You can update a row in the database without fetching and deserializing it; update() can do it. E.g.:
User.objects.filter(id=data['id']).update(email=data['email'], phone=data['phone'])
This will issue one SQL update statement, and is much faster than the code in your post. It will never fetch the data or waste time creating a User object.
You cannot, though, send a whole bunch of update data to the SQL database and ask it to map it to different rows in one go. If you need a massive update like that done very quickly, your best bet is probably inserting the data into a separate table and then update it form a select on that table. Django ORM does not support this, as far as I can tell.