Permission is the foundation of email marketing everywhere, but in India it now has a legal definition. The Digital Personal Data Protection Act 2023 (DPDP Act) and the DPDP Rules 2025 describe what valid consent looks like, what notice must come with it, and what happens when someone changes their mind. The core obligations apply from 13 May 2027, and the lists you build today will still be in use then.
General information only; not legal advice.
Step 1: Write a notice people can actually understand
Every request for consent must come with, or be preceded by, a notice. For a newsletter sign-up, keep it short and specific:
- what you will collect (for example, name, email address and city);
- what you will use it for (for example, a weekly newsletter with offers and new arrivals);
- how to withdraw consent and how to contact you;
- how to complain to the Data Protection Board of India.
The DPDP framework expects the notice to be available in English or in any of the languages listed in the Eighth Schedule of the Constitution if the person asks. If your audience signs up in Hindi, Marathi or Tamil, offering the notice in that language is both good practice and good conversion.
Step 2: Ask with a clear affirmative action
Consent must be free, specific, informed, unconditional and unambiguous. That rules out:
- pre-ticked checkboxes;
- bundling marketing consent into general terms of service;
- making a purchase or a free download conditional on joining the newsletter, when marketing is not needed to deliver it.
Use a separate, unticked checkbox on checkout pages and a dedicated sign-up form elsewhere. If you want both email and SMS permission, ask for each separately so the purpose stays specific.
Step 3: Confirm the address with double opt-in
With double opt-in, Mailpro sends a confirmation email and only adds the contact once they click. This stops mistyped and fake addresses, which are common when forms are filled in on a phone, and gives you a timestamped record showing when consent was confirmed. The difference is explained in opt-in vs double opt-in.
Step 4: Honour withdrawals immediately
Withdrawing consent must be as easy as giving it. Every Mailpro campaign includes an unsubscribe link, and contacts who click it are excluded from future sends automatically. You can also manage bounced and inactive addresses so your list only contains people who want your emails.
Step 5: Take extra care with children
The DPDP Act treats anyone under 18 as a child. You need verifiable consent from a parent or lawful guardian before processing a child’s personal data, and targeted advertising directed at children is prohibited. For edtech platforms and coaching institutes, address the parent rather than the student, and add an age question to your forms.
Step 6: Keep permission fresh
Consent is tied to a purpose. If you collected addresses for webinar reminders, do not start sending Diwali sale offers to them without asking. A good moment to ask is a clear, friendly re-permission campaign before a big seasonal push, with a single button to opt in.
What about existing customers?
Service messages such as order confirmations, shipping updates and invoices are part of delivering what the customer asked for. Promotional content is a separate purpose. Do not mix the two: a transactional email stuffed with offers weakens your argument that it is purely a service message. The same logic appears in TRAI’s SMS rules, where a message mixing promotional and service content is treated as promotional.
Permission improves results as well
A consented list is smaller at first, but it produces fewer spam complaints, lower bounce rates and better inbox placement at Gmail and other providers. You can track that difference in your campaign statistics. When you are ready to send, follow our guide to sending effective email campaigns in India, and see the full email marketing law overview for the wider legal context.