DPDP Phase II Is Here. Does Your Cold Email Change?

For most cold-email senders, nothing changed this week. Mid-November 2026 opened registration for consent managers, meaning companies incorporated in India with a minimum net worth of ₹2 crore. The date that matters for outreach is May 2027, when notice, consent, security, breach-reporting and data-rights duties become enforceable. This article is not legal advice; confirm your own list and sending volume with a lawyer.

If you searched "DPDP cold email" because you heard that Phase II began on 13 November, the short version is this: this week's milestone, the second of three phases, is about consent-manager companies, not about senders.

Parliament enacted the DPDP Act on 11 August 2023. The government then notified the DPDP Rules, 2025 on 14 November 2025, after 6,915 consultation inputs. The Rules allow an eighteen-month period for phased compliance.

The phases work like this: the Data Protection Board provisions took effect immediately, Rule 4 (consent-manager registration) one year after publication, and the core Rules covering notice, consent, security and rights eighteen months after. Law-firm trackers differ by a day on the exact dates (12, 13 or 14), so the practical reading is "mid-November 2026" for consent-manager registration and "May 2027 (13 May in most trackers)" for the core duties.

Sources: the [PIB backgrounder on the DPDP Rules](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf), plus law-firm phase trackers.

So what opened this week? Registration for companies that want to operate as consent managers, which must be incorporated in India with a minimum net worth of INR 2 crore. From 13 May 2027, all notice, consent, security, breach-reporting and data-subject-rights obligations become enforceable. Citizens will also be able to file complaints online, through a portal and an app.

For most people asking about the DPDP Act and B2B cold email, this is the first real question. The Act protects personal data, and the Data Principal is the individual the data relates to.

Our reading: a named person's work email or direct mobile number is data about an individual, so the Act can cover it. A generic company inbox such as info@ or sales@, or the phone number a business publishes for customer calls, is closer to data about a business than about an individual.

That distinction decides how much of your list the Act touches. It is our reading, not a court's, so treat it as a working assumption.

Section 3(c)(ii) says the Act does not apply to "personal data made or caused to be made publicly available by the Data Principal to whom it relates," or by another person under a legal obligation to make it public. The Act's own illustration is a person who posts their own data publicly on social media.

So the question for every row of your list is: who made this public?

India Briefing's caution applies here: data obtained by unauthorised access, or by circumventing technical or contractual restrictions, raises separate legal questions, and companies should establish how the information entered the public domain.

The practical habit: record, per row, the URL where the contact was published and the date you saw it. If you cannot answer "who published this," treat the row as covered.

Most of this is housekeeping, and all of it fits before the DPDP May 2027 deadline.

The phase dates matter less than provenance. A bought database gives you rows with no history: you cannot say who published each address, so the public-data exclusion is hard to argue. A live search of listings that businesses publish about themselves gives you rows that each point back to a public source. We compared both approaches in bought database vs live search.

I'm Tarun, founder of Mantis.

Mantis finds B2B leads by live map and web search of business listings, including businesses that have no website, in India and outside the US. Each row comes from a live public listing. That does not make anyone exempt: you still honour opt-outs, you still answer rights requests, you still secure the list. Mantis comes with 500 free credits once at signup, no card.

And if the contact is an Indian SMB whose owner rarely reads email, cold email may be the wrong channel entirely. We covered that choice in call, WhatsApp or walk-in for Indian SMBs.

This week's milestone concerns consent-manager companies, not senders. The sender-facing duties arrive in May 2027. Use the months in between to give every row of your list a source, an opt-out and an owner. This is not legal advice; confirm with a lawyer for your list and volume.

Build a list where every row has a source: how to find clients.