When a visitor hands you a visiting card, India’s DPDP Act generally lets you use it for the reason they gave it, such as sending the quote they asked for. Newsletters, bulk campaigns and sharing the details need their consent. These duties take effect on 13 May 2027, so set up the habits now.
In short
- When the Act applies
- Once a card is scanned, saved in a phone, or typed into a spreadsheet or CRM
- In force today
- Definitions and the Data Protection Board; notice, consent, rights and penalties start on 13 May 2027
- Following up
- Generally a legitimate use under section 7(a), until the person says stop
- Needs consent
- Newsletters, bulk WhatsApp, and sharing or selling the details
- Their rights
- Correction and erasure, answered within a period you publish of no more than 90 days
- Penalties
- Up to ₹50,00,00,000 (₹50 crore) for most breaches; up to ₹2,50,00,00,000 (₹250 crore) for weak security
This is general information, not legal advice. It explains what the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 say about one everyday situation, quoting the Gazette text as checked on 10 October 2026. Where the law can be read two ways, we say so. Ask a lawyer before you rely on it.
Does the DPDP Act cover a visiting card someone hands you?
A visitor stops at your stall, talks about blister foil and hands over a visiting card (a business card, if that is the word you searched for). Three points in the Act decide what happens next.
A paper card in a drawer is outside the Act. Section 3(a) covers digital personal data, including data collected “in non-digital form and digitised subsequently”. Scanning the card, saving the number in a phone or typing it into a spreadsheet brings it in.
Work contact details are still personal data. Section 2(t) covers “any data about an individual who is identifiable by or in relation to such data”. A name with a mobile number identifies a person, even on a company card. The Act has no exemption for business contact details.
Your business is the Data Fiduciary. Section 2(i) gives that name to whoever “determines the purpose and means of processing of personal data”. The visitor is the Data Principal. A scanner app or CRM working for you is a Data Processor, which section 8(2) lets you use “only under a valid contract”.
Section 3(c) excludes data used for a “personal or domestic purpose”, and data “made or caused to be made publicly available” by the person. Neither obviously fits a card handed over at a stall.
Which parts of the DPDP Act are in force on 10 October 2026?
The Act starts in three stages. Notification G.S.R. 843(E), in the Gazette dated 13 November 2025, sets them:
| When | What comes into force |
|---|---|
| On publication, 13 November 2025 | Section 1(2), section 2, sections 18 to 26, 35 and 38 to 43, and section 44(1) and (3): definitions and the Data Protection Board |
| One year later, 13 November 2026 | Section 6(9) and section 27(1)(d): registration of Consent Managers |
| Eighteen months later, 13 May 2027 | Sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, the rest of section 27, sections 28 to 34, 36 and 37, and section 44(2): notice, consent, legitimate uses, rights and penalties |
The DPDP Rules, 2025 (G.S.R. 846(E), same date) follow suit: rules 1, 2 and 17 to 21 apply on publication, rule 4 a year later, and “Rules 3, 5 to 16, 22 and 23”, including notice, security and rights, after eighteen months.
The notification gives periods, not calendar dates. The Gazette issue is dated 13 November 2025, but the Press Information Bureau backgrounder says 14 November, so some commentators give 14 May 2027. Plan for 13 May 2027, the earlier reading.
The Removal of Difficulties Order, 2026 (S.O. 5458(E), in the Gazette of 6 October 2026) only corrects wording in sections 9(1) and 10(2)(c)(ii). It moves no dates and does not touch section 7. Section 43A of the Information Technology Act, 2000 stays in force until May 2027, since section 44(2), which omits it, is in the last group.
Why start now, if the duties begin in 2027?
The cards you scan this season will still be in your CRM on 13 May 2027. A consent you never recorded cannot be proved later. Section 5(2) also asks for a notice, “as soon as it is reasonably practicable”, to anyone who consented before commencement.
Can you follow up someone who gave you their card?
Section 4(1) allows processing only where the person “has given her consent”, or “for certain legitimate uses”. Section 7 lists those uses, and clause (a) fits a stall:
“(a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data.”
In Illustration (II) to section 7, X shares her details with a real estate broker, Y, to find a flat to rent. The Act continues:
“Y may process her personal data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal data of X”
What the text supports
- A card handed over at your stall is personal data “voluntarily provided”.
- Sending what the visitor asked for (a quote, a sample, a call back) matches the broker example.
- Once they say they are not interested, you must stop.
- Section 5 ties its notice duty to consent requests, so this route needs no written notice.
Where it is a matter of interpretation
Section 2(za) defines “specified purpose” as “the purpose mentioned in the notice given by the Data Fiduciary”. Nobody hands a notice across a stall counter. The illustrations take the purpose from what the person asked for, and most readers do the same. No decision has tested that reading, because the Board can only start inquiries on 13 May 2027.
