Every enquiry that lands in your business carries personal data: a name, a mobile number, sometimes an email, a budget, a child’s class, a health complaint or a loan amount. Until recently most Indian small businesses treated that data as simply “our leads”. Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules notified in November 2025, it becomes data you hold on someone else’s behalf, with clear duties attached.
The good news is that most of these duties line up with good sales practice. If you already know where each lead came from, why you are contacting them and when to stop, you are closer to compliance than you think. This guide explains what the DPDP Act means for the leads in your CRM, what changes before the main deadline of 13 May 2027, and a practical checklist you can start this month.
Quick answer: Under the DPDP Act, a business that collects leads must tell people what their data will be used for, get clear consent where consent is needed, use the data only for that purpose, let people withdraw consent and ask for correction or erasure, protect the data with reasonable security, delete it when it is no longer needed, and report personal data breaches. Most of these obligations apply from 13 May 2027. For a small business, the CRM is where all of this is either easy to prove or impossible to prove.
This article is general information for business owners, not legal advice. For your specific situation, speak to a lawyer or compliance advisor.
What is the DPDP Act, in plain words?
The DPDP Act is India’s law on digital personal data. It received Presidential assent on 11 August 2023. The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules, 2025 on 13 November 2025, which set out how the Act works in practice.
The law uses three terms you will see often:
- Data Principal: the person the data is about. For you, that is the lead or customer.
- Data Fiduciary: the business that decides why and how the data is used. That is you.
- Data Processor: anyone who processes data on your behalf, such as a CRM provider, an SMS or WhatsApp messaging provider, or a call centre agency.
The key point for business owners: responsibility stays with you, the Data Fiduciary, even when your data sits in software or with a vendor.
The DPDP timeline: what applies when
The Rules are being brought in over 18 months so that businesses have time to prepare.
| Date | What comes into force | What it means for an SMB |
|---|---|---|
| 13 November 2025 | Rules on the Data Protection Board of India | The regulator is set up. No new day-to-day duties yet. |
| 13 November 2026 | Rules on Consent Managers | Registered platforms that help people give, manage and withdraw consent can start operating. |
| 13 May 2027 | Remaining obligations: notice, consent, security safeguards, breach reporting, retention and erasure, rights of Data Principals | Your forms, follow-ups and CRM records need to meet the law by this date. |
Seven months may sound like a lot of time. In practice, cleaning up years of leads spread across phones, Excel sheets and WhatsApp chats takes longer than most owners expect, so it is worth starting now.
How the DPDP Act affects the leads in your CRM
1. You need to tell people what you will do with their data (notice)
When you ask for personal data, you must give a clear notice that explains what data you are collecting and the purpose. The notice should also tell people how to withdraw consent and how to raise a complaint, including with the Data Protection Board. For a lead form, this can be a short, plain-language line next to the submit button with a link to a fuller privacy notice.
Example for a coaching centre: “We will use your name and number to call or WhatsApp you about admissions for the course you selected. You can ask us to stop at any time.”
2. Consent must be clear, specific and easy to withdraw
Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Withdrawing consent should be as easy as giving it. That rules out pre-ticked boxes and vague lines like “we may contact you about anything”.
For most businesses this means separating two things that are often bundled:
- Responding to the enquiry the person just made (a price, a site visit, a doctor’s appointment).
- Ongoing marketing such as offers, newsletters and festive campaigns.
Treat marketing as a separate, optional choice, and record that choice in the lead record.
3. Use the data only for the purpose you stated
If someone enquired about a 2BHK flat, using their number to promote your unrelated insurance agency is a different purpose. Purpose limitation is one of the easiest rules to break by accident when many people in a team have access to the same contact list.
4. People can ask to see, correct or erase their data
Data Principals have the right to access information about their data, ask for correction and erasure, and nominate someone to exercise their rights. The Rules give businesses up to 90 days to respond to such requests. You will need to publish how people can make a request, and you will need to be able to find everything you hold about one person quickly. If a lead’s details are in three phones and two spreadsheets, that is hard to do.
5. Keep the data safe
Businesses must take reasonable security safeguards to prevent personal data breaches. For an SMB this usually means role-based access (a telecaller does not need the full customer export), no shared logins, no customer lists forwarded on personal WhatsApp, and logs that show who accessed or changed data. The Rules also require businesses to retain related logs for at least one year.
6. Delete data you no longer need
Once the purpose is served and you have no legal reason to keep the data, it should be erased. A lead who said “not interested” two years ago and never came back is a good example of data you should review.
7. Report personal data breaches
If personal data is breached, for example a laptop with your lead list is stolen or a staff member exports and leaks the database, you must inform the affected people and the Data Protection Board. The Rules require a detailed report to the Board within 72 hours of becoming aware of the breach, unless the Board allows more time.
What are the penalties?
The Act allows penalties of up to ₹250 crore for the most serious failures, such as not taking reasonable security safeguards. The Board considers factors such as the nature and seriousness of the breach when deciding the amount. For small businesses, the bigger day-to-day risk is losing customer trust when someone asks “where did you get my number?” and you cannot answer.
Which lead sources need the most attention?
| Lead source | Typical risk | What to fix |
|---|---|---|
| Website forms | No notice, pre-ticked marketing box | Add a short notice, a separate unticked marketing option and a privacy notice link |
| Facebook and Instagram lead ads | Generic disclaimer, purpose unclear | Use the form’s custom disclaimer to state the purpose and add your privacy notice link |
| WhatsApp enquiries | Chats stored on staff phones | Route enquiries into one shared inbox, not personal handsets |
| Google campaigns and landing pages | Same as website forms | Same notice and consent pattern on every landing page |
| Walk-ins and phone calls | Details written in registers, no record of what was agreed | Enter walk-ins into the CRM with source and the purpose explained to the visitor |
| Bought or shared lists | No consent from the person at all | Avoid using them. You cannot show where consent came from |
A DPDP-ready checklist for your CRM
Work through these steps over the next few months. None of them needs a large budget.
