How Digital Marketers Should Prepare for the DPDP Act Before May 2027
Every enquiry form on your website is data protection decision. Most businesses just haven’t made it on purpose yet.
Think about a typical healthcare enquiry form. A patient types their name phone number country and a short description of their condition. Sometimes they attach medical reports. One click later that information is sitting in an inbox a CRM a WhatsApp chat and maybe a Google Sheet the sales team shares.
India’s Digital Personal Data Protection Act 2023 decides what you are allowed to do with that information. Its main obligations for businesses start on 13 May 2027. That’s roughly six months away and fixing forms CRMs and vendor contracts takes longer than most teams expect.
At HireWebPro Solutions we build and run websites and campaigns for clients including healthcare businesses where the data is personal and sensitive. This guide is what we’re walking our own clients through: what the Act means for day-to-day marketing what to change first and what you can safely leave alone.
The Act covers digital personal data processed in India. That includes data of foreign nationals so a medical tourism business collecting enquiries from patients in Nigeria or Sri Lanka is still covered.
Three roles matter:
The Act establishes principles while the DPDP Rules 2025 issued on 13 November 2025 clarify the details in practice namely what must be stated in a privacy notice how breaches are to be reported and how long personal data may be retained.
A single enquiry touches more systems than most clients realise. Take a medical tourism website like MJ Healthcare which we developed. International patients can submit a query with their medical reports book a callback or start a WhatsApp chat.
One patient enquiry can end up in five places within an hour:
- The website form which stores the submission and any uploaded reports.
- Email inboxes where the form notification lands.
- WhatsApp where the coordinator follows up.
- A CRM or spreadsheet where the lead is tracked.
- Partner hospitals which receive the reports to prepare a treatment plan and cost estimate.
Every one of those is a place the data has to be secured a place someone might ask you to delete it from and a place a breach could happen. If you can’t draw this map for your own site that’s your first job.
When we mapped this flow for one of our healthcare clients three fixes stood out:
The enquiry form asked for details nobody on the team ever used. Removing the field meant less personal data to protect and a shorter form for patients to fill in.
Medical reports were arriving as email attachments and getting forwarded between inboxes. Now they stay in one secured place and the notification email only says that a new enquiry has arrived.
Before anyone with a login could download the full lead list. Now only named people can export it and everyone else sees only the records they’re working on.
None of these changes took long and the client didn’t lose a single feature. Each one made the data easier to find protect and delete when a patient asks.
The biggest revelation is easy to get your head around: Sending a response to a lead and marketing to the lead are two different things.
If for instance an individual completes a form requesting a quote the Act considers it reasonable to use their information to respond if your use is limited to their request. Using their information to send newsletters or seasonal special offers or to add the individual to a remarketing list would be another purpose. You would need their permission for that.
According to the Act valid consent must be: freely; specific; informed; unconditionally; unambiguously; and through a clear affirmative action. For a website form this can be:
The notice matters too. The Rules expect it to stand on its own in plain language listing the data you collect and why. A link to a 4000-word privacy policy in the footer won’t be enough on its own.
Under the DPDP Act anyone under 18 is a child. That’s stricter than many marketers assume.
Parental consent is required for children’s data under the Act. It prohibits behavioral tracking and child targeted advertising.
This matters if your client is a school coaching institute ed tech platform pediatric clinic or youth brand. Retargeting website visitors or sending student inquiry lists to Meta for lookalikes may be unethical.
If a client’s audience includes under-18s plan the campaign around parents as the audience and take legal advice before using any tracking.
Using a big-name platform doesn’t make you compliant. Google Meta and your CRM provider have their own obligations. Yours stay with you.
The places we see the most risk:
Uploading enquiry emails or phone numbers to Google or Meta for Customer Match or custom audiences is a marketing use. Make sure those people consented to it.
The lead lands in the platform first then syncs to your CRM. Check what the form’s disclaimer says and whether your follow-up stays within it.
Coordinators often use personal phones. When they leave the patient chats and reports leave with them. A WhatsApp Business account owned by the business fixes most of this.
A Google Sheet of leads shared by link with “anyone can view” is a breach waiting to happen. Restrict it to named people.
Limit who can export the full CRM. Most team members only need the records they’re working on.
Beginning in May 2027 individuals will be able to inquire about the personal data held by businesses request the data to be amended and/or deleted and complain if their request is not honored. Individuals can also appoint someone to act on their behalf in this matter.
In real life the problem isn’t the law but the ability to locate the data. If a patient demands to be removed from all records will your company be able to find all copies of that record and remove them from every source including the form plugin inbox WhatsApp and spreadsheet? In many cases deletion is not an absolute option because other laws may require some records to be kept.
Set up three things now:
Breaches need a plan too. If personal data is leaked or accessed by the wrong person the Rules require you to tell the affected people and the Data Protection Board without delay followed by a detailed report to the Board within 72 hours. An agency that spots a breach in a client’s system must tell the client straight away so put that in your contract.
The Act is coming into force in three stages set by the notification of 13 November 2025:
Jay Methew
Jay Methew is a passionate web developer and designer dedicated to building high performance, user focused digital experiences. With a strong foundation in modern coding standards, responsive design, and UI/UX strategy, Jay transforms complex ideas into clean, functional websites that drive engagement and business growth. He combines technical precision with creative thinking to craft websites that are fast, secure, and visually compelling across all devices. From custom WordPress development to scalable eCommerce solutions and performance optimization, Jay focuses on delivering solutions tailored to each brand’s goals. His approach blends innovation, usability, and strategic design to ensure every project stands out in today’s competitive digital landscape.
