Email Marketing & Consent (DPDP Act)

Email is the one channel you truly own. Social platforms change their rules and reach; your email list stays yours. A monthly newsletter from a coaching centre or a "new arrivals" email from a boutique can bring repeat business for years. But an email list is also a store of personal data, and in India that brings legal duties under the Digital Personal Data Protection Act, 2023 (DPDP Act).

In this lesson you will learn how to collect consent properly, the DPDP basics every marketer should know, how to keep emails out of spam folders, and how to measure campaigns honestly.

DPDP Act basics for marketers

The DPDP Act sets rules for processing digital personal data in India. Its key roles:

• Data Principal: the person the data is about, such as your subscriber.
• Data Fiduciary: the business that decides why and how the data is processed, such as your company.
• Data Processor: a service that processes data for you, such as your email platform.
• Consent Manager: a registered platform through which people can give, manage and withdraw consent.
• Data Protection Board of India: the body that handles complaints and can impose penalties.

For consent-based marketing, the Act's main ideas are:

• Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action (such as ticking an empty box), and limited to the purpose you stated.
• You must give a notice explaining what data you collect and why, in clear and plain language.
• People can withdraw consent as easily as they gave it, and then you must stop processing for that purpose.
• People have rights to information about their data, correction and erasure, and grievance redressal.
• For children (under 18), you need verifiable consent from a parent or guardian, and the Act forbids tracking or behavioural monitoring of children and targeted advertising directed at them.
• Businesses must protect data with reasonable security safeguards and report breaches. Penalties for failures can reach up to ₹250 crore for the most serious ones.

The DPDP Rules, 2025 were notified in November 2025 and phase the obligations in over time, with most duties for businesses taking effect about 18 months later. Check the current status on the Ministry of Electronics and IT website (meity.gov.in), and take legal advice for your situation; this lesson is a marketer's overview, not legal advice.

A consent-friendly sign-up form

A good form asks only for what you need, explains the purpose next to the form, uses an unticked checkbox, and links to the privacy notice. Run it and try submitting without ticking the box.

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Newsletter sign-up</title>
  <style>
    body { font-family: system-ui, sans-serif; margin: 1.5rem; max-width: 30rem; }
    label { display: block; margin: .6rem 0; }
    .notice { font-size: .9rem; color: #444; background: #fff7ed; padding: .6rem .8rem; }
    #msg { font-weight: 600; }
  </style>
</head>
<body>
  <h1>Monthly IELTS tips by email</h1>
  <p class="notice">We use your email address only to send one IELTS tips email a month. You can unsubscribe from any email with one click. Read our <a href="#privacy">privacy notice</a>.</p>
  <form id="f">
    <label>Email <input type="email" name="email" required value="ananya@example.com"></label>
    <label><input type="checkbox" name="consent"> Yes, send me the monthly IELTS tips email</label>
    <button type="submit">Subscribe</button>
  </form>
  <p id="msg"></p>
  <script>
    document.getElementById("f").addEventListener("submit", (e) => {
      e.preventDefault();
      const data = new FormData(e.target);
      const msg = document.getElementById("msg");
      if (!data.get("consent")) {
        msg.textContent = "Please tick the box if you want the emails. We will not add you without it.";
        return;
      }
      const record = { email: data.get("email"), purpose: "monthly_ielts_tips",
                       consented_at: new Date().toISOString(), source: "website_form" };
      msg.textContent = "Saved consent record: " + JSON.stringify(record);
    });
  </script>
</body>
</html>

Notice the consent record: what the person agreed to, when and where. Keep such records so you can show how each subscriber joined. A good practice is double opt-in: send a confirmation email and add the address only after the person clicks the link, which also blocks typos and fake sign-ups.

