DPDP Act, 2023 and B2B sales data: what changes, what does not

India's Digital Personal Data Protection Act, 2023, was notified in November 2025 and came into force in May 2027. It is the country's first comprehensive personal-data law, and it changes the legal posture for sales teams that store personal contact data.

Three sections matter for B2B-data work. Section 3(c)(ii) carves out personal data that is made public by legal mandate, or by the data principal themselves. Section 4 sets out lawful grounds for processing (consent or "certain legitimate uses"). Section 12 gives data principals access, correction, and erasure rights, exercisable directly against any data fiduciary.

Section 3(c)(ii) is the part most people misunderstand. It does not say "anything on the internet is fair game". It says specifically: data made public by legal mandate (e.g., MCA director records), or made public by the data principal themselves (e.g., a company's own website). Scraped personal mobile numbers that the individual did not publish? Outside the carve-out. Sourced via a contributory mechanic that captured contacts from users' inboxes? Outside the carve-out.

The practical implication for sales teams: the cleanest legal posture is to source from statutory registries (MCA, GST, Udyam, DGFT, ICEGATE) and from the company's own published surfaces (website, public LinkedIn page, IndiaMART seller listing). Anything else either needs explicit consent or a licensed third-party basis with audit trail.

Storing scraped personal mobiles in 2027 will be the equivalent of storing scraped European emails after GDPR took effect: technically possible, legally indefensible, and the first complaint to a friendly Data Protection Board investigator becomes a fine.

The other practical implication: build the DPDP rights pipeline now. Any data principal can file an access, correction, or erasure request against your database. You have 30 days to respond. The first time this happens, you do not want to be writing the pipeline.