Cold Email in India: B2B Lead Generation and the DPDP Act Timeline

Running B2B cold email into India means working through a privacy law that is switching on in phases (with the main obligations landing in May 2027), a telecom regime that polices calls and SMS but not email, English as the language of business across 22 scheduled languages, and a calendar shaped by one time zone and a long festival season. Koldify runs done-for-you cold email campaigns for companies selling into India from abroad. Here is what matters before you send.

Is cold email legal in India?

Short answer: yes, B2B cold email is legal today, and India has no email-specific anti-spam statute. DLA Piper's India chapter does not identify one.

That will change in substance, though not in name, when the Digital Personal Data Protection Act fully applies. This is a plain-English summary, not legal advice.

The DPDP Act 2023 and the DPDP Rules 2025

The Digital Personal Data Protection Act was published on August 11, 2023, and the DPDP Rules were notified on November 13, 2025 (DLA Piper). The rollout is phased, per AZB & Partners:

Some sources count the anniversary dates as the 12th and others as the 13th, so confirm exact dates with counsel.

MeitY proposed cutting the 18-month window to 12 months in January 2026 and closed comments on February 4, 2026 (Mondaq, April 2026). As of September 2026, MirvoLegal had found no amending notification, so May 13, 2027 remains the date for the substantive duties. Watch the Gazette, because this could still move.

What the DPDP Act means for cold email

• It covers work emails. The Act protects digital personal data of individuals, and a buyer's name plus work email is personal data. It also reaches processing outside India when it is connected to offering goods or services to people in India (KPMG).
• Consent is the main basis. Consent must be free, specific, informed, unambiguous and given by a clear affirmative action, and there is no "legitimate interests" basis, per Hogan Lovells. The "legitimate uses" in Section 7 are narrow, such as data a person voluntarily provided for a purpose.
• Publicly available data. The Act does not apply to personal data "made publicly available by the Data Principal either by choice or under legal obligation" (KPMG). Whether a work email that a person published themselves falls under this, versus an address a data vendor inferred, is untested. Do not assume a purchased list qualifies.
• Penalties. Fines on data fiduciaries go up to INR 250 crore per instance (KPMG). DLA Piper also notes that people can withdraw consent and restrict processing for purposes like email marketing.

What this means in practice: from May 2027, cold email to individuals in India carries more legal uncertainty than cold email to the US. Keep lists tight to people who publish their business contact details, honor every opt-out immediately and get advice before running high volume.

The IT Act until May 2027

Until the core DPDP provisions apply, the Information Technology Act and its privacy rules continue to govern (DLA Piper). Section 43A and the 2011 SPDI Rules focus on "sensitive personal data or information" with consent, privacy policy and security requirements. Section 44(2) of the DPDP Act omits Section 43A from May 13, 2027, and the SPDI Rules stop operating then (King Stubb & Kasiva).

TRAI rules apply to calls and SMS, not email

The Telecom Regulatory Authority of India's Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR) target unsolicited commercial communications over telecom networks. TRAI announced further amendments in September 2026, including AI-based detection and rules for automated calls (TRAI press release). The Do Not Call registry covers phone numbers whose holders opted out (DLA Piper).

None of this regulates email. It matters the moment you add cold calls or SMS follow-ups to an Indian campaign, so check those channels separately.

A practical compliance checklist

• Target business roles and business email addresses only, never personal Gmail or Yahoo addresses.
• Record the source of every contact.
• Identify your company, explain briefly why you are writing and include a one-line opt-out.
• Suppress opt-outs across all inboxes and future campaigns.
• Do not cold call or SMS numbers on the DND registry.
• Review your process with Indian counsel before May 13, 2027.

What's different about selling into India

Language

India's Constitution lists 22 languages in its Eighth Schedule, and Hindi speakers make up roughly 44% of the population in Census 2011 data (Scroll.in). The same analysis notes that English has very few mother-tongue speakers but is one of the fastest-growing languages.

Practical advice: write B2B cold email in clear, polite English. Regional language copy (Tamil, Marathi, Gujarati, Bengali and so on) only pays off for tightly local segments, and it needs a native writer.

Tone and titles

Practical advice: a respectful but direct tone works, with a clear reason for writing in the first line. Titles to target include Founder, Director, Managing Director, VP and Head of a function (for example "Head of Procurement"). If the company is part of a larger group, name the specific business unit you mean.

