Does the DPDP Act apply to B2B contact data?
A business contact is still an individual — so B2B data is personal data.
Why 'it's just business data' is a myth
Some teams assume DPDP only covers consumer data. It does not. 'rajesh@acme.com' identifies Rajesh as much as his personal email does. The Act draws no line between B2C and B2B — if the data point identifies a living person, it is personal data and the protections apply.
What this means for sales and marketing
Cold outreach built on scraped or purchased contact lists is the highest-risk area. You generally need valid consent for promotional messaging, an easy opt-out, and a clear notice when you collect a contact. CRM hygiene — minimising fields, setting retention, and recording the source of each contact — becomes part of compliance.
Account and vendor contacts
Contacts you hold for live customers, partners and vendors can often be processed for the legitimate purpose of running that relationship, but you still owe transparency and security, and you must stop marketing if the person opts out.
Frequently asked questions
Can I still do B2B cold outreach under DPDP?
Carefully. Promotional outreach generally needs valid consent or a defensible basis and an easy opt-out. Relying on bought or scraped lists is risky.
Is a work email address personal data?
Yes. A work email that identifies an individual is personal data under the Act, even though it belongs to a business context.
Does DPDP apply to my CRM?
Yes. A CRM full of named contacts is a store of personal data, so it needs minimisation, retention limits, access control and a lawful basis for use.
Check your exposure
Use the free DPDP Applicability Checker to map where your B2B data creates obligations.
Check DPDP Applicability (Free)