Short answer: yes. Sending newsletters and promotional emails is perfectly legal in India. What the law controls is whose personal data you use and how you obtained it. Since the Digital Personal Data Protection Act 2023 (DPDP Act) came onto the books, that question has become much more important.
This page is general information, not legal advice.
Is there an anti-spam law for email in India?
Not a dedicated one. India has never passed an email equivalent of the US CAN-SPAM Act. The Information Technology Act 2000 deals with cyber-offences and data security but does not set out rules for commercial email content such as mandatory footers. The rules on unsolicited commercial communication that do exist, TRAI’s TCCCPR 2018, cover SMS and voice calls on telecom networks, not email.
That gap is closing from a different direction. The DPDP Act treats an email address tied to a person as personal data, so building and using a mailing list is data processing that needs a lawful basis. For marketing, that basis will almost always be consent.
What makes an email campaign lawful in India
Consent that meets the DPDP standard
Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action. It must also be preceded or accompanied by a notice explaining what you collect and why. A pre-ticked box, or consent hidden in general terms and conditions, will not meet that bar. See how to get permission to send email campaigns in India.
An easy way out
People must be able to withdraw consent as easily as they gave it. In practice that means a one-click unsubscribe in every marketing email. Gmail and Yahoo also require this of bulk senders; see our article on the one-click unsubscribe standard.
Security
You must protect the data you hold. The largest penalty in the Act, up to ₹250 crore, is for failing to take reasonable security safeguards that would have prevented a breach.
When does it all apply?
The DPDP Rules were notified in November 2025. The Data Protection Board of India exists already, Consent Manager provisions arrive in November 2026, and the core obligations apply from 13 May 2027. Emails you send today are building the list you will be holding on that date, so it is sensible to collect consent to the new standard now.
Common scenarios
| Scenario | Generally OK? | What to watch |
|---|---|---|
| Newsletter to people who signed up on your website | Yes | Keep a record of the sign-up and the notice shown |
| Order confirmations and invoices to customers | Yes | Keep them free of promotional content |
| Offers to existing customers who never opted in to marketing | Risky | Ask for marketing consent separately |
| Cold email to a purchased list | No | No valid consent; high complaint and blocklist risk |
| Marketing to under-18s (e.g. edtech) | Only with verifiable parental consent | No targeted advertising at children |
Emailing outside India
If your list includes people in the EU or the UK, the GDPR or UK GDPR can apply to them regardless of where your company is based. The FAQ on GDPR for companies outside Europe explains when. US contacts fall under CAN-SPAM, which requires a physical address and an opt-out in every commercial email.
How Mailpro helps
- Double opt-in records the moment each subscriber confirmed.
- Unsubscribes are processed automatically so no one is mailed after opting out.
- Contact data is hosted in Switzerland on private infrastructure, outside US jurisdiction, and never sold or rented.
- Connections use TLS 1.3 encryption.
For the full legal picture, including the IT Act and TRAI’s SMS rules, read our overview of email marketing law in India.