Time zone and sending windows

India uses one time zone, IST (UTC+5:30), with no daylight saving. That makes it about 9.5 to 10.5 hours ahead of New York, depending on US daylight saving. Practical advice: send Tuesday to Thursday between 9:30 a.m. and noon IST, which also catches early mornings in Europe if you schedule carefully.

Festival seasons and holidays

Holidays vary by state, so use the central government list as a baseline. In 2026, Diwali falls on Sunday, November 8 (DoPT order via StaffNews). For 2027, the Delhi central government list includes Holi on March 23, Id-ul-Fitr on March 10, Dussehra on October 9 and Diwali on October 29 (StaffNews).

Practical advice: the weeks around Dussehra and Diwali are slow for new conversations, and many people take extended leave. Pause or lower volume the week of Diwali and restart afterward.

Data coverage

Apollo says it has "240M+ contacts and 30M+ accounts" globally, but it does not publish an India breakdown that we found. Practical advice: test 200 records for your exact titles and industries, verify them and check catch-all rates before buying volume. Coverage can differ sharply between, say, IT services firms and family-run manufacturers, so verify each segment on its own.

LinkedIn, phone and WhatsApp

LinkedIn is a strong second channel for Indian B2B buyers. WhatsApp and phone are common for business conversations once someone has engaged, but cold calls and SMS fall under TRAI rules, so move to those channels only after a reply.

Want a second opinion? If you are planning outbound into India and want a second set of eyes on the list, the offer and the DPDP timeline, book a 30-minute call with David at Koldify.

How we run cold email into India

The core system is described on our cold email services page and in our explainer on what a cold email agency does.

1. Infrastructure. Koldify owns and runs its sending infrastructure, no middlemen, on separate sending domains, never your main domain. See cold email infrastructure for the reasons.
2. Warmup. About three weeks of inbox warmup before any campaign sends, with launch typically around week four.
3. List, offer and copy. Built with you and approved before launch. For India, that means business emails only, careful segment testing and English copy, with regional language versions only where you ask for them.
4. Compliance footer. Sender identity, a short reason for contact and a one-line opt-out on every email.
5. Sending windows. Weekday mornings IST, with lower volume around Diwali.
6. Replies. Routed to you; you handle the conversation, booking and closing.

It is month-to-month, with no long-term contract, and we do not promise results for India or any market. If you want to walk through how this would look for your offer, schedule a call with David. To estimate what a DIY version would cost first, try the cold email cost calculator.

Sample cold email for India

Subject: [Company]'s vendor onboarding in [city]

Hi [First name],

I saw that [Company] is [hiring for procurement in Pune / expanding plants in Gujarat]. When teams grow that fast, [specific problem, e.g. vendor onboarding takes weeks and blocks new orders].

We help [type of company] [one-line outcome you can back up], and we already work with [relevant client type].

Would you be open to a 20-minute call on Tuesday or Wednesday, any time before 1 p.m. IST? Happy to send a short note instead if that is easier.

Regards,
[Your name]
[Title], [Your company]
[Website]

I am writing because of your role at [Company]. If this is not relevant, reply "no thanks" and I will not contact you again.
[Company legal name], [Address]

No Indian statute prescribes this footer today, but it supports the consent withdrawal rights that apply under the DPDP Act from May 2027.

Proof

These numbers are from koldify.io and describe Koldify's work overall, not results specific to India.

• 10M+ cold emails sent, 50K+ leads generated, $10M+ in pipeline and $2M+ in revenue generated for clients.
• Vidsec: 160+ ready-to-buy leads in 2 months and $12,000+ closed.
• Black Stone Funding Group: 120+ leads in 60 days.
• Skrapper: 140+ interested leads.
• Koldify's own outbound: about 500 leads from about 250,000 sends in 3 weeks.

Nerdy Joe is a certified Apollo.io Managed Services Partner and a PlusVibe Certified Silver Partner.

DIY instead?

Here is a typical self-serve stack. Some tool links here are affiliate links (disclosure).

Add separate domains, Google Workspace or Microsoft 365 inboxes and a verifier, then set your sequencer to IST. If you also sell into Southeast Asia, the cold email Singapore page covers a very different legal setup.

