How to collect leads legally in India: DPDP basics for your business tool

This guide is general information, not legal advice. For your specific situation, speak to a lawyer.

The law in one paragraph

India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) sets the rules for using personal data in digital form. The DPDP Rules, 2025 were notified in November 2025 and phase in over 18 months: most day-to-day duties, such as notices, security and responding to people’s requests, apply from around May 2027. Until then, the older IT Act rules on privacy policies still apply. The simplest approach is to build your tool the DPDP way from the start.

Are you covered?

If your business tool, website or WhatsApp list collects information that identifies a person (name, phone number, email, and so on), yes. You decide why and how the data is used, so you are the Data Fiduciary. The AI builder or host you use (for example Lovable or Cloudflare) is your Data Processor: they handle data on your behalf.

The checklist for a lead tool

1. Collect only what you need. For most lead tools: name, WhatsApp number, and the answers. Don’t ask for date of birth, income or health details unless the tool truly needs them.
2. Show a short notice before they submit. In plain language: what you collect, why, and how to contact you. Link to your privacy policy.
3. Ask for consent with a clear action. An unticked checkbox or a clear “Yes, contact me” button. Never a pre-ticked box.
4. Use it only for that purpose. If someone asked for their GST score, you can follow up about GST. Adding them to unrelated promotions needs separate consent.
5. Make withdrawal easy. Tell people how to stop messages (for example, reply STOP on WhatsApp) and honour it.
6. Keep it safe. Turn on two-factor login for your builder and database. Run the two-user safety test: create two accounts and check neither can see the other’s data.
7. Don’t keep it forever. Decide how long you keep leads that don’t become customers, and delete them after that.
8. Have a contact person. Publish an email (and ideally a name) for privacy questions and complaints, and reply promptly.
9. Plan for a breach. If data leaks, you must tell the affected people and the Data Protection Board of India.

A consent line you can adapt

I agree that [Business name] may use my name, WhatsApp number and answers to send my result and contact me about [topic]. I can withdraw anytime by replying STOP. [Privacy policy]

Common mistakes

• Pre-ticked consent boxes or consent hidden in long terms.
• Collecting data “just in case”: every extra field is extra risk.
• Sharing leads with partners without telling people and getting consent.
• Test data in public inboxes: don’t create test accounts with public email services. Use your own addresses.
• No way to opt out of WhatsApp messages.

Where to go next

• Website vs business tool: which one brings you leads?
• Business tool ideas by industry, including what each tool should and shouldn’t collect
• Our own Privacy Policy, as an example of a plain-English notice