That old lead list from last year? It can still get you in trouble.
You ran a sale campaign last Diwali. You collected phone numbers and names. The campaign ended months ago. But that list is still sitting in your laptop, your agency's folder, or a WhatsApp group. Under India's new data law, old data that you no longer need is a risk. If something goes wrong, you are responsible. This applies to you even if an agency ran the campaign for you.
Say you ran a WhatsApp campaign for your shop. Your agency collected 500 customer phone numbers. The campaign ended in March. It is now September. Those numbers are still in the agency's Google Drive. Under the new law, that is a problem. You must have a clear plan: delete old data on time, and know what to do if data leaks. Even one leaked phone number can trigger a complaint against your business.
Ask your agency to delete old lead lists from finished campaigns now.
Write down what you will do if customer data ever leaks.
Check if your business is ready. Takes 3 minutes. Visit saralprivacy.com/assessment
“When the campaign ends the data question does not end automatically.”
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
