DPDP Act Compliance for Your CRM: A Checklist for Salesforce, Zoho and HubSpot Users in India
India's Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 (notified in November 2025) are being phased in. Consent Manager provisions apply from around 13 November 2026, and most obligations for businesses, including notice, consent, security safeguards, breach intimation and data erasure, apply from around 13 May 2027. Your CRM holds most of the personal data your business collects, so it is where compliance work should start. This checklist shows what to change in Salesforce, Zoho CRM or HubSpot. It is practical guidance, not legal advice; confirm your obligations with a qualified lawyer.
The key dates
- November 2025: DPDP Rules notified; provisions setting up the Data Protection Board took effect.
- Around 13 November 2026: rules for Consent Managers come into force.
- Around 13 May 2027: the main obligations for Data Fiduciaries (businesses) apply, including notice, consent, safeguards, breach intimation, retention limits and children's data rules.
Penalties under the Act are significant: up to Rs 250 crore for failing to take reasonable security safeguards, and up to Rs 200 crore each for failing to notify a breach or to meet the obligations for children's data. Six months is not a long time to fix CRM data models, forms and integrations, so starting now is sensible.
Step 1: Map the personal data in your CRM
- List every object or module that stores personal data: leads, contacts, accounts, cases, activities, custom objects and attachments.
- Note where each field comes from: website forms, ads (for example Meta lead forms), imports, WhatsApp, events or partners.
- List every integration that sends or receives personal data, such as marketing tools, telephony, billing and analytics.
- Mark fields you do not actually need. Collecting less is the simplest compliance step.
Step 2: Fix notice and consent at every entry point
Under DPDP, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and as easy to withdraw as it was to give. The notice must explain what data you collect and why, in clear language.
- Update web forms with a short, plain-language notice and an unticked consent checkbox per purpose, such as sales follow-up and marketing emails.
- Store consent as data, not just a tick: purpose, date and time, source, and the notice version shown.
- Salesforce: use the consent data model (Individual, Contact Point Consent and Data Use Purpose) or well-designed custom fields.
- Zoho CRM: use GDPR/data privacy settings where available, plus custom fields for purpose-level consent and its source.
- HubSpot: use subscription types and lawful basis properties, and set up separate subscription types per purpose.
- Make withdrawal easy: unsubscribe links, a preference page and a process to update all connected systems quickly.
Step 3: Prepare for data principal requests
- Set up a simple request channel, such as a web form or email address, that creates a case in your CRM.
- Document how to find all records for a person across CRM, marketing and support tools.
- Prepare steps for access, correction and erasure, including integrated systems and backups.
- Define who approves requests and how you verify the requester's identity.
Step 4: Security safeguards and breach readiness
The Rules expect reasonable security safeguards such as encryption or masking, access control, logging and monitoring, with logs kept for at least a year. If a personal data breach happens, you must inform affected individuals without delay and report to the Data Protection Board, with a detailed report expected within 72 hours of becoming aware of it.
- Review profiles and permission sets; remove access people no longer need, especially export rights.
- Turn on multi-factor authentication for every CRM user.
- Enable field history and login audit features available in your edition, and decide where logs are kept.
- Use encryption or masking for sensitive fields where your platform supports it.
- Write a one-page breach response plan with names, contacts and the 72-hour reporting steps.
Step 5: Retention and erasure
- Set a retention period for each type of record, such as unconverted leads, closed cases and old marketing contacts.
- Automate clean-up with scheduled flows or workflows that anonymise or delete records after the retention period.
- Large e-commerce, gaming and social media platforms have specific erasure timelines for inactive users under the Rules; check whether these apply to you.
Step 6: Vendors and data processors
Your CRM vendor, implementation partner and connected apps may act as data processors. Make sure contracts cover DPDP obligations, check where data is stored, and remove integrations you no longer use.
Frequently asked questions
When does the DPDP Act apply to my business?
The DPDP Rules were notified in November 2025. Consent Manager rules apply from around 13 November 2026, and most business obligations apply from around 13 May 2027.
Does DPDP apply to B2B CRM data?
Yes, if your CRM stores digital personal data of individuals, such as names, emails and phone numbers of contacts at client companies, it falls within the Act.
What is the breach reporting timeline under the DPDP Rules?
Affected individuals must be told without delay, and a detailed report is expected to reach the Data Protection Board within 72 hours of becoming aware of the breach. Confirm details with legal counsel.
Can Salesforce, Zoho CRM or HubSpot store consent records?
Yes. Each platform can store purpose-level consent with date, source and notice version, using built-in consent features or custom fields designed for it.
How Quant Tech can help
Quant Tech works with Indian businesses on Salesforce, Zoho and HubSpot. We can map your CRM data, redesign forms and consent fields, set up request handling and automate retention, so your CRM is ready well before May 2027. Book a free consultation with our team in Jaipur.
Talk to a Salesforce, HubSpot or Zoho expert—free 30-minute consultation.