Ready to start?

If you sell into India and want campaigns run end to end, from infrastructure to approved copy to replies landing in your inbox, book an intro call with David at Koldify. David Tile is a partner at Koldify, and the call is 30 minutes. Bring your target titles and the timeline you are working to, and plan around May 2027.

Other markets we cover

• Cold email in United States
• Cold email in Canada
• Cold email in United Kingdom
• Cold email in Europe (EU)
• Cold email in Australia
• Cold email in Latin America
• Cold email in UAE
• Cold email in Singapore

How to set up a cold email campaign: the tools you'll need

Some tool links here are affiliate links (disclosure). Prices are as of October 2026.

1. Get your data (who you'll email). Build your list in Apollo by title, industry, company size and location, then export contacts with verified emails. Nerdy Joe is a certified Apollo Managed Services Partner.
2. Buy 2 to 3 sending domains. Never send cold email from your main domain. Use lookalikes (for example, getyourbrand.com). The simplest route is buying them inside your sending tool: Instantly sells done-for-you domains (about $15 a year), Smartlead sells them through SmartSenders, and PlusVibe offers a done-for-you setup. Before you buy, check whether domains bought in a tool can be moved out later; some Instantly users report they can't.
3. Create 2 to 3 inboxes per domain. Google Workspace or Microsoft 365 inboxes, not one big inbox. Instantly sells done-for-you Google inboxes (about $5 a month, or $10 pre-warmed), Smartlead sells pre-warmed Google and Outlook inboxes (about $9 a month), and PlusVibe can set them up for you. Done-for-you setups configure SPF, DKIM and DMARC for you.
4. Warm up for about 3 weeks. Warmup is built into Instantly, Smartlead and PlusVibe. Keep it running after launch.
5. Write and check your sequence. Three to five short emails. Run each one through our free Spam Word Checker.
6. Launch slowly. Start at about 20 to 30 emails per inbox per day in Instantly, Smartlead or PlusVibe, and watch bounces and replies. Use our Cold Email Cost Calculator to size domains, inboxes and spend.

Rather not run it yourself? Koldify, the done-for-you cold email agency where David Tile is a partner, builds and runs all of this on infrastructure it owns. Book a 30-minute call with David.

Sources

• DLA Piper, Data Protection Laws of the World, India (last modified February 13, 2026): https://www.dlapiperdataprotection.com/countries/india/law.html
• AZB & Partners, DPDP Act phased rollout and key compliance milestones: https://www.azbpartners.com/bank/indias-digital-personal-data-protection-act-phased-rollout-and-key-compliance-milestones/
• Hogan Lovells, India's DPDP Act 2023 brought into force: https://www.hlc.com/en/publications/indias-digital-personal-data-protection-act-2023-brought-into-force-
• Mondaq, "MeitY plans to cut short DPDP compliance timeline" (April 15, 2026): https://www.mondaq.com/india/data-protection/1773554/meity-plans-to-cut-short-dpdp-compliance-timeline-and-notify-cross-border-restrictions-for-sdfs
• MirvoLegal, DPDP Rules 2025 compliance timeline (as at September 2026): https://www.mirvolegal.com/insights/dpdp-rules-2025-compliance-timeline/
• KPMG, "Decoding the Digital Personal Data Protection Act, 2023": https://assets.kpmg.com/content/dam/kpmg/in/pdf/2023/08/decoding-the-digital-personal-data-protection-act-2023.pdf
• King Stubb & Kasiva, SPDI Rules after DPDP enforcement: https://ksandk.com/data-protection-and-data-privacy/what-happens-spdi-rules-after-dpdp-enforcement/
• TRAI press release No. 119 of 2026 (TCCCPR amendments): https://www.trai.gov.in/sites/default/files/2026-09/PR_No119of2026.pdf
• Scroll.in, Census 2011 language data: https://scroll.in/article/884754/scroll_in
• StaffNews, DoPT holiday list 2026: https://www.staffnews.in/2025/07/list-of-holidays-2026-dopt-order-reg-closed-and-restricted-holidays.html
• StaffNews, gazetted holidays 2027 for central government offices in Delhi: https://www.staffnews.in/2026/07/list-of-holidays-for-the-year-2027-gazetted.html
• Apollo.io homepage (database size): https://www.apollo.io/