How far a follow-up may go is also unsettled. Two or three messages about the visitor’s enquiry fit the purpose. A monthly offer for a year probably does not.
| At the stall | Our reading |
|---|---|
| Asked for a quote and gave a card | Follow up on the quote: generally covered by section 7(a) |
| Gave a card “to keep in touch”, with no request | Unclear: keep to one message about what you discussed |
| Dropped a card in a lucky-draw bowl | Use it for the draw; sales calls need consent |
| Appears on the organiser’s visitor list | Not section 7(a): ask the organiser, in writing, what consent it took |
| Said “not interested, please don’t call” | Stop, and mark the record |
Make the purpose explicit at the stall, so nobody has to guess it later. Ask: “I will send the price list on WhatsApp tomorrow. Is that all right?”
What needs consent: newsletters, bulk WhatsApp and sharing?
Anything beyond the purpose the visitor gave you needs consent under section 6: newsletters and festival offers, bulk WhatsApp or SMS, passing details to a dealer the visitor did not ask about, and selling or swapping the list.
Section 6(1) says consent “shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action”. At a stall, that means:
- Unconditional: the catalogue should not depend on joining the list.
- Specific: a separate tick for each use, such as WhatsApp offers and an email newsletter.
- Informed: the notice comes first, as section 5 requires.
- Clear affirmative action: a tick, a signature, or a spoken yes that you write down. Silence, or a box ticked in advance, is hard to call one.
Under section 6(4), the person may withdraw “at any time, with the ease of doing so being comparable to the ease with which such consent was given”. One tick in means one reply out. Section 6(6) then requires you, and your processors, to stop “within a reasonable time”.
Section 6(10) says the Data Fiduciary “shall be obliged to prove that a notice was given” and that consent was given. Under the DPDP Act, proving consent is your job, not the visitor’s.
WhatsApp adds its own rule. Its Business Messaging Policy (last updated 23 September 2026, checked 10 October 2026) requires that you have “received opt-in permission from the recipient”.
Worked example. Sunrise Packaging scans 300 visiting cards at a pharma packaging fair, and 40 visitors tick the box for the monthly price list on WhatsApp. On our reading, all 300 may get a follow-up about their own conversation. Only the 40 get the price list.
What should the notice say before you ask for consent?
Section 5(1) says a consent request must be “accompanied or preceded by a notice” giving the data and purpose, how to withdraw and use their rights, and how to complain to the Board. Rule 3 adds “an itemised description of such personal data” and a link to your website or app. Section 5(3) adds a choice of English or any Eighth Schedule language.
A printed card or standee with a QR code does this at a stall. A model to adapt:
Sunrise Packaging: how we use your details
What we keep: your name, company, designation, mobile number, email address and city, from your visiting card.
Why: to send our monthly price list for blister foil and cartons on WhatsApp, only if you tick the box. We do not share your details.
Changing your mind: reply STOP on WhatsApp at any time, or use the form at the link below.
Your rights: ask what we hold, have it corrected or erased, or complain to the Data Protection Board of India: [your website address]/privacy
Questions: [name], [role], [business email address]
Keep each version of the notice, dated, and note which one each person saw.
What should you record when someone agrees?
Record enough to show later who agreed to what, when, and after seeing which notice:
| Field | Example |
|---|---|
| Who | Name and company, as on the card |
| When and where | 10 October 2026, your stall at a pharma packaging fair |
| What they agreed to | Monthly price list on WhatsApp. Not the email newsletter. |
| How | Ticked the consent sheet after reading the notice card |
| Notice seen | Stall notice, version 2, English |
| Taken by | The salesperson’s name |
| Withdrawn | Date and how, if they later say stop |
On paper, use a consent sheet with a tick column per use, scanned each evening. In an app, add a note to the person’s record in the same words every time.
JAI CRM has no screen for recording consent today. Keep your register alongside, or say the consent line into the card’s voice note, which is written out as text and kept with the person once the card is filed.
What if a visitor asks you to correct or delete their details?
Section 12(1) gives the right to “correction, completion, updating and erasure”, including for data given under “clause (a) of section 7”. So it covers cards you follow up without consent too.
- Correction: section 12(2) says correct, complete and update.
- Erasure: section 12(3) says erase “unless retention of the same is necessary for the specified purpose or for compliance with any law”. Invoices you must keep under tax law stay. Marketing stops.
- Withdrawal: section 8(7) requires erasure once consent is withdrawn or the purpose is served, and erasure by your Data Processor too.
How fast must you respond?
Rule 14 asks you to publish on your website or app how to make a request, and your response period, “not exceeding ninety days”. Rule 9 asks you to publish a contact who can answer questions about the data. Section 13(3) says people must use your route before going to the Board. Ninety days is the ceiling, not the target.
Where to erase
Check the CRM record (with the card photograph and voice note), each salesperson’s phone contacts, WhatsApp broadcast lists, spreadsheets, email tools, and any dealer you passed the details to. Keep a short note that the request was handled, and when.
