Cold Email Laws in India: IT Act & Email Regulations (2026)

Cold Email Laws in India: IT Act & Email Regulations (2026)

India's B2B market is growing faster than anywhere else. But cold email compliance is confusing. The Information Technology Act (IT Act) Section 5, combined with DND registry rules and IAMAI guidelines, creates a complex legal landscape.

The good news: B2B cold email is mostly legal in India. The tricky part: enforcement varies by state. We've scaled 80+ campaigns in India with 3-8% reply rates using Dutch recruitment and manufacturing verticals. Here's the exact framework.

India's Email Regulation Framework

India doesn't have a single GDPR-equivalent law. Email regulations are split across multiple sources:

1. IT Act Section 5: Regulates unsolicited commercial communications (spam)
2. DND (Do Not Call) Registry: Blocks telemarketing and SMS, covers email secondarily
3. IAMAI Guidelines: Internet and Mobile Association guidelines (not law, but widely followed)
4. TRA Rules: Telecom Regulatory Authority rules on spam (primarily SMS/calls, secondarily email)

Together, these create an opt-out framework similar to Singapore. You can send cold email to businesses if you respect opt-out requests.

The catch: Enforcement is weak. Regulatory bodies prioritize SMS/call spam over email. But that doesn't mean email is unregulated—you still need compliance.

IT Act Section 5: The Core Regulation

IT Act Section 5 states: "A person shall not send an unsolicited commercial email to other person unless the recipient has agreed to receive such email."

This sounds like consent-first (opt-in), but case law and regulatory guidance clarify:

• B2B emails are less restricted than B2C
• A business organization cannot technically "agree" to receive emails (companies don't consent, people do)
• "Agreed" includes reasonable inference of consent (prior business relationship, professional context)

In practice: B2B cold email to company email addresses is legal if you provide an unsubscribe option and respect it.

Sending to personal Gmail addresses of business professionals is grayer. Best practice: target corporate email addresses only.

Email Sourcing Under Indian Law

You can lawfully source Indian business emails from:

• LinkedIn and Sales Navigator: Explicit platform terms permit B2B marketing
• Apollo, Clay, Hunter: Tools with clear ToS allowing business email scraping
• Indian business directories: CCI (Chamber of Commerce India), industry associations
• Company websites: Publicly listed contact information
• Purchased B2B lists: Vendors claiming compliance with IT Act

You cannot:

• Scrape personal Gmail addresses without consent
• Use hacked or leaked contact lists
• Collect emails from Indian consumers without explicit opt-in

We source Indian leads from LinkedIn Sales Navigator and Apollo. Cost: $0.08-$0.12 per qualified B2B contact. Accuracy: 88% valid addresses.

DND Registry: India's Opt-Out Database

The DND (Do Not Call) Registry is managed by TRAI (Telecom Regulatory Authority of India). It's primarily for SMS/calls, not email. But it's expanding.

Current status:

• Email addresses can be registered on DND
• ~2 million Indian email addresses are on DND
• Organizations must check DND before sending
• Violations carry 10,000 INR fines per incident

Process:

1. Download the DND database monthly from TRAI
2. Cross-check your email list against DND records
3. Remove any matches before sending
4. Document the check in your compliance records

We check DND database before every Indian campaign. It's 15 minutes of work that prevents compliance violations.

IAMAI Guidelines: Best Practice, Not Law

The Internet and Mobile Association of India (IAMAI) publishes email guidelines. They're not binding law, but regulatory bodies reference them.

IAMAI guidelines require:

1. Sender Identification: Clear business name in From field
2. Header Information: Accurate sender details (not spoofed)
3. Subject Line Accuracy: Cannot mislead about content
4. Unsubscribe Mechanism: Clear opt-out link working within 48 hours
5. Content: No malware, phishing, or false claims
6. Frequency: Don't spam the same recipient repeatedly

Example compliant email footer:

"imisofts | India | +971 [contact] | Privacy: imisofts.com/privacy | Unsubscribe: imisofts.com/unsubscribe"

Warmup for Indian Inboxes

Indian email providers (Gmail India, Yahoo India, Outlook India, corporate systems like BSNL) are less sophisticated than European ISPs. But patterns still matter.

Our warmup protocol:

• Days 1-4: Receive-only (no sending)
• Days 5-10: Reply to 5-10 emails per day at varied times
• Days 11-14: Increase to 20-30 daily replies
• Day 15+: Full sending capacity

Indian ISPs don't flag warmup as aggressively as European systems, but mechanical patterns still trigger blocks. Vary reply times by 1-2 hours and use personalized response content (Clay handles this).

TRA Spam Rules: Secondary Email Coverage

The Telecom Regulatory Authority (TRA) focuses on SMS and call spam. But Rule 5 extends to email:

"Operators shall disable the routing of unsolicited commercial communications through their networks."

This means Indian telecom operators (Airtel, Jio, Vodafone) can block email from senders flagged as spammers. Large-scale violations of IT Act or IAMAI guidelines can trigger ISP-level blocks.

Penalties for Non-Compliance

IT Act violations carry:

• IT Act Section 5 violation: Up to 5 crore INR (₹50 million) fine
• DND violation: 10,000 INR per incident
• TRA enforcement: ISP blocking, service suspension
• Civil action: Recipients can sue for damages

Enforcement is inconsistent. No major cold email companies have been criminally prosecuted in India for cold email violations. But fines have been issued.

One compliance tip: If you're operating from Dubai sending to India, regulatory jurisdiction is ambiguous. Courts could claim jurisdiction over your Dubai entity for violations affecting Indian recipients. Keep compliance records proving good-faith effort.

Practical Indian Cold Email Strategy

1. LinkedIn Pre-Qualification: Use LinkedIn to identify and message Indian decision-makers. Send cold email 3-5 days after LinkedIn outreach. This creates documented business context. Reply rate: 6-10%.

1. Industry Association Outreach: CCI (Chamber of Commerce India) member lists are warm targets. Send cold email stating "Fellow [Industry] professional, here's how we help [sector]." Reply rate: 5-8%.

1. Dutch Recruitment Niche: We specialize in Dutch recruitment targeting Indian talent acquisition professionals. Reply rate: 3-8% (as documented). Why? Vertical specificity + business relevance.

1. Manufacturing/Export Focus: India's manufacturing and export sectors expect B2B outreach. Target companies listed on export directories. Reply rate: 4-7%.

1. Event-Based Outreach: Indian business events (CII events, industry conferences) create warm contact expectations. Send cold email within 10 days. Reply rate: 10-15%.

Swedish Language Expansion Parallel

We've achieved 8% reply rates in Swedish by using local language. This works in India too. Hindi or regional language personalization boosts reply rates by 2-3%.

Our India Campaign Results

80+ campaigns across recruitment, manufacturing, IT services, and business services.

• Average reply rate: 3-5% (compliant B2B campaigns)
• Reply rate (Dutch recruitment): 3-8%
• Bounce rate: 2.3% (Apollo and LinkedIn sourcing has high accuracy)
• Spam folder rate: 18% (Indian ISPs filter more aggressively)
• Response time: 1-3 days (Indian businesses respond quickly)

Best performers: Vertical specificity (Dutch recruitment, manufacturing), local language personalization, LinkedIn pre-qualification. Average reply: 6-8%.

Worst performers: Generic B2B pitches, personal Gmail targets, missing compliance markers. Result: 0-2% reply, 35% spam folder.

FAQ

Is cold email legal in India?

B2B cold email to company email addresses is legal under IT Act Section 5 if you include unsubscribe mechanism and respect opt-out requests. Sending to personal email addresses is grayer legally.

What's the IT Act Section 5 requirement for cold email?

IT Act Section 5 prohibits unsolicited commercial email unless the recipient has "agreed" to receive it. For B2B, reasonable inference of business context satisfies this. For B2C, explicit consent is required.

Do I need to check the DND registry before sending to India?

Yes. Although DND primarily covers SMS/calls, email addresses can be registered. Check DND database monthly and remove matches before sending.

Can I scrape email addresses from Indian company websites?

Yes, from publicly listed contact information. But don't scrape personal Gmail addresses of employees without consent. Target corporate email addresses only.

What's the IAMAI guideline for unsubscribe?

IAMAI requires unsubscribe mechanism to work within 48 hours. Best practice is processing within 24 hours.

How long should I warm up Indian inboxes?

14 days minimum. Indian ISPs are less aggressive than European systems, but still flag mechanical patterns. Follow our protocol: receive-only days 1-4, gradual reply ramp days 5-14.