Sector guide · Agencies
DPDP Act for marketing and advertising agencies
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
An agency running campaigns on a client’s data is a Data Processor for that client, and a Data Fiduciary for its own leads and staff. The Act reaches the tools agencies deploy on client sites: pixels, tag managers, retargeting and lead forms all process personal data, and the client answers for them under Section 8(1) while the agency answers under the contract.
From the Gevox Readiness Index: Nineteen of twenty websites of firms that sell DPDP advice load tracking or set cookies before consent.
The pixel is the client’s liability and the agency’s work
When an agency installs an ad pixel, analytics or a tag manager on a client site, the client is the Data Fiduciary for what it collects and Section 6 requires consent before it fires. On the Readiness Index, nineteen of twenty sites failed that test. An agency that ships a consent-first tag setup is selling the fix to the most common finding in the Act.
Contracts both ways
The client must engage the agency under a valid contract under Section 8(2), and Rule 6(1)(f) requires it to bind the agency to security safeguards. The agency’s own tools, the ad platforms, the email service and the CRM, are sub-processors the client’s notice has to be able to describe.
Purchased lists and lookalikes
A purchased list has no ground unless each person consented to marketing from the client. A lookalike audience built on a platform from hashed customer data is processing that needs the client’s consent basis to extend to it. Section 6(10) puts the burden of proving consent on the Fiduciary, which is the client, and the agency will be asked to show the evidence.
First five actions
- Make consent-mode tag setups the default deliverable.
- Add a Section 8(2) data processing schedule to every client agreement.
- Refuse purchased lists without a consent trail.
- Keep evidence of consent for every campaign audience the client supplies.
- Fix the agency’s own website first; clients will scan it.
Questions people ask
- Who is liable if a client’s pixel fires before consent?
- The client, as Data Fiduciary, under Section 8(1). The agency answers to the client under the contract, and its reputation answers to the market.
- Can we run campaigns on a purchased database?
- Not without a consent trail for each person that covers marketing from this client. Section 6(10) puts the burden of proof on the Fiduciary.
- Is a tag manager a Data Processor?
- The tag manager vendor is, when it processes visitor data on the client’s behalf, and so is every tool it loads.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.