Is Cold Calling Legal Under DPDP?
Liability Check
Under the DPDP Act, cold calling individuals without their explicit, verifiable consent is a direct violation of data privacy principles. This isn't just annoying; it's a high-risk activity carrying potential penalties up to ₹250 Crore.
Why Is Cold Calling Legal Under DPDP? is at Risk
The DPDP Act mandates **explicit, informed consent** for processing any personal data, including phone numbers used for cold calling. Simply obtaining a phone number from a public directory or a third-party list does not automatically constitute legal grounds for unsolicited calls. Even if your target audience is B2B (e.g., calling CXOs in Whitefield or Gurgaon's Cyber Hub), contacting individuals at their professional numbers without prior consent or a clearly defined 'legitimate use' is a high-risk activity. The **Data Protection Board** can initiate investigations based on complaints, leading to significant fines. Remember, the TRAI DND registry is a separate compliance layer.
Common Violations
- 1.Calling individuals who have not explicitly opted in for marketing communications.
- 2.Purchasing or using third-party contact lists without verifying prior consent for calling purposes.
- 3.Not providing an easy, accessible mechanism for individuals to opt-out or withdraw consent from calls.
The Immediate Fix
Immediately cease all cold calling activities that target individuals without their explicit, verifiable consent. Implement a robust opt-in strategy for all marketing communications, including phone calls, and ensure your CRM or contact management system logs granular consent status. For existing lists, review data acquisition methods and consider re-permissioning campaigns if consent status is unclear or non-existent.
Projected Compliance Deadline: Immediate