- Map every lead source. List every place enquiries arrive: forms, ads, WhatsApp, Google campaigns, walk-ins, referrals, exhibitions.
- Bring leads into one system. Data scattered across phones, notebooks and Excel files cannot be secured, corrected or erased reliably. One CRM inbox gives you one place to manage it.
- Record source and purpose on every lead. Add fields or tags such as “Source: Instagram ad, 10 Oct 2026” and “Purpose: admission enquiry”.
- Record marketing consent separately. Use a clear yes/no field for marketing messages, captured from an unticked checkbox or a clear reply.
- Make opting out simple. Tell people they can reply “STOP” or ask your team to stop. When they do, tag the lead and pause automated WhatsApp, SMS and email follow-ups for them.
- Restrict access by role. Give each team member access only to the leads they handle. Remove access the day someone leaves.
- Stop exporting to personal devices. Discourage downloading lead lists to personal phones or forwarding them in group chats.
- Set a retention rule. Decide, with your advisor, how long you keep closed or inactive leads, and review old records on a fixed schedule.
- Check your vendors. Ask your CRM, messaging and telecalling vendors how they protect data, where it is stored, and how they would inform you of a breach. Put this in your agreements.
- Write a one-page breach plan. Who decides it is a breach, who informs customers, who prepares the report to the Board, and how you reach the 72-hour deadline.
- Publish a contact for data requests. Name a person or email address for access, correction and erasure requests, and track each request until it is closed.
Industry examples
Real estate: Portals, site-visit registers and channel partners all feed leads. Recording the source on each lead makes it easy to answer “how did you get my number?” and to stop follow-ups when a buyer has purchased elsewhere. See how this fits a sales pipeline on our real estate CRM page.
Healthcare: Clinics and diagnostic centres often collect symptoms or test details at the enquiry stage. Collect only what you need to book the appointment, and limit who can view it. Our healthcare CRM page covers patient enquiry workflows.
Education: Many enquiries are made by parents about students. The Act has additional rules on the data of children, including verifiable consent from a parent or lawful guardian, so admissions teams should get specific advice on this. See our education CRM page for admissions follow-up.
Finance and insurance: Loan and policy leads involve income and financial details, and the sector already has its own regulators. Keep DPDP steps aligned with your existing sector rules. Read more on our finance and insurance CRM page.
Where ZeaCRM fits
A CRM does not make you compliant on its own. Compliance depends on your notices, your decisions and your team’s habits. What a CRM does is give you one place to run and prove those habits.
ZeaCRM brings leads from website forms, Facebook and Instagram ads, WhatsApp, Google campaigns and walk-ins into one inbox, so you are not hunting through phones and spreadsheets when someone asks about their data. You can tag each lead with its source and purpose, see the full history of follow-ups on WhatsApp, SMS and email, and track every lead through your pipeline. Onboarding is available in Tamil, English and Hindi with a dedicated onboarding specialist, which helps when your team needs to set up new fields and habits quickly. Explore the ZeaCRM features to see how this works in practice.
Common mistakes to avoid
- Assuming the law only applies to large companies. The DPDP Act applies to businesses of every size that process digital personal data, though the government can notify exemptions for certain classes of businesses.
- Using one checkbox for “contact me about this enquiry” and “send me all future offers”.
- Keeping leads forever “just in case”.
- Letting ex-employees keep customer lists on their phones.
- Waiting until April 2027 to start.
Frequently asked questions
Does the DPDP Act apply to small businesses in India?
Yes. The Act applies to digital personal data processed in India, whatever the size of the business. The government can exempt certain classes of Data Fiduciaries, including startups, from some provisions by notification, so check the current position with your advisor.
When do the main DPDP obligations start?
Most obligations, including notice, consent, security safeguards, breach reporting, erasure and the rights of Data Principals, apply from 13 May 2027, 18 months after the Rules were notified on 13 November 2025.
Can I still follow up with leads on WhatsApp?
Yes, if the person asked you to contact them and you use their data for that purpose. Keep marketing messages as a separate choice, follow WhatsApp’s own opt-in rules, and stop when someone asks you to.
Do I need consent for a lead who enquired on my website?
The Act allows certain “legitimate uses” without separate consent, including where someone voluntarily gives data for a specific purpose. Using that data for unrelated marketing needs proper consent. Get advice on how this applies to your forms.
What should I do with old leads in Excel and phones?
Move the ones you still have a reason to contact into one CRM, record where they came from, and review or delete the rest according to a retention rule you agree with your advisor.
How fast must a data breach be reported?
Affected people and the Data Protection Board must be informed. The Rules require a detailed report to the Board within 72 hours of becoming aware of the breach, unless the Board allows more time.
Is my CRM provider responsible if there is a breach?
Your CRM provider is a Data Processor. As the Data Fiduciary, your business remains responsible under the Act, so choose vendors carefully and set clear terms in your contract.
Next step
The DPDP deadline is a good reason to do what most growing businesses need anyway: one place for every lead, a clear record of where it came from, and follow-ups that stop when the customer says stop. If you want to see how that looks for your business, Book a Demo with the ZeaCRM team.
Sources: Digital Personal Data Protection Act, 2023; Digital Personal Data Protection Rules, 2025 (MeitY, notified 13 November 2025). Dates and requirements summarised from the official texts and legal commentary as of October 2026.