DPDP Act and WhatsApp Marketing: A Compliance Guide for Indian Businesses
The DPDP Act 2023 introduces strict consent requirements for marketing messages in India. WhatsApp marketers must update their opt-in processes, data storage, and breach response procedures.
India's Digital Personal Data Protection Act 2023 (DPDP Act) came into force with its rules being notified in 2025. For businesses using WhatsApp for marketing, it introduces concrete legal obligations around how you collect consent, process phone numbers and personal data, and handle data subject rights requests. This is not optional compliance — violations carry penalties up to ₹250 crore.
What Does India's DPDP Act 2023 Mean for WhatsApp Marketers?
| Requirement | What It Means for WhatsApp Marketing | Action Needed |
|---|---|---|
| Consent must be free, specific, informed, and unambiguous | Pre-ticked 'Send me WhatsApp updates' boxes are invalid | Use an explicit opt-in checkbox — unchecked by default |
| Purpose limitation | You can only use data for the purpose it was collected | Do not use e-commerce checkout data for real estate promotion |
| Data minimisation | Collect only what you need | Stop collecting phone + email + city + DOB if you only send WhatsApp |
| Right to withdraw consent | Contacts can opt-out and must be honoured within reasonable time | Implement one-tap opt-out on WhatsApp (reply STOP) |
| Data breach notification | Notify DPDB within 72 hours of a breach | Have an incident response plan for WhatsApp contact data leaks |
| Data principal rights | Customers can request what data you hold | Be able to export and delete a contact's data on request |
How Do I Update My WhatsApp Opt-In Process for DPDP Compliance?
- Replace pre-ticked checkboxes with empty checkboxes labelled explicitly: 'I agree to receive WhatsApp messages from [Business Name] for [specific purpose, e.g., order updates and promotional offers]'
- Store consent records with timestamp, source, and what was agreed to — you must be able to prove consent on request
- Separate consents for different purposes — a customer consenting to order updates is NOT consenting to marketing campaigns
- Include your Privacy Policy link at every opt-in point
- For existing lists collected before DPDP rules: send a re-consent campaign to validate your database
What WhatsApp User Data Must