Marketing Consent in India: Navigating TRAI’s TCCCPR and the DPDP Act 

Introduction 

Businesses that communicate with customers through promotional SMS and voice calls must navigate two distinct regulatory frameworks: the Telecom Commercial Communications Customer Preference Regulations, 2018 (“TCCCPR”), issued by the Telecom Regulatory Authority of India (“TRAI”), and the Digital Personal Data Protection Act, 2023 (“DPDP Act”). While the TCCCPR regulates commercial communications transmitted through telecom networks, the DPDP Act governs the processing of digital personal data, including the mobile numbers and customer information used to identify, segment and target recipients. 

The two frameworks address different aspects of a marketing campaign. A business may have the necessary permission to send a promotional message under the telecom regulatory framework, but still need to establish a lawful basis for processing the recipient’s personal data. Conversely, obtaining consent for processing personal data does not, by itself, authorise a business to send promotional communications in violation of TRAI’s requirements. 

This distinction has become particularly important following the Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026, which expressly clarify that compliance with the TCCCPR does not exempt a sender from its obligations or liability under the DPDP Act. Businesses should therefore assess their marketing consent processes, customer databases and communication workflows against both frameworks. 

The regulatory framework governing commercial communications

The TCCCPR was notified by TRAI on 19 July 2018 and came into force on 28 February 2019. It establishes a framework to protect subscribers from unsolicited commercial communications (“UCC”), while enabling businesses to communicate with customers who have opted in or configured their preferences to receive such communications. 

The framework operates through a system involving Principal Entities (“PEs”), Registered Telemarketers, telecom access providers, registered headers, content templates and the Distributed Ledger Technology (“DLT”) platform. A Principal Entity is, broadly, the business or organisation that sends commercial communications, either directly or through a registered telemarketer. 

The TCCCPR framework requires businesses sending commercial communications to comply with applicable registration, consent, preference and message-template requirements. The DLT platform facilitates the recording and verification of subscriber preferences and consent, registration of entities and telemarketers, and registration of headers and content templates. The framework has also evolved through successive amendments. The 2025 amendments strengthened measures against unsolicited commercial communications, while the Third Amendment Regulations, 2026 introduced further changes, including revised definitions of consent and explicit consent, provisions concerning application-to-person calls and enhanced enforcement mechanisms. 

Importantly, the Third Amendment distinguishes between consent for establishing a commercial communication channel and the separate obligations that may arise under data protection law. It expressly provides that nothing in the TCCCPR exempts a sender from obligations or liability under the DPDP Act.

2. TRAI consent and DPDP consent serve different legal purposes 

Although both frameworks use the concept of consent, the nature and purpose of the permission required under each are different. 

Consent under the TCCCPR

Under the amended TCCCPR, consent refers to voluntary permission, whether explicit or inferred, given by a customer to a sender to receive commercial communications relating to a specific purpose, product or service. The amended definition clarifies that such consent is limited to permission for establishing the communication channel between the sender and the customer. 

The Regulations separately define “explicit consent”. This requires consent to be verified directly from the recipient in a robust and verifiable manner and recorded by the Consent Registrar, or to be obtained through another verifiable means and subsequently registered in the Consent Register in accordance with the procedure specified by TRAI. 

The Digital Consent Acquisition (“DCA”) facility enables senders to acquire digital consent for commercial communications. The consent is recorded on the DLT platform by the access provider following subscriber verification. The facility is particularly relevant where a subscriber’s registered preferences restrict promotional communications but the subscriber wishes to receive communications from a particular sender for a specified purpose, product or service. 

The TCCCPR also provides for the registration of Principal Entities and telemarketers, headers and content templates, as well as the scrubbing of commercial communications against applicable customer preferences and consent records. 

Accordingly, businesses should not treat the possession of a customer’s mobile number, an existing customer relationship or a general marketing database entry as sufficient evidence of permission to send every category of commercial communication. The nature and scope of the permission, the applicable subscriber preferences and the relevant requirements of the Regulations must be examined. 