Keeping the list clean

Every send must exclude people who unsubscribed and addresses that bounce. This program prepares a send list and a segment:

subscribers = [
    {"email": "kabir@example.com", "status": "active", "interest": "ielts", "city": "Lucknow"},
    {"email": "isha@example.com", "status": "unsubscribed", "interest": "ielts", "city": "Kanpur"},
    {"email": "rohan@example.com", "status": "bounced", "interest": "spoken", "city": "Lucknow"},
    {"email": "meera@example.com", "status": "active", "interest": "spoken", "city": "Lucknow"},
    {"email": "farhan@example.com", "status": "active", "interest": "ielts", "city": "Lucknow"},
]

active = [s for s in subscribers if s["status"] == "active"]
ielts_lucknow = [s["email"] for s in active if s["interest"] == "ielts" and s["city"] == "Lucknow"]

print(f"Total {len(subscribers)}, sendable {len(active)}")
print("Removed:", [s["email"] for s in subscribers if s["status"] != "active"])
print("IELTS weekend batch email goes to:", ielts_lucknow)

Total 5, sendable 3
Removed: ['isha@example.com', 'rohan@example.com']
IELTS weekend batch email goes to: ['kabir@example.com', 'farhan@example.com']

Segmenting (sending each group only what is relevant) respects the purpose people signed up for and usually improves results. Never buy or rent email lists: those people never agreed to hear from you.

Getting into the inbox

Mailbox providers check that email really comes from your domain. Set up three DNS records with your email platform's help:

• SPF lists the servers allowed to send email for your domain.
• DKIM adds a digital signature that proves the message was not changed.
• DMARC tells receivers what to do with mail that fails those checks, and sends you reports.

example.com.         TXT  "v=spf1 include:mail.your-email-platform.example ~all"
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The values above are illustrations; your platform gives the exact records. Gmail and other large mailbox providers require authentication, an easy one-click unsubscribe and low spam complaint rates from bulk senders, so these are not optional extras. Use a clear sender name, honest subject lines and a visible unsubscribe link in every email.

Measuring email honestly

sent, delivered = 2_000, 1_960
clicks, unsubscribes, complaints, enquiries = 118, 9, 1, 14

print(f"Delivery rate: {delivered / sent:.1%}")
print(f"Click rate: {clicks / delivered:.1%}")
print(f"Unsubscribe rate: {unsubscribes / delivered:.2%}")
print(f"Complaint rate: {complaints / delivered:.2%}")
print(f"Enquiries per 1,000 delivered: {enquiries / delivered * 1000:.1f}")

Delivery rate: 98.0%
Click rate: 6.0%
Unsubscribe rate: 0.46%
Complaint rate: 0.05%
Enquiries per 1,000 delivered: 7.1

The program skips open rate on purpose. Privacy features in some email apps load images automatically, which makes many "opens" unreliable. Clicks, replies, enquiries and sales (tracked with UTM links) tell you much more.

Common mistakes

• Pre-ticked consent boxes or consent hidden in terms and conditions. Consent must be a clear action.
• Using data for a new purpose, such as adding enquiry-form contacts to a promotions list without asking.
• Bought lists. No consent, high bounces, spam complaints.
• Hard-to-find unsubscribe. It breaks mailbox rules and the spirit of the DPDP Act, and people report you as spam instead.
• Targeting minors. The DPDP Act forbids targeted advertising directed at children.

Key points

• The DPDP Act 2023 requires consent that is free, specific, informed, unconditional and unambiguous, with a clear notice and easy withdrawal.
• Children's data needs verifiable parental consent, and targeted ads at children are not allowed.
• Use unticked checkboxes, keep consent records, prefer double opt-in, and never buy lists.
• Authenticate your domain with SPF, DKIM and DMARC, and include a one-click unsubscribe.
• Measure clicks, replies and enquiries rather than relying on open rates; check DPDP Rules timelines on meity.gov.in.

<p class="notice">We use your email for the purposes you choose below. You can change your choice or unsubscribe at any time from any email.</p>
<label><input type="checkbox" name="purpose" value="order_updates"> Send me updates about my orders</label>
<label><input type="checkbox" name="purpose" value="collection_offers"> Send me new-collection offers (about twice a month)</label>
<script>
  // inside the submit handler:
  // const purposes = data.getAll("purpose");
  // if (purposes.length === 0) { msg.textContent = "Choose at least one option."; return; }
  // const record = { email: data.get("email"), purposes, consented_at: new Date().toISOString() };
</script>