Campaign Contact List and Consent Records Checklist

A responsible campaign contact list can show where each number came from, what permission exists for this use, how opt-outs are recorded and applied, who can access the file and when it will be deleted. If you cannot show that, do not use the list. Keep operational segments, and never build them from sensitive traits.

A contact list is a campaign's most valuable asset and its largest source of risk. Complaints, blocked senders, rejected templates and data incidents all trace back to the list. This guide gives a practical campaign contact list consent and data handling checklist for SMS and voice. It belongs to our wider guide to political campaign marketing in India, and it supports the telecom steps in TRAI and DLT setup for election-related SMS.

By Rupali Dahiwal. Last reviewed: 25 October 2026. This is operational guidance, not legal advice. Data protection law and telecom rules apply to contact data, so confirm the current position with a qualified adviser. This guide is not a guide to profiling or targeting voters.

What this checklist covers, and what it does not

This checklist covers responsible stewardship of contact data used to send campaign notices: provenance, permission, suppression, access, retention and incident response. It does not cover building voter profiles, scoring people, inferring political views or targeting by sensitive traits. Those practices raise serious legal and ethical risks and are outside this guide.

Step 1: Record the provenance of every list

For each list, write down:

Source. Where did the numbers come from? An event registration form, a volunteer sign-up, a helpline, a survey, a partner organisation?
Date and method of collection. When, and through which form or channel?
Stated purpose at collection. What were people told their number would be used for?
Who collected it and who holds it now.
What has been done to it since. Merges, cleaning, additions.

If a list has no clear source, treat it as unusable. A list bought from a third party is a particular warning sign: you cannot show what people agreed to, and the seller's assurances will not protect you if there is a complaint.

Step 2: Match the purpose to the permission

Permission is tied to a purpose. A person who gave a number to register for an event expects event updates. They did not necessarily agree to receive unrelated messages. For each planned message type, ask: is this within what people were told when they gave their number?

TRAI's page on unsolicited commercial communication describes a communication as unsolicited only if the recipient has neither given consent nor registered a preference that covers it, and defines consent as voluntary permission for messages about a specific purpose, product or service. See TRAI's page on UCC. TRAI's guidance for senders also describes consent being collected through a registered consent template, where applicable, before commercial messages are sent. See TRAI's advice to senders. Ask your telecom provider how these apply to your messages.

A consent record should show who agreed, to what, when and how. Keep:

The number or identifier.
The wording shown at the time of agreement, or a version reference to it.
The date and time, and the channel or form used.
Any later change, such as an opt-out.

Store this where it can be searched. A spreadsheet is acceptable for a small campaign if access is controlled. The test is simple: if someone asks why they were messaged, can you answer with a record in minutes?

Step 4: Build and apply a suppression list

A suppression list holds every number that must not be contacted: people who opted out, who complained or who asked to be removed. Apply it before every send, on every channel.

Update it the moment a request arrives, including requests made by phone to the helpline or in person.
Match across channels. A person who opts out of SMS should not receive a voice call about the same activity unless they agreed to it.
Never delete a suppression record because the person re-appears on a new list. Check new lists against the suppression list first.
Tell people how to opt out in a way that actually works for the channel, and honour it promptly.

TRAI's page says recipients can revoke consent given to a sender, which makes a working opt-out process essential, not optional. SMSNiti's voice page notes that promotional calls follow consent and DND rules, so ask your provider how preferences are handled on each channel.

Step 5: Clean and format the list

Remove duplicates.
Correct number formats and remove invalid entries.
Remove numbers that have bounced repeatedly, as this suggests they are not in use.
Do not add numbers from other sources without recording their provenance.

A clean list improves delivery reports and reduces wasted spend. See how to measure campaign communication delivery honestly for how list quality shows up in reports.

Step 6: Segment on operational lines only

Segment by things that help you send the right message: language, district, the event a person registered for, the role they hold in the campaign. Do not segment by religion, caste, ethnicity, health, sexual orientation, inferred political views or other sensitive traits. If a segment would embarrass the campaign if explained in public, do not build it.

Step 7: Limit access

Give access only to the people who need it for their role.
Use individual accounts, not shared logins, so actions can be traced.
Control downloads and exports, and log them.
Share files with providers through agreed, secure routes, not through chat or personal email.
Remove access when a person leaves the team or the campaign ends.

Step 8: Agree what the provider may do with the data

Your provider will hold your list while it sends. Before you upload, ask in writing: who can see it, where it is stored, whether it is used for anything else, how long it is kept after the campaign and how it is deleted on request. Our provider scorecard includes a data handling row for exactly this. Ask for the answers in writing, and keep them with the contract.

Step 9: Decide retention and deletion

Decide how long each list and record will be kept, and who deletes it. Do not keep contact data longer than you need it. Keep consent records and suppression lists for as long as they are needed to honour opt-outs and answer questions. Take advice on what your records must include and how long to keep them, because requirements differ, and do not assume a universal period. Data protection law, including the Digital Personal Data Protection Act, 2023 and rules made under it, may apply to your handling of personal data, so check the current position with a qualified adviser.

Step 10: Prepare for a data incident

If a list is lost, shared by mistake or accessed by someone who should not have it, act quickly:

Contain it: remove access, recall the file where possible.
Record what happened, when, which list and how many people.
Tell the campaign lead and your adviser at once.
Follow any notification duty that applies, as advised.
Review and fix the cause.

A checklist you can copy

Source, date, method and purpose recorded for each list.
Permission checked against each planned message type.
Consent records stored and searchable.
Suppression list applied before every send, on every channel.
List cleaned and formatted.
Segments built on operational lines only.
Access limited, with individual accounts and logs.
Provider data terms agreed in writing.
Retention and deletion decided and owned.
Incident process written and known.

Common mistakes

Using a list because it was available. Availability is not permission.
Buying lists. You cannot show consent for them.
Applying opt-outs on one channel only. People expect it to stop.
Sensitive segmentation. It creates legal and reputational risk.
Shared logins. Nobody can say who exported a file.
Keeping data forever. Delete what you no longer need.

Frequently asked questions

Can I use any phone number list for a campaign?

Only if you can show where it came from, what permission exists for the intended use and how you will honour opt-outs. If you cannot, do not use it.

What is a suppression list?

A list of numbers that must not be contacted, such as people who opted out or complained. Apply it before every send.

TRAI's guidance refers to consent collected through a registered consent template where applicable, and defines unsolicited communication by reference to consent and registered preferences. Ask your telecom provider how this applies to your messages.

Can I segment contacts by religion or caste?

No. Do not segment by sensitive traits. Use operational segments such as language, district or event.

How long should I keep contact data?

Only as long as you need it, with consent and suppression records kept as long as needed to honour opt-outs. Take advice on what applies to you.

Sources checked

TRAI, What is spam or UCC, last updated 23 October 2026 as shown on the page. Checked 25 October 2026.
TRAI, Advice to Senders / Telemarketers, last updated 23 October 2026 as shown on the page. Checked 24 October 2026.
SMSNiti bulk voice call service page, for the statement on consent and DND rules. Checked 25 October 2026.

Before you upload a list, ask SMSNiti about bulk SMS how lists are stored, who can access them and how they are deleted, and get the answer in writing.