Consent under the DPDP Act

The DPDP Act approaches the issue from the perspective of personal data processing. A mobile number linked to an identifiable individual constitutes personal data, as may other information used to profile customers, segment audiences or personalise marketing campaigns. Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, and must be expressed through a clear affirmative action. It must also be limited to the personal data necessary for the specified purpose. 

Section 5 requires a Data Fiduciary to provide a notice before or at the time of seeking consent. The notice must identify the personal data being processed and the purpose of processing, and provide the prescribed information concerning the exercise of rights and withdrawal of consent. Rule 3 of the Digital Personal Data Protection Rules, 2025 further requires the notice to be clear, independently understandable and sufficiently detailed to enable informed consent. 

For marketing activities, this means that a business should identify marketing as a specific processing purpose and explain the relevant categories of personal data involved. A broad statement in general terms and conditions or a privacy policy may not, by itself, establish valid consent for every form of marketing-related processing. The distinction is therefore substantive: TCCCPR consent concerns permission to communicate through the telecom channel, whereas DPDP consent concerns permission to process personal data for a specified purpose. A business must evaluate each requirement independently. 

The phased commencement of the DPDP Act: What businesses must consider

Although the DPDP Act was enacted in 2023 and the DPDP Rules were notified in November 2025, the framework is being brought into force in phases. As at November 2026, the core obligations relating to notice and consent under Sections 5 and 6 of the DPDP Act, along with the corresponding substantive provisions of the DPDP Rules, are scheduled to come into force on 13 May 2027. Certain provisions and rules have commenced earlier, while the Consent Manager framework under Rule 4 is scheduled to commence on 13 November 2026. 

Businesses should therefore distinguish between obligations that are currently enforceable under the TCCCPR and the DPDP requirements that are scheduled to become operational in May 2027. The fact that the substantive DPDP consent provisions are not yet in force does not make the forthcoming requirements irrelevant to present-day compliance planning. Organisations that rely on large customer databases, marketing automation platforms, outsourced telemarketing services or customer profiling should begin reviewing their consent architecture, privacy notices, data flows and vendor arrangements in advance of the DPDP implementation date. 

DND preferences, DLT scrubbing and the DPDP framework

One of the principal operational challenges for businesses is ensuring that customer preferences and consent records are accurately reflected before a marketing campaign is initiated. The TCCCPR framework enables subscribers to register their preferences concerning commercial communications. These preferences may relate to categories of communication, time bands and days of the week. The DLT ecosystem also supports the acquisition and recording of consent for communications from specific senders. 

Businesses must ensure that their campaigns comply with the applicable preference and consent requirements. This includes checking whether the recipient has restricted promotional communications, whether a valid consent record exists where required, and whether the communication complies with the relevant registration and template requirements. 

The DND or preference-registration mechanism should not, however, be treated as a complete substitute for a business’s own consent and data-protection compliance processes. Nor should the DLT record be treated as conclusive evidence that every aspect of the underlying personal data processing is lawful. For example, a business may have obtained permission to send promotional SMS messages for a particular product through the applicable DLT process. However, the business may also be using customer purchase history, demographic information or behavioural data to create marketing segments. The processing of that additional information must be assessed separately under the applicable data protection framework. 

Similarly, a business that has obtained consent to process customer information for marketing purposes must still comply with the TCCCPR when transmitting promotional SMS messages or voice calls. The existence of a privacy notice or an affirmative marketing consent on a website or application does not dispense with the applicable telecom requirements. 

Consent withdrawal and suppression of marketing communications

Consent withdrawal is another area in which businesses should ensure that their systems and internal processes are aligned. Section 6(4) of the DPDP Act provides that a Data Principal may withdraw consent at any time, and that the process for withdrawal must be as easy as the process through which consent was given. Following withdrawal, the Data Fiduciary must cease processing the personal data for which consent was withdrawn, within a reasonable time, unless such processing is required or authorised under the Act or another applicable law. 

