Building an email list with consent under DPDP, GDPR and CASL

Fibvo editorial · 21 August 2026 · 5 min read

A sales manager comes back from a trade fair with a stack of visiting cards and a spreadsheet of badge scans. Someone suggests adding them all to the monthly newsletter. It feels harmless, because these people stopped at your stall. But stopping at a stall is not the same as asking for marketing email, and the laws that apply to your list treat that difference seriously.

Consent and notice under India's DPDP Act

India's Digital Personal Data Protection Act, 2023 covers personal data in digital form, and an email address linked to a person is personal data. Unlike GDPR, the Act has no general legitimate-interest ground for marketing, so consent is the safe basis to plan for. That consent must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. That rules out silence, pre-ticked boxes and consent hidden inside terms of service.

You also owe the person a notice. It should explain what data you collect, why, how they can withdraw consent and how they can complain to the Data Protection Board. It must be in clear, plain language, and the person must be able to read it in English or in any language listed in the Eighth Schedule of the Constitution. Withdrawing consent must be as easy as giving it.

These notice and consent duties are being phased in under the DPDP Rules 2025, so not all of them can be enforced yet. Build your forms to the standard now, and the list will not need rebuilding later.

Adding overseas buyers to the same list

An Indian exporter's list often includes buyers in Europe, the UK, the United States and Canada. The simplest approach is one sign-up process that meets the strictest of them.

• GDPR (EU) and UK GDPR: consent must be freely given, specific, informed and unambiguous, and you must be able to show when and how it was given. National ePrivacy rules on electronic marketing sit alongside GDPR.
• CAN-SPAM (United States): an opt-out law that does not require consent before you send. Every commercial email still needs accurate headers, a subject line that does not mislead, a valid physical postal address and a working unsubscribe, honoured promptly and within ten business days at most.
• CASL (Canada): you need consent before sending, express or, in limited cases, implied. A request for express consent must say who is asking, why, how to contact them and that the person can withdraw at any time.

A form built to the DPDP Act and GDPR will generally meet CASL's consent standard too, if it names your business and says consent can be withdrawn. Accurate sender details, your postal address and an unsubscribe link in every email then cover CAN-SPAM's main duties.

A sign-up form that records real consent

• Say what people will receive and how often, for example 'a monthly email on changes to export documentation'.
• Ask only for what the purpose needs. An email address and a first name are enough for a newsletter. A phone number serves a different purpose and needs its own reason.
• Where the form has another main purpose, such as a quote request, add marketing as a separate unticked checkbox. The quote request must still work if the box stays empty.
• Place a link to your privacy notice next to the submit button, not only in the website footer.
• Keep evidence: the date and time, the page or form used, and the exact wording shown. Check what your email platform stores and fill any gaps.

Offline sign-ups follow the same principles. A tablet at your stall running the same form, or a printed card with a box to tick and a line of wording, gives you a record. A badge scan on its own does not.

Lead magnets without the bait-and-switch

A lead magnet is something useful offered in exchange for an email address, such as a checklist of the documents needed for a first export shipment. The problem starts when the download is quietly treated as permission for months of marketing.

A person who wanted one checklist has not asked for a year of emails.

Keep the two decisions apart. Send the checklist to anyone who requests it, and offer a separate, unticked option to receive future emails. Making marketing consent a condition of the download is hard to defend as freely given under GDPR, or as unconditional under the DPDP Act, unless ongoing emails are clearly the thing being offered and the form says so.

Double opt-in as your proof

Double opt-in means that after someone submits a form, they receive an email asking them to confirm with a click. Only after that click do they join your marketing list.

Neither the DPDP Act nor GDPR names double opt-in as a requirement. It is still the most practical way to show that the person who signed up controls the address. It filters out typing errors, fake addresses and people signing up someone else.

• Send the confirmation email straight away, with a subject line that says what it is.
• Keep it to one sentence about what they signed up for and a single confirm button.
• Send one reminder a day or two later if there is no click, then stop.
• Keep unconfirmed addresses out of every marketing send, and delete them after a fixed period, such as thirty days.

As for the trade fair list, follow up one to one on the conversations people actually had at your stall, and include a link to your sign-up form. Nobody joins the newsletter until they use it.

---

Written by Fibvo — Bengaluru and Erode, India — working with clients in other time zones. Questions, or think we have it wrong? Tell us.