22 Aug 2026 · 9 MIN READ

DPDP for consultancies: consent without friction

The DPDP Act 2023 is India's law on digital personal data. It applies to any consultancy or clinic that holds a prospect's phone number.

Abijith JojuFounder, Crosvia (Veedo Studio LLP)

What the law actually asks of a lead business

The Digital Personal Data Protection Act 2023 (DPDP Act) received assent on 11 August 2023. It is being brought into force through the DPDP Rules, published in draft in January 2025 and notified in stages.

It is short by the standards of data laws, about 44 sections, and most of it reads as plain obligations. This article is an operator's summary, not legal advice; read the Act and the notified rules, and ask a lawyer about your specific situation.

The four duties

For a consultancy, clinic or agency that collects enquiries, the Act reduces to four duties.

Have a lawful basis for processing a person's data. For lead businesses that basis is almost always consent under section 6, or the "legitimate use" in section 7 where a person voluntarily gives data for a specific purpose and has not said no.
Tell the person, at or before collection, what you collect and why, and how they can complain (section 5).
Protect the data with reasonable security safeguards and report breaches to the Data Protection Board and the affected people (section 8).
Honour the person's rights: access, correction, erasure, and withdrawal of consent, with a grievance contact (sections 11 to 14).

What it costs to get wrong

The penalty schedule tops out at ₹250 crore for failure to take security safeguards and ₹200 crore for failing to notify a breach. Those numbers are written for large platforms, but the Board can impose proportionate penalties on anyone, and a 40-seat consultancy that leaked passport scans from a counsellor's phone would not have a good defence.

The fear most founders have is that consent means a wall of legal text in front of every form and a drop in enquiries. It does not.

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Section 5 requires the notice to be in plain language, optionally in any of the 22 scheduled languages. None of that requires length.

What a compliant capture looks like

On a web form:

One sentence above the submit button: "We will use your name and number to contact you about this enquiry on WhatsApp and by phone. We do not share it. Unsubscribe any time."
A link to the privacy notice.
An unticked box if you also want to send marketing later: "Send me intake updates and offers."

On a Meta lead form, the first line of the form's privacy disclaimer does the same job, and the first WhatsApp template should restate it in one line: "Reply STOP to opt out."

On WhatsApp itself, an inbound message from the person is a clear affirmative action for replying about what they asked. It is not consent for a broadcast list. Keep the two apart.

Recording it without slowing anyone down

What makes this frictionless is recording it automatically. Crosvia stores consent per channel (WhatsApp, SMS, email, calls) on every lead, stamps the source and time, and the automations check it before sending. A counsellor never has to remember; a broadcast tool simply does not show the people who said no.

A worked example: one enquiry through its life

Meera fills a Meta lead form for a dental clinic's aligner consultation on 3 March.

3 March: Lead created. Consent recorded: WhatsApp and calls, purpose service, source Meta lead form, marketing not granted. First utility template sent. Notice link included.
4 March: Consultation booked and attended. Treatment plan PDF sent on WhatsApp. The clinic asks in the chat whether she would like offers on whitening; she replies "yes". The reply itself is the evidence, and it sits on the thread with its timestamp.
20 March: She pays the first instalment through a Razorpay link. Invoice generated. The invoice is a tax record and carries its own retention under GST rules, separate from the lead.
9 June: She messages "please delete my details, going with another clinic." The receptionist clicks Erase on the lead. Crosvia removes name, phone, email, message bodies, notes, transcripts, call recordings and documents, and writes an audit row in the same transaction saying an erasure was performed on 9 June by that user. Financial records are kept where GST requires them; the erase action clears the personal fields Crosvia holds on the lead. At no point did anyone consult a spreadsheet of consents or a lawyer. The system asked once, recorded everything, and erased on request. Telling Meera the erasure is done is still a human job — Crosvia does not message a number it has just deleted.