The TCCCPR separately provides for the management and revocation of telecom consent and customer preferences through the relevant access-provider and DLT mechanisms. The Third Amendment also clarifies that revocation under the Regulations concerns withdrawal of the permission to establish the commercial communication channel. 

These mechanisms address different legal interests. A subscriber may withdraw permission to receive promotional calls or messages without necessarily withdrawing consent for every other purpose for which the business processes the subscriber’s personal data. For example, the business may continue to process certain information to provide an existing service, comply with a legal obligation or meet another applicable lawful requirement. Conversely, a withdrawal of consent for marketing-related data processing may require the business to stop using the relevant personal data for that purpose, even if a telecom consent record has not yet been updated. 

The two frameworks should therefore be reflected in a coordinated internal withdrawal and suppression process. Businesses should be able to identify the purpose for which consent was obtained, the channel to which it relates, the systems in which the consent is recorded and the consequences of a withdrawal request. 

A centralised suppression list, supported by appropriate access controls and audit trails, can help prevent a customer who has opted out from continuing to receive promotional communications through another campaign platform or outsourced service provider. Such a system should also distinguish marketing suppression from records that must be retained for legitimate operational or legal purposes. 

Designing a compliant marketing consent process

Businesses should consider the following measures when reviewing their marketing consent and communication practices: 

1. Separate telecom consent from data-processing consent

Consent for receiving promotional SMS messages or voice calls should be distinguished from consent for processing personal data for marketing, profiling or other purposes. The scope and purpose of each permission should be clear to the customer. 

2. Maintain verifiable consent records

Businesses should maintain reliable records of how and when consent was obtained, the identity of the sender, the product or service to which it relates, the communication channel and the applicable consent or preference status. Where the TCCCPR requires consent to be registered on the DLT platform, businesses should ensure that the prescribed process is followed. 

3. Review privacy notices and consent interfaces

Marketing-related notices should identify the personal data being processed and the specific purpose for which it is used. Consent should be obtained through a clear affirmative action and should not be bundled with acceptance of unrelated terms or made a condition of accessing a service where such processing is not necessary for that service. 

4. Implement effective opt-out and withdrawal mechanisms

Businesses should provide accessible mechanisms for subscribers to withdraw telecom consent or update communication preferences, and should also prepare for the DPDP Act’s consent-withdrawal requirements. Internal processes should ensure that withdrawal requests are communicated to relevant marketing platforms, business teams and service providers. 

5. Review third-party marketing arrangements

Where telemarketing agencies, customer relationship management platforms, marketing automation providers or other service providers process personal data on behalf of a business, the organisation should review the contractual and operational arrangements governing those activities. Once the relevant DPDP provisions commence, Data Fiduciaries will also need to ensure that processing undertaken through Data Processors is supported by a valid contract and appropriate safeguards. 

6. Conduct periodic compliance checks

Consent records, DLT registrations, headers, message templates, subscriber preferences and marketing databases should be reviewed periodically. Businesses should also assess whether their campaign workflows distinguish promotional communications from transactional and service communications, and whether the correct regulatory requirements are applied to each category. 

Conclusion

The coexistence of the TCCCPR and the DPDP Act requires businesses to approach marketing consent as a matter of both telecom regulation and personal data governance. The two frameworks are complementary in their objectives but distinct in their requirements: one regulates the transmission of commercial communications through telecom networks, while the other governs the processing of personal data used in connection with those communications. 

The Third Amendment to the TCCCPR, 2026 reinforces this distinction by expressly preserving a sender’s obligations and liability under the DPDP Act. As the substantive DPDP provisions approach commencement in May 2027, businesses should review their existing marketing consent processes, DLT compliance arrangements, privacy notices, customer databases and third-party marketing contracts. 

A robust marketing compliance framework will require more than a record of customer consent. It will require businesses to demonstrate that the permission obtained is appropriate for the relevant purpose, that telecom preferences are respected, that personal data is processed lawfully and that withdrawal requests are effectively implemented across the organisation’s communication systems