Regional terms: India

Version 2026-10-05 · Last updated October 5, 2026

In short: India's DPDP Act requires clear, specific, informed consent with an itemised notice. Its main duties apply from 13 May 2027; follow them now.

The DPDP Act and Rules

The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 apply to personal data of people in India. Consent must be free, specific, informed, unconditional, unambiguous and given by a clear affirmative action, with a notice in plain language that lists the data and the purpose, available in English or a language of the Eighth Schedule. Withdrawing consent must be as easy as giving it. The main obligations on data fiduciaries (notice, consent, security, breach reporting, rights) become enforceable on 13 May 2027, and penalties can be very large; we recommend following them already.

You are the data fiduciary for your contacts and PostaraAI is your data processor; the Data Processing Addendum applies.

Other rules and invoices

Other laws such as the Information Technology Act apply. Telemarketing and SMS rules do not apply to email. If you have a GST registration, enter your GSTIN in Settings > Legal & privacy so it appears on invoices.

What PostaraMail does for you

How PostaraMail helps: when you send a campaign you choose the regions to include; strict regions only include contacts with a clear opt-in; every contact stores the consent wording, time, source and country; double opt-in is available; unsubscribes take effect immediately; and you can export a consent record for any contact.

General information

This addendum is general information about the main rules for sending email and handling personal data. It is not legal advice and may not be complete. You remain responsible for complying with the law that applies to you and your recipients.

More: Legal centre · Trust and security · What changed · Privacy request