DPDP consent guide for B2B companies.
Selling to businesses does not take you outside India's DPDP Act. The Act protects individuals, and your leads, client contacts, product users and website visitors are all individuals. Where you rely on consent, you need a clear notice, a separate choice for each purpose, a record of that choice and an easy way to withdraw it. Most duties start on 13 May 2027.
This guide is general information, not legal advice. Check your own situation with a lawyer.
Where a B2B company handles personal data
- Website forms: demo requests, contact forms, free trials and gated content
- Newsletters, webinars and event sign-ups
- CRM and sales tools: names, work emails, phone numbers and job titles
- Sales outreach: cold email, LinkedIn messages and call lists
- Product users: the people at your clients who log in to your software
- Analytics, ad pixels and chat widgets on your website
- Your own team: employee and contractor records
Work emails are still personal data
The Act has no special exemption for business contact details. A name with a work email or phone number identifies a person, so treat it as personal data.
There is one narrow exclusion: the Act does not apply to personal data that a person has made publicly available themselves. Where that line falls for contact lists bought from data vendors or collected from online profiles is not settled, so check with a lawyer before relying on it.
Two roles you may play
Data Fiduciary
When you decide why and how personal data is used: your leads, your marketing list, your website visitors. Notice, consent, rights requests and breach duties are yours.
Data Processor
When you handle personal data for a client, for example their customer records stored in your software. Your client must engage you under a valid contract, so expect requests for a data processing agreement, security commitments, help with rights requests and erasure on their instruction.
Many B2B companies are both at once: a fiduciary for their own sales and marketing data, and a processor for the data their product handles for clients.
What valid consent looks like in B2B
- Someone who fills in a demo form has given you their details to arrange the demo. Adding them to your newsletter is a different purpose, so ask separately.
- No pre-ticked boxes for marketing emails or for sharing with partners.
- Do not pass webinar or event attendee lists to sponsors without a clear, separate choice.
- Make unsubscribing and withdrawing consent as easy as signing up.
- Name a grievance contact and tell people how to use their rights.
Not everything needs a consent tick
The Act allows certain "legitimate uses" without consent. Two matter most in B2B: using details a person gave you voluntarily for the purpose they gave them, as long as they have not objected, and processing employee data for employment purposes. Marketing to new contacts, profiling for ads and sharing data with third parties are different. Treat those as needing consent.
The B2B checklist
- 1Map every form, tool and list that holds personal data
- 2Write a short, plain notice for each form saying what the data is used for
- 3Ask separately for marketing emails, newsletters and sharing with partners
- 4Put a consent banner on your website that blocks ad and analytics trackers until the visitor chooses
- 5Keep a record of each consent and each withdrawal, with the time
- 6Give people a visible way to ask for access, correction or erasure, and publish a grievance contact
- 7List every vendor that receives personal data, such as your CRM, email tool and ad platforms, and sign data processing agreements
- 8If you process data for clients, have a contract ready that covers security, breach notice and erasure
- 9Write down what you will do if there is a data breach, and who does it
Why it matters for winning deals
The Act sets penalties of up to ₹250 crore, the highest for failing to keep reasonable security safeguards. For a B2B company, the question usually arrives sooner from clients: security reviews and vendor questionnaires now ask how you collect consent, handle data requests and manage breaches. A clear, documented process helps you answer them and close deals faster.
How Foxinel helps
Foxinel is a consent management platform built for the DPDP Act. It gives you the consent banner, consent records, a rights-request queue, a vendor registry with data processing agreement status, a breach log, team access and an audit log in one place. It does not replace legal advice and does not by itself make a business compliant.
