-1.svg)
Key Takeaways
-
DPDP governs how organizations collect, store, and use the personal data of individuals in India.
-
HubSpot has no DPDP-labeled features, but its general consent and data tools can be configured to support it.
-
Compliance starts with a clear, itemized notice and specific consent at the point of collection.
-
Data Principals have rights to access, correct, erase, and file grievances, plus a right to nominate.
-
This is a legal area, so set up the tools and confirm your approach with qualified counsel.
What Is DPDP Compliance and Why It Matters
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's data protection law. It governs how organizations, called Data Fiduciaries, collect, store, and use the personal data of individuals, called Data Principals. In practice it means giving a clear, itemized notice about what data you're collecting and why, capturing specific consent before processing, and honoring rights like access, correction, erasure, and grievance redressal. HubSpot doesn't have features labeled for DPDP the way it does for GDPR, but the same underlying consent, subscription, and data management tools can be configured to meet these requirements.
This matters because the Act carries real financial penalties, and because handling data from Indian users properly builds trust with your database. Rules and enforcement details were still being finalized as this was written, and specific obligations, deadlines, and thresholds can change. Treat this as a practical setup guide for the HubSpot side, and confirm your overall approach, especially around notice content, consent manager requirements, and breach reporting timelines, with qualified legal counsel rather than relying on software settings alone.
How to Set Up DPDP Tools: Step-by-Step
DPDP rules are newer and still being finalized in India, and HubSpot has no DPDP-specific labeled settings, so confirm the current legal requirements and the exact configuration in your portal. This is not legal advice.
Step 1: Review What Data You Collect From Indian Users
-
Log into your HubSpot account.
-
Identify which forms, workflows, and imports collect personal data from individuals in India.
-
Note what categories of data you collect and the specific purpose for each.
-
This audit is the basis for the notice you'll need to give Data Principals.
Step 2: Build a Clear, Itemized Notice
DPDP requires a notice that's clear and specific about what you're collecting and why, not a vague link to a privacy policy. In HubSpot:
-
Add a notice or consent statement to forms collecting personal data.
-
Itemize the specific data being collected and the specific purpose for each.
-
Use plain, simple language rather than dense legal text.
-
Keep the notice available in English and relevant regional languages if your audience needs it.
Step 3: Set Up Consent Tracking
-
Record consent as a distinct action, not assumed from a form submission alone.
-
Track when and how consent was captured for each contact.
-
Use subscription types so people can consent to specific kinds of communication separately.
-
Keep a record you can produce if a Data Principal or the Data Protection Board asks.
Step 4: Prepare for Data Principal Rights Requests
Data Principals can request access and correction, ask for erasure, and file grievances, so be ready to act:
-
Know how to export a contact's data for an access request.
-
Know how to correct inaccurate information on request.
-
Know how to permanently delete a contact's data on request, and confirm before doing so since it's irreversible.
-
Set up a clear grievance-handling process, since DPDP requires one.
Step 5: Handle Children's Data Carefully
-
Treat anyone under 18 as a child under DPDP, a stricter threshold than many other privacy laws use.
-
Do not process a child's data without verifiable parental or guardian consent.
-
Avoid behavioral tracking or targeted advertising directed at children.
-
Build extra age verification into any form likely to be filled out by a minor.
Best Practices for DPDP in HubSpot
-
Make the Notice Specific: Itemize what you collect and why, rather than pointing to a generic privacy policy. Vague notices don't meet the bar.
-
Separate Consent From Submission: Don't treat a form fill as automatic consent. Capture it as its own clear, recorded action.
-
Treat Under-18 as a Child: DPDP's child threshold is higher than GDPR's or COPPA's. Verify age and parental consent wherever a minor might realistically be the one submitting the form.
-
Prepare for Rights Requests in Advance: Access, correction, erasure, and grievance handling should have a clear process before a request arrives, not after.
-
Confirm With Counsel: DPDP's rules were still being finalized as this was written. Verify your specific obligations, especially around Significant Data Fiduciary status and cross-border transfer, with qualified legal advice.
How to Use DPDP Tools in Your Workflow
-
Use subscription types so contacts control which communications they receive.
-
Reference recorded consent before adding contacts to marketing campaigns.
-
Route access, correction, and erasure requests through one clear internal process.
-
Keep your notice and consent language current as your data practices and the Act's rules change.
Troubleshooting Common DPDP Setup Issues
Problem: We don't have a DPDP-specific consent feature in HubSpot
Solution: HubSpot doesn't label anything “DPDP” directly. Configure the same forms, consent tracking, and subscription tools you'd use for other privacy laws, with notice language and consent capture built to DPDP's specific requirements.
Problem: We're not sure if a contact counts as a Data Principal under DPDP
Solution: DPDP covers the personal data of individuals processed digitally, generally regardless of where your company is based, if you're offering goods or services to people in India. When in doubt, treat Indian contacts as covered.
Problem: We're not sure how to handle a data request under Indian rules specifically
Solution: The mechanics, export, correct, delete, are similar to what you'd build for other privacy laws, but the timelines and grievance-officer requirements are specific to DPDP. Confirm the exact process with legal counsel.
The Bottom Line
DPDP compliance in HubSpot comes down to giving Data Principals a clear, itemized notice, capturing consent as a distinct recorded action, and being ready to honor access, correction, erasure, and grievance requests. HubSpot has no DPDP-labeled toolkit, but the same consent and data management infrastructure you'd use for any privacy law can be configured to meet these requirements. India's rules are newer and still being finalized, so pair this setup with qualified legal counsel rather than treating software configuration as compliance on its own.
The Markivis Approach
We build DPDP-ready consent practices on HubSpot's general tools, and confirm the specifics with counsel:
-
Make the notice specific: We itemize what data is collected and why, rather than pointing to a generic privacy policy.
-
Separate consent from submission: We capture consent as its own recorded action, never assumed from a form fill.
-
Treat under-18 as a child: We build age verification into forms that a minor might realistically fill out, matching DPDP's stricter threshold.
-
Prepare for rights requests in advance: We set up a clear process for access, correction, and erasure requests before one arrives.
This same trust-first approach to customer data is how we drove high-value, sales-qualified leads for Bharti Realty, treating every contact's information with care regardless of which market it came from. See the Bharti Realty case study.
