CRM Costs, Price Drivers and 2026 Rules
DPDP Act and Rules for CRM data: consent, notices, consent managers and what the vendor must do
How the DPDP Act 2023 and phased DPDP Rules 2025 apply to leads and customer data in a CRM — consent, legitimate uses, notices, consent managers, erasure, breaches and transfers.
Every lead and customer in your CRM is personal data under the Digital Personal Data Protection Act, 2023. Your business is the data fiduciary (it decides why and how the data is used), the CRM vendor is generally a data processor acting on your instructions, and each contact is a data principal with rights. The DPDP Rules, 2025 were notified on 13 November 2025 and apply in phases: the Data Protection Board provisions applied at once, the consent manager provisions from 13 November 2026, and most obligations on businesses — notices, security safeguards, breach intimation, retention and erasure, and data principals' rights — from 13 May 2027 under the original timetable. A CRM is where you will prove compliance, so choose and configure it with these rules in mind. This guide is part of the CRM costs and rules overview and is general information, not legal advice.
Lawful grounds: consent or a legitimate use
The Act allows processing on two grounds:
- Consent (section 6) that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. Withdrawing consent must be as easy as giving it.
- Certain legitimate uses (section 7), including where a person voluntarily provides their data for a specified purpose and has not indicated that they do not consent to its use — for example, a customer who gives a mobile number so you can deliver an order or send a quotation.
| CRM situation | Likely ground | What to record |
|---|---|---|
| Enquiry form asking for a quote | Voluntarily provided for that purpose | Form, date, purpose stated |
| Sending the requested quotation and follow-up on it | Same purpose | Activity log |
| Adding the lead to promotional WhatsApp or SMS campaigns | Consent | Consent text, date, channel, purpose; opt-out |
| Bought or scraped lists | Generally no valid ground | Do not import |
| Marketplace leads (IndiaMART-type) | Depends on the platform's terms and what the buyer was told | Platform terms; your notice on first contact |
Note that consent for telecom purposes under TRAI's rules and consent under the DPDP Act are separate. TRAI's 2026 amendment says expressly that its rules do not exempt senders from the DPDP Act. See TRAI DLT and calling rules.
Notices
When you seek consent, you must give a notice describing the personal data and the purpose, how to withdraw consent and exercise rights, and how to complain to the Data Protection Board. The Rules require the notice to be understandable on its own, with an itemised description of the data and purposes. In CRM terms: keep each web form, landing page and WhatsApp opt-in linked to the notice version shown, so you can show what a person agreed to.
Consent managers
A consent manager is a person registered with the Data Protection Board that lets data principals give, manage, review and withdraw consent through an accessible, interoperable platform. The Rules' registration provisions apply from 13 November 2026. For a small business:
- you are not required to use a consent manager, but customers may start to use one to manage consents they gave you;
- your CRM should be able to record consent from any channel and act on withdrawals quickly, whichever route they arrive by;
- do not confuse this with TRAI's consent registration for commercial communication, which is a telecom-sector system run through operators.
Obligations that a CRM must help you meet
| Obligation (Act and Rules) | What the CRM or vendor should provide |
|---|---|
| Reasonable security safeguards | Role-based access, two-factor login, encryption, access logs; Rule 6 lists minimum measures including encryption or masking, access control, logs and monitoring, and backups, with logs kept for one year |
| Breach intimation to the Board and affected people | Vendor tells you without delay; you have an incident plan. Rule 7 requires a detailed report to the Board within 72 hours of becoming aware, unless the Board allows longer |
| Erasure when the purpose is served or consent is withdrawn | Bulk deletion, retention rules, deletion logs |
| Accuracy and correction | Edit history; easy correction on request |
| Rights of access, correction, erasure, grievance | Export of one person's data; a request log with dates |
| Processor under a valid contract | Data processing terms with security, breach and deletion clauses |
| Contact for questions | Published contact of a person who can answer on your behalf |
Penalties
The Schedule to the Act provides penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach and up to ₹200 crore for failing to notify a breach, among others. The Board decides amounts after inquiry, considering factors such as gravity and duration.
Data location and transfers
The Act allows transfers outside India except to countries the Central Government restricts by notification; sector rules can be stricter. There is no general requirement to keep CRM data in India. The RBI's 2018 payment data storage directive applies to payment system operators, not to an ordinary business storing customer contacts — but do not store card numbers in your CRM; payments should run through a licensed gateway or aggregator.
If you sell online
If you sell goods or services to consumers through your own website or app, the Consumer Protection (E-Commerce) Rules, 2020 apply to e-commerce entities: among other things, a grievance officer and a complaint-handling timeline. The CCPA's 2023 guidelines on dark patterns list practices such as subscription traps and nagging that also matter for CRM-driven campaigns. Check the current text with the Department of Consumer Affairs.
Practical setup in the CRM (illustrative effort)
| Task | Illustrative effort or cost |
|---|---|
| Add source, purpose, consent date and notice version fields | 2–4 hours of admin time |
| Opt-out handling: one click suppresses WhatsApp, SMS and email | Often configuration; sometimes an automation tier |
| Retention rule: delete unconverted leads after a set period | 1–2 hours, plus a quarterly review |
| Role-based access so telecallers cannot export the database | 2–3 hours; may need a higher tier |
| Legal review of the vendor's data processing terms | ₹15,000–₹50,000 one-time |
Record these in the selection checklist and in your 3-year TCO.
FAQ
Do I need fresh consent for my existing customer list?
Not necessarily for serving existing orders, which can rest on legitimate use. For promotional messages, check what each person agreed to and when; where you cannot show valid consent, seek it with a proper notice before the obligations apply.
Is my small business exempt from the DPDP Act?
The Act allows the government to exempt certain classes of data fiduciaries, including start-ups, from some provisions by notification. Check whether any notified exemption covers you; do not assume it does.
Who is liable if the CRM vendor has a breach?
You remain responsible to data principals and the Board as data fiduciary, which is why the vendor contract must require prompt notice and cooperation.
Sources
- Ministry of Electronics and Information Technology — DPDP Act, 2023 and DPDP Rules, 2025
- e-Gazette of India — G.S.R. 846(E) of 13 November 2025 and any amendments
- Telecom Regulatory Authority of India — telecom-sector consent registration
- Reserve Bank of India — payment data storage directive
- Department of Consumer Affairs — Consumer Protection (E-Commerce) Rules, 2020 and dark patterns guidelines
