What the DPDP Rules actually change for a small sales team
India's DPDP Rules were notified on 13 November 2025. Most of the obligations that matter to a sales team do not land on day one, but the runway is shorter than it looks, and the provisions that bite hardest are the ones that touch your CRM.
The shape of it, as EY described it when the Rules were notified: some provisions apply immediately, including those relating to the Data Protection Board, Consent Manager obligations apply in 12 months, and Data Fiduciary obligations apply in 18 months. Count forward from 13 November 2025 and that is roughly 13 November 2026 for the consent-manager milestone and 13 May 2027 for the obligations that actually govern how a sales team operates.
Which means that as of November 2026 you are a couple of months from the first deadline and about six from the one that matters.
| OBLIGATION | WHAT IT MEANS FOR A SALES TEAM | THE RULE |
|---|---|---|
| Notice at collection | Tell a prospect what you are collecting and why before you collect it, not in a policy page nobody opens | Rule 3 |
| Purpose limitation and retention | Keep a prospect's data only while the reason you collected it still exists, and delete it when it does not | Rule 8 |
| Reasonable security safeguards | Protect the record where it sits, and control who inside the company can read it | Rule 6 |
| Breach intimation | Intimate a personal data breach to the Data Protection Board within 72 hours of becoming aware of it | Rule 7 |
| Grievance contact | Publish the route a person can use to complain about how their data is handled | Rule 9 |
| Data principal rights | Handle access, correction and erasure requests when a person makes them | Rule 14 |
Rule numbers and obligations as set out in the DPDP Rules 2025, notified 13 November 2025, read 4 November 2026. The 72-hour breach window and the 48-hour notice before erasure are as described in EY's analysis of the notified Rules.
None of that requires a compliance team. It requires you to know which of your tools holds personal data, and what you are using it for.
The four obligations that land on your CRM first
A sales CRM is not where personal data lives by accident. For a team doing outbound calls, email campaigns and site demos, the CRM is the single richest record you keep of a person: name, number, email, what they asked for, who they spoke to, and a recording of what was said. That makes four obligations land there before anywhere else.
- —Notice, captured where the data is collected. Rule 3 requires notice to the data principal. If you collect a lead through a form, the honest place to give notice is on that form, next to the submit button, not three pages deep in a privacy policy that no one from a sales team has ever sent.
- —Retention, with an actual end date. Rule 8 turns on the time period for which the specified purpose is being served. A lead you called in March 2023 and never spoke to again is not a record you should still be exporting. Put a review date on the record and let something delete it when the date passes.
- —Access control, because safeguards are about people before they are about servers. Rule 6 asks for reasonable security safeguards. In a ten-person company the realistic risk is not a sophisticated attacker. It is a rep exporting the whole contact list to a personal drive, or a shared login where every rep can read every customer's details. That is a permissions problem before it is an encryption problem.
- —A breach process that has been rehearsed. Rule 7 and the 72-hour clock assume you can answer three questions quickly: what was held, who was in it, and what do we tell the Board. A CRM that keeps a full activity timeline is what makes the second question answerable in an hour instead of a week. EY's analysis of the notified Rules notes the Board expects intimation as soon as a fiduciary becomes aware, with a detailed submission within 72 hours.
One more catches people out. EY's summary of the Rules notes that individuals must be notified at least 48 hours before their data is erased. An erasure workflow that deletes silently is not the workflow the Rules describe.
What your CRM can do about it, and what it cannot
Here is the honest split. A CRM is good at the controls that live in the record, and bad at everything that lives in the policy.
- —Keep one record per person, with duplicate detection on import, so a prospect is not chased twice and two rows do not become two consent problems. Our contact records do this on every plan.
- —Hold a full activity timeline per contact and per deal, so you can show what happened to a person's data without reconstructing it from memory.
- —Control who sees what, with custom roles and audit logs for teams that need them. This is the cheapest part of Rule 6 to get right.
- —Capture the lead and the notice together, through a form you build and embed yourself, so the notice and the consent live on the same screen as the submit button.
- —Run retention and breach-response work as automations with triggers, conditions and actions, and no per-rule action meter to argue about.
- —Keep call records on the contact through your own number, rather than scattering call logs across a separate dialling tool, and keep campaigns segmented from the same place that holds the contacts, with no list export in between.
And here is what it cannot do, which matters more.
- —It cannot be your consent management platform. Consent Managers register with the Board and carry their own obligations under Rule 4 and Schedule I. That is a different product category doing a different job.
- —It cannot produce your records of processing, run a data protection impact assessment, or answer a customer's security questionnaire about how you govern data.
- —It cannot tell you whether a particular use of a prospect's data is lawful. That is a legal question, and the answer depends on your notice, your stated purpose and your sector.
- —It cannot make you a Data Protection Officer, or discharge the audit obligations that apply if you are a Significant Data Fiduciary.
- —It cannot cover a second regime. If you sell to EU or UK buyers and handle data about people in those regions, GDPR applies alongside DPDP, and one CRM does not unify two legal frameworks.
If a tool's job is to hold records and control access to them, a CRM is a reasonable place to do that work. If a tool's job is to tell you whether you are compliant, no CRM is.
Honest caveats: when a small team should not be solving this with a CRM
Four cases where the right answer is something else entirely.
- —If you might be a Significant Data Fiduciary. The notified Rules set additional obligations for Significant Data Fiduciaries, including a Data Protection Officer, impact assessments and periodic audits, per EY's summary. The numerical thresholds for designation had not been fixed in the Rules as notified and were expected to follow later. Industry guidance circulating in 2025 put indicative markers well above where a ten-person company sits, around 50 lakh records or Rs 250 crore of revenue, though those are indicative figures and not law. If your volumes are anywhere near that, you need a compliance programme and probably a DPO, not a CRM with better permissions.
- —If consent is the actual problem. If you collect through a website, an app, a call centre and a branch office, you need consent captured and honoured across all of them. That is a consent management platform's job.
- —If your buyers demand evidence. Enterprise customers will ask for your processor agreements, retention schedules, sub-processor lists and breach history. A CRM will not answer those. A good compliance programme and a lawyer will.
- —If you have outgrown a small-team CRM altogether. BeigeCRM is built for teams of two to twenty people. Past that you need the permissions depth, territories and governance that enterprise tiers exist to provide, and you should read our Salesforce comparison and HubSpot comparison before deciding.
And one plainly: if your real problem is that you are holding far more data than you use, no product fixes it. Deleting what you do not need is the cheapest safeguard available to you, and it is available today.
What to do in the next ninety days
You are six weeks from the consent-manager milestone and about six months from the one that matters. A workable order:
- —Week one: find out what you actually hold. Export the list and count the fields nobody reads. Most teams find a dozen they never use, and a personal phone number somebody typed in 2023.
- —Week two: write the notice you will actually show people, then put it on your forms and in your email footer. One page, plain language, specific about why you are calling.
- —Week three: set retention rules. Pick a review interval, write it down, and automate the review. A record with a review date beats a record with a policy.
- —Week four: fix access. One login per person, roles that match what each person needs, and no exports to personal accounts. This is the cheapest part of Rule 6 to get right.
- —Month two: rehearse a breach on paper. Decide who decides, who drafts the Board notification, and who speaks to affected customers, then run it once before you need it.
- —Month three: write down the purposes you collect for, and get rid of the rest. Anything outside your stated purpose is data you should not be holding.
None of this needs a consultant on day one. It needs a list of what you hold, a decision about how long you keep it, and one person who owns both. The rules then come to you, in eighteen months, instead of arriving as a crisis.