Rule 8(3) also asks you to keep personal data and processing logs “for a minimum period of one year” for Seventh Schedule purposes. How that fits erasure is unsettled, so ask your lawyer before deleting logs.
What are the penalties under the DPDP Act?
Section 33(1) lets the Board impose a penalty from the Schedule if, “on conclusion of an inquiry”, a breach “is significant”. The maximums:
| Breach | Maximum penalty |
|---|---|
| No reasonable security safeguards, section 8(5) | ₹2,50,00,00,000 (₹250 crore) |
| Not reporting a personal data breach, section 8(6) | ₹2,00,00,00,000 (₹200 crore) |
| Duties on children’s data, section 9 | ₹2,00,00,00,000 (₹200 crore) |
| Duties of a Significant Data Fiduciary, section 10 | ₹1,50,00,00,000 (₹150 crore) |
| A Data Principal’s own duties, section 15 | ₹10,000 |
| Breaking a voluntary undertaking, section 32 | Up to the amount for the original breach |
| Any other provision of the Act or the Rules | ₹50,00,00,000 (₹50 crore) |
A missing consent record or an ignored erasure request falls in the last row. Section 33(2) makes the Board weigh gravity, duration, mitigation and “the likely impact of the imposition of the monetary penalty on the person”. None of this applies before 13 May 2027.
Rule 6 sets minimum security, from access control and backups to logs kept for a year. Rule 7(2) wants detailed breach information sent to the Board “within seventy-two hours”. A phone with no screen lock, full of contacts, is a breach waiting to happen.
A one-page stall routine for your team
Before the fair
- Publish a privacy page: a named contact, how to ask for correction or erasure, and a response period of 90 days or less.
- Print the notice card with a QR code, in English and the local language, and a consent sheet.
- Set a screen lock on every phone that will hold cards.
At the stall
- Ask “What shall I send you, and where?”
- Ask separately: “Would you also like our monthly price list on WhatsApp? It is optional.”
- Show the notice before the tick.
- Do not file cards from visitors under 18. Section 9(1) needs a parent’s verifiable consent.
- Use lucky-draw cards for the draw only.
After the fair
- Follow up each conversation, and nothing more without consent.
- Treat “not interested” as stop, and mark the record.
- Before 13 May 2027, take anyone without a consent record off your campaign lists.
What should you ask a card scanner app?
Section 8(1) keeps you responsible for your processors “irrespective of any agreement to the contrary”. Ask any vendor:
- Where are card photographs and voice notes stored, and for how long?
- Is the card read by an AI service, and can we turn that off?
- Does deleting a contact remove the card image, voice note and backups too?
- Will you sign a contract covering security and deletion, as section 8(2) and rule 6 expect?
- How fast will you report a breach to us, given our 72 hours under rule 7(2)?
How JAI CRM answers some of these
JAI CRM is ours. Here is what its Exhibitions module does today, limits included:
- Look up mode reads a card only to check whether you already know the person, and keeps nothing.
- Cards are read with AI where the workspace uses AI, otherwise on JAI CRM’s own server. A switch in Settings turns AI reading off.
- With no signal, cards and voice notes wait on the phone until the connection returns.
- Leads and customers from a card get the source Exhibition and the exhibition’s name as a tag, which answers “Where did you get my number?”
- There is no screen for recording consent.
Common questions
Is it legal to scan visiting cards in India?
Yes. The DPDP Act does not ban scanning, but a scanned card is digital personal data. From 13 May 2027, use it for the purpose the person gave it, or with their consent. Following up your conversation is generally a legitimate use under section 7(a).
Do I need consent to email someone who gave me their card?
Generally not to follow up the conversation you had, which is why they gave you the card. Newsletters, offers and campaigns need consent under section 6, after a notice under section 5. Record what they agreed to.
How do I record consent at an exhibition?
Note who agreed, when and where, to what, how, and which version of your notice they saw. Keep it with that person’s details, on a consent sheet or a note on their record. Section 6(10) puts the burden of proving consent on you.
What do I do if a visitor asks me to delete their details?
Stop using them, and erase them everywhere: the CRM, phones, spreadsheets, WhatsApp lists, the card photograph, and anything passed to a dealer. Keep only what another law requires, such as invoices. Reply well inside your published period, which cannot exceed 90 days.
Is there a DPDP exemption for small businesses?
Not today. Section 17(3) lets the Central Government exempt notified classes, including startups, from some duties. Section 17 starts on 13 May 2027, and we found no such notification on 10 October 2026.
Correct as of October 2026. Quotations are from the Gazette texts, checked 10 October 2026. Sunrise Packaging and the worked example are illustrations. This is general information, not legal advice: ask a lawyer about your own situation.
Next
See it with your own data
Start free, import a spreadsheet of your customers, and raise a real GST invoice in the first ten minutes. No card, no sales call.