India has no single “anti-spam” statute for email in the way the US has CAN-SPAM or Canada has CASL. Instead, three pieces of law shape how you can market by email and SMS: the Digital Personal Data Protection Act 2023, the Information Technology Act 2000, and TRAI’s telecom regulations for commercial SMS and calls. This page summarises each one and turns them into steps you can apply in Mailpro.
This is general information, not legal advice. Take advice from an Indian lawyer for your specific situation.
1. The Digital Personal Data Protection Act, 2023
The DPDP Act governs how “Data Fiduciaries” (the businesses that decide why and how personal data is processed) handle the digital personal data of “Data Principals” (the people the data is about). An email address or mobile number linked to a person is personal data, so your mailing list is squarely in scope.
The phase-in timeline
The Ministry of Electronics and Information Technology notified the DPDP Rules, 2025 in November 2025 and set an 18-month runway:
- 13 November 2025: provisions establishing the Data Protection Board of India took effect.
- November 2026: provisions on registered Consent Managers take effect.
- 13 May 2027: the main obligations for businesses (notice, consent, security safeguards, breach notification, rights of Data Principals) apply in full.
If you build your consent and list practices to the DPDP standard now, you will not need to rebuild your database in 2027.
What consent must look like
Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the purpose you describe. Each request for consent should come with a notice in clear language explaining what data you collect and why, and people must be able to withdraw consent as easily as they gave it. For marketing, that means an unticked checkbox or a deliberate sign-up, not a pre-ticked box buried in your terms. Our page on getting permission to send email campaigns goes into detail.
Penalties
The Data Protection Board can impose penalties set out in the Schedule to the Act. The highest, up to ₹250 crore, applies to failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify a breach, or breaching the special rules for children’s data, can each cost up to ₹200 crore, and other breaches up to ₹50 crore.
Children’s data
The Act requires verifiable parental consent before processing the personal data of anyone under 18, and it prohibits targeted advertising directed at children. Edtech companies and consumer brands with a young audience should gate their forms accordingly.
2. The Information Technology Act, 2000
The IT Act does not regulate marketing email directly, but it still matters. Until the DPDP Act fully replaces it in May 2027, Section 43A and the 2011 “SPDI Rules” require companies handling sensitive personal data (such as financial or health information) to follow reasonable security practices. The Act also underpins electronic contracts and cyber-offences such as phishing and identity theft, which is why sender authentication and honest “from” names matter.
3. TRAI rules for SMS and calls
If your campaigns include SMS, TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR) apply. Businesses must register as a principal entity on an operator’s DLT platform, register their sender headers and message templates, and respect the DND preferences recorded in the National Customer Preference Register. The February 2025 amendment tightened the rules further: a message that mixes promotional content with a transactional or service message is treated as promotional. See SMS marketing in India for the operational side.
4. When foreign laws also apply
Many Indian businesses sell overseas. If you email people in the EU or the UK, the GDPR or UK GDPR may apply to those contacts; if you email US residents, CAN-SPAM does. Mailpro’s GDPR compliance page explains how the platform supports these obligations.
Where your data is stored
Section 16 of the DPDP Act lets businesses transfer personal data outside India unless the Central Government restricts a particular country. Sector rules can be stricter: payment system data regulated by the Reserve Bank of India, for example, has its own storage requirements. Mailpro stores your contact data in Switzerland on private infrastructure, outside US jurisdiction, and never sells or rents it. Read whether your email data is subject to US law for background.
A compliance checklist for Indian senders
- Collect email addresses and phone numbers only through forms with a clear notice and an unticked consent box.
- Use double opt-in to prove when and how each person agreed.
- Put a working unsubscribe link in every marketing email and process opt-outs automatically with unsubscribe management.
- Never buy or rent lists. Consent given to someone else is not consent given to you.
- Keep SMS headers and templates registered on DLT and separate promotional messages from service messages.
- Store only the data you use, and delete it when the purpose is over.
- Prepare a breach-response plan now, before the May 2027 deadline.
For a narrower question about whether bulk email is allowed at all, read are email campaigns legal in India?