evidence and purpose of each record cannot run a Section 5(2) campaign without a spreadsheet beside it. QQCRM, Qodequay's AI CRM accelerator, carries consent-source and purpose fields on every contact, withdrawal-triggered suppression and an audit trail of who sent what to whom. For the notice and evidence layer, DAPro (Data Adhikaar), our DPDPA compliance platform, generates notices in all 22 scheduled languages, records delivery and withdrawals in a tamper-evident Evidence Vault, and connects to the CRM, marketing and support systems where the data lives through 25+ connectors. Qodequay is ISO 9001:2015 and ISO 27001:2022 certified.

If your CRM holds years of contacts and you are not sure which of them you can still lawfully process, we will map your database into the five buckets and size the notice campaign. Book a 30-minute DPDPA readiness call.

This article is for general information and is not legal advice. It reflects the DPDP Act, 2023 and the DPDP Rules, 2025 as notified at the time of writing; proposals under consultation may change the dates described. Confirm obligations against the official texts and consult qualified counsel for your situation.