The seven things to set up this month

Write a one-page privacy notice in plain English, and if your market is Kerala or Tamil Nadu, in Malayalam or Tamil too. Link it from every form and template.
Add the one-sentence consent line and the optional marketing box to every web form. Re-check your Meta lead form privacy disclaimer.
Decide a retention period for leads that go quiet. 18 months is a common choice. Put it in the CRM so it runs without anyone remembering.
Turn on per-channel consent recording and stop anyone from sending broadcasts to people who did not opt in.
Name a grievance contact and publish the email on your site (section 13). Answer within the period the notified rules set.
Get documents off personal phones. Passport scans and mark sheets belong in the CRM under role-based access, not in a counsellor's WhatsApp gallery.
Check your vendors. Your CRM, your telephony provider and your WhatsApp BSP are data processors under the Act; they should each tell you where data is hosted and how it is encrypted. Crosvia is hosted in DigitalOcean's Bengaluru region, encrypts integration secrets with AES-GCM, runs daily backups, and publishes its sub-processor list on the security page.

What this looks like in Crosvia

Consent per channel and purpose on the lead, with source and time.
Erase action that removes personal data, messages, recordings and attachments, keeps an audit entry, and respects the retention rule for financial records.
Retention setting per workspace that anonymises or erases quiet leads on schedule.
Automations and broadcast tools that check consent before sending.
TOTP two-factor authentication, role-based access, and an audit log of every sensitive change, written in the same transaction as the change.

None of this is a substitute for reading the Act. It is the part that a lead business would otherwise have to build by hand.

What to do next

The full list of safeguards and sub-processors: Security.
Consent capture on hosted forms and the first WhatsApp template: Inbox and WhatsApp Cloud API.
Related terms: DPDP Act, consent, data erasure request, audit log.
Our own policies: Privacy, Data deletion.
How the WhatsApp rules interact with consent: The WhatsApp 24-hour window.

QUESTIONS THIS NOTE ANSWERS

Short answers, kept specific.

Does the DPDP Act apply to a small consultancy with one office?

Yes. The Act applies to anyone processing digital personal data in India, regardless of size, once it is in force through the notified rules. There are relaxations for some obligations for small entities that the Central Government may notify, but the core duties of lawful basis, security and honouring erasure requests apply.

Is a Meta lead form submission valid consent under DPDP?

A lead form where the person asks to be contacted about a specific enquiry is a reasonable basis for contacting them about that enquiry. It is not consent for unrelated marketing or for sharing the number with partners. Record what the person consented to and stick to it; Crosvia stores consent per channel on the lead, with its source and time.

What must a consent request contain?

Section 5 of the Act requires a notice, in clear language, saying what personal data is collected and for what purpose, how the person can exercise their rights, and how to complain to the Data Protection Board. Section 6 requires the consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. A pre-ticked box does not meet that.

What happens when a prospect asks us to delete their data?

Section 12 gives the person a right to correction and erasure. You must erase the data unless a law requires you to keep it, for example tax records of a paid invoice. Crosvia's erase action removes the personal fields, messages and recordings, keeps an audit entry that an erasure happened, and retains only what the retention rule you set says must stay.

How long can we keep leads who never converted?

Section 8(7) says personal data should be erased when the purpose is no longer served or consent is withdrawn, and the draft DPDP Rules 2025 propose specific retention periods for some classes of data fiduciary. A reasonable default for a lead that went quiet is 12 to 24 months, then anonymise or erase. Set the number in Crosvia's retention settings and let it run.

Do we need a Data Protection Officer?

Only Significant Data Fiduciaries designated by the Central Government must appoint a DPO under section 10. A typical consultancy or clinic is not one. You still need a named contact for grievances under section 13, which can be a founder or manager; publish that email on your website.

What should we do about WhatsApp conversations that contain documents?

Passport scans, mark sheets and medical reports in a WhatsApp thread are personal data, and some are sensitive in practice. Store them in the CRM rather than on personal phones, restrict who can open them by role, and include them in erasure. Crosvia stores attachments per workspace in object storage, serves them through signed, time-limited URLs, and deletes them with the lead.