Consent and lawful basis
Can I send marketing emails under DPDP?
- Short answer
- Yes, with consent. Marketing is not a listed legitimate use, so it needs consent that is specific to marketing and separate from the consent to provide the service. Withdrawal must be as easy as giving it.
The word that does the work is specific. Consent to create an account is not consent to receive promotions. The two must be separable, which in practice means a distinct tick or toggle rather than a bundled one.
An existing customer relationship is not itself a basis for marketing under this Act. That differs from some other regimes, so imported templates often get this wrong.
Because the burden of proving consent sits on you, keeping a record of when and how each person consented is what makes the position defensible later.
Where this comes from
- Section 6, DPDP Act 2023
The mistake people make
Marketing to everyone who ever transacted with you, on the basis that they are customers rather than strangers.