DPDP Act and WhatsApp marketing: the consent rules Indian businesses must follow

Last updated: 18 October 2026 · By Shashi Pundir, Co-Founder, Adwix Media · 8 min read · This is a practical guide, not legal advice

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s main data privacy law. It covers any business that handles digital personal data of people in India, and a phone number with a name is personal data. The law calls the business a Data Fiduciary and the customer a Data Principal.

The Act needed rules before it could work in practice. The government notified the DPDP Rules, 2025 on 13 November 2025 and gave businesses time to prepare. That is why this matters now: the deadline is close enough that your systems, forms and WhatsApp flows should be updated in the next few months.

When do the DPDP rules apply?

Date	What happens
11 Aug 2023	DPDP Act, 2023 becomes law
13 Nov 2025	DPDP Rules, 2025 notified. Data Protection Board provisions start
About 13 Nov 2026	Consent Manager registration provisions start (12 months)
About 13 May 2027	Most business duties apply (18 months): consent notices, security safeguards, breach reporting, children’s data, data deletion and user rights

What does the DPDP Act say about consent?

Section 6 of the Act says consent must be:

• Free: not forced, and not a condition for getting a service that does not need it
• Specific: for a stated purpose, like “offers and new packages”
• Informed: the person knows what they are agreeing to
• Unconditional and unambiguous
• A clear affirmative action: the person ticks a box, taps a button or replies “Yes”. A pre-ticked box is not consent.

People must be able to withdraw consent as easily as they gave it. If someone opted in with one tap, they should be able to opt out with one tap or a one-word reply.

Before or when you ask for consent, you must give a notice in clear, plain language. It should say what data you collect, why, and how the person can withdraw consent or complain. People can ask for the notice in English or any of the 22 languages in the Eighth Schedule of the Constitution.

Is there any way to send marketing without consent?

No. The Act lists a small set of “legitimate uses” where you can process data without consent, such as when a person voluntarily shares data for a specific purpose, or for legal and medical emergencies. Marketing is not on that list, and India’s law has no general “legitimate interest” basis like Europe’s GDPR.

That means a phone number given for a delivery update, an appointment reminder or a quote can be used for that purpose. To send offers to the same number, you need separate consent.

What WhatsApp already requires today

You do not have to wait for 2027. Meta’s opt-in policy for the WhatsApp Business Platform already says:

• You must have the person’s phone number and their permission to receive messages from you.
• The opt-in must clearly say the person is opting in, and name your business.
• You must give clear instructions to opt out, and honour opt-outs.
• Your opt-in must also comply with applicable law, which in India now includes DPDP.

Meta also recommends collecting opt-in for each type of message you plan to send, such as order updates and offers. Businesses that skip this pay for it in blocks and reports, which lower your quality rating and messaging limit.

How to collect WhatsApp opt-in the right way

On a website or landing page form

Add a separate checkbox under the phone number field. Leave it unticked. Example wording:

Keep the form working even if the box is not ticked. Making it compulsory would break the “free” consent rule.

Inside a WhatsApp chat

When someone messages you from a Click-to-WhatsApp ad, they started the chat, so you can reply. Before adding them to future broadcasts, ask with quick-reply buttons:

Only tag people who tap “Yes” as opted in for marketing.

In your shop, clinic or office

Use a short paper or tablet form with the same wording, or a QR code that opens a WhatsApp chat with a pre-filled “Yes, send me updates” message. That gives you a timestamped record.

What records should you keep?

If a customer or the Data Protection Board asks, you should be able to show when and how each person agreed. For every opted-in contact, store:

Field	Example
Phone number	+91 98XXX XXXXX
Date and time	18 Oct 2026, 11:42 am
Source	Website form, Diwali landing page
Purpose agreed to	Offers and updates on WhatsApp
Exact wording shown	Version 2 of the checkbox text
Opt-out date	Blank, or the date they replied STOP

In Adwix Connect, you can store this as contact tags and attributes, and opt-outs are handled automatically when someone replies STOP.

DPDP checklist for WhatsApp marketing

1. Stop using bought or scraped number lists. You cannot prove consent for them.
2. Separate service and marketing consent. Order updates and offers need different permission.
3. Use unticked checkboxes and plain wording that names your business and WhatsApp.
4. Publish a short privacy notice that explains what you collect, why, and how to withdraw.
5. Add an opt-out line, like “Reply STOP to unsubscribe”, in every marketing template.
6. Sync opt-outs everywhere: WhatsApp, CRM, SMS and email lists.
7. Log consent with date, source, purpose and wording version.
8. Delete data you no longer need, such as old leads who never converted and never opted in.
9. Limit team access to customer chats and exports, and use two-step verification.
10. Have a breach plan. Under the Rules, you must inform affected people and the Data Protection Board if personal data is breached.

What are the penalties?

The Schedule to the DPDP Act sets maximum penalties, decided by the Data Protection Board case by case:

• Up to ₹250 crore for failing to take reasonable security safeguards to prevent a data breach
• Up to ₹200 crore for failing to notify a breach, or breaking the rules on children’s data
• Up to ₹50 crore for other breaches of the Act or Rules, which can include consent and notice failures

Most small businesses will never face numbers like these. The bigger daily risk is practical: customers who did not agree to hear from you block and report you, and WhatsApp limits or bans your number.

A note on children’s data

Under the Act, a “child” is anyone under 18. You need verifiable consent from a parent or guardian before processing a child’s data, and you cannot do tracking or targeted advertising aimed at children. Coaching institutes and schools should collect WhatsApp opt-in from parents, not students.

Frequently asked questions

Do I need consent to send WhatsApp marketing messages in India?

Yes. WhatsApp’s policy requires opt-in today, and the DPDP Act requires clear, specific consent for marketing. Marketing is not one of the Act’s “legitimate uses” that work without consent.

When does the DPDP Act consent rule start?

The DPDP Rules were notified on 13 November 2025. The consent notice and most other business duties apply after 18 months, around 13 May 2027.

Can I message customers who gave me their number for a booking?

You can send messages about that booking. To send offers or promotions, ask for separate marketing consent first.

Is a pre-ticked checkbox valid consent under DPDP?

No. Consent must be a clear affirmative action, so the person has to tick the box or tap a button themselves.

Does replying to a Click-to-WhatsApp ad count as marketing consent?

It lets you reply to that enquiry. For future broadcasts, ask the person to confirm they want offers, for example with a “Yes, send offers” button, and record their answer.

Sources

• Ministry of Electronics and IT: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
• PIB: DPDP Rules, 2025 notified (November 2025)
• Meta for Developers: Get opt-in for WhatsApp