Is cold email legal in India under the DPDP Act?

Does the DPDP Act cover a business email address?

Probably, when the address names a person. The Act defines personal data as any data about an individual who can be identified from it. Processing covers collecting, recording, storing, using, sharing and similar operations on digital personal data¹. A named person plus a work email identifies someone, so collecting and mailing it is processing. That is our reading of the text, not a court's, and the Act does not carve out business contacts.

A generic address such as info@ or sales@ that points to no individual is a different case, because the Act is about individuals. The Act also applies to digital personal data processed in India, and to processing outside India that relates to offering goods or services to people in India¹.

What lets you email someone you have never contacted?

Section 4 gives two routes: the person's consent, or a certain legitimate use. Section 7 lists those uses, and it has no general marketing or legitimate-interest ground like the one in European law. The closest fit for outreach is section 7(a): data the person voluntarily provided for a specified purpose, where they have not said they do not consent. Its own illustration is a person who messages a broker for help finding a rental and shares her details for that purpose¹.

A cold prospect has not given you their data for your purpose, so on this reading section 7(a) does not cover a first email. That leaves consent, or the exclusion for data the person made public themselves. Whether a name and email on a company staff page counts as made public by the person is unsettled, and we would not rely on it without advice¹.

What does valid consent look like, and when do the duties start?

Consent has to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action for a stated purpose, and the person can withdraw it as easily as they gave it. The request must come with a notice saying what data is used and why, in English or any language in the Eighth Schedule. If you rely on consent, you must be able to prove that the notice and the consent happened¹.

The Rules were notified on 14 November 2025 and give an eighteen-month period for phased compliance². The Rules' own commencement clause starts the notice rule (rule 3) and most operating duties (rules 5 to 16) eighteen months after publication, which is about mid-May 2027 by simple arithmetic⁴. The Act itself comes into force on dates the Central Government notifies, and different provisions can have different dates¹. Check the current notifications before you rely on this page.

What are the penalties?

The Schedule to the Act sets maximum penalties of Rs 250 crore for failing to keep reasonable security safeguards, Rs 200 crore for failing to notify a breach or breaching the duties on children's data, and Rs 50 crore for any other breach². These are the most the Data Protection Board may impose, not typical amounts.

What about the US, UK and EU?

The rules follow the recipient's country, not yours. None of the sources below treats AI-drafted email differently.

United States. CAN-SPAM makes no exception for business-to-business email. You need truthful header information, a subject line that matches the content, a clear disclosure that the message is an ad, a valid postal address, and an opt-out honoured within 10 business days. Each email in violation can carry penalties of up to $53,088³.

United Kingdom. The ICO says the UK electronic mail marketing rule does not apply to corporate subscribers, so company addresses need no prior consent. Sole traders and some partnerships count as individuals and need consent or the soft opt-in. UK GDPR still applies to a named person, who has an absolute right to object to direct marketing. The ICO notes its guidance is under review⁵.

Germany. The Act against Unfair Competition treats email advertising without the recipient's prior express consent as an unacceptable nuisance, with a narrow exception for your own existing customers⁶. Other EU countries have their own rules, so check each recipient's country.