Why This Matters More Than Your Vendor Admits
There is a widespread and expensive misunderstanding in India's broking and advisory market: the belief that if you buy a list, the legal exposure belongs to whoever sold it.
It does not. Under the Digital Personal Data Protection Act, 2023, the Data Fiduciary is the entity that determines the purpose and means of processing personal data. When you load a list into your dialer and call those people to sell broking or advisory services, you are determining the purpose. You are the Data Fiduciary. The vendor is, at most, a Data Processor.
This is the part that catches firms out. "We bought it from someone" is not a defence. It has never been a defence. The obligation to demonstrate valid consent sits with the business doing the outreach.
The Three Questions That Decide Everything
Strip away the complexity and compliant sourcing comes down to three things a vendor must be able to demonstrate:
- Was consent actually collected? Not assumed, not inferred from a public listing — collected, through a channel where the person took an affirmative action.
- Did that consent cover this purpose? Someone who consented to receive a market newsletter has not consented to a cold sales call from a firm they have never heard of. Purpose limitation is a real constraint, not a formality.
- Can consent be withdrawn? A person has the right to withdraw consent and have their data erased. If there is no working mechanism to action that, the consent framework is decorative.
A vendor who cannot answer all three clearly, in writing, is not selling you compliant data — whatever the invoice says.
What a Scraped List Actually Costs
The commercial case tends to land harder than the legal one, so consider the arithmetic.
A scraped list is cheap per record. But you do not buy records — you buy conversations. Dead numbers, wrong segments, and people who never traded in their life all cost you the same telecaller-hour as a real prospect. Add the DND complaints, and the cheap list starts consuming the one resource you cannot buy back: your team's time.
Consent-based data connects at a materially higher rate for one unglamorous reason — the person on the other end actually opted in to financial communication. They are not surprised to hear from you.
How to Test Any Vendor (Including Us)
Never buy a database on a promise. Run this on every vendor you consider:
- Ask for a free sample. A vendor who refuses is telling you something important.
- Dial it yourself. Not a spreadsheet review — actually call fifty records.
- Measure the connect rate. What percentage reach a real, reachable person?
- Check segment accuracy. If you bought F&O data, ask them whether they trade F&O. If they say no, the segmentation is fiction.
- Ask how they would remove someone. If there is no answer, there was no consent.
Good data survives this test. We would rather you run it on us than take our word for it — which is why the sample is free and the removal mechanism is public.
Frequently Asked Questions
Is buying a traders database legal in India?
Buying a database is not illegal in itself. What matters is whether the personal data inside it was collected with valid consent for the purpose you intend to use it for. A scraped list has no such consent — that absence is what creates the exposure, not the act of purchasing.
Who is the Data Fiduciary when I buy a lead list?
You are. The entity that determines the purpose and means of processing personal data is the Data Fiduciary under the DPDP Act 2023. If you buy a list and call those people, you are processing that data for your purpose, so the obligation sits with you.
What makes a traders database DPDP-compliant?
Documented opt-in consent; consent that specifically covered financial or investment communication; and a working mechanism for withdrawal and erasure. All three, demonstrable. Anything less is a claim, not compliance.
Does this tool store my answers?
No. The checker runs entirely in your browser. Nothing is transmitted, logged, or stored — which, given the subject matter, seemed like the only defensible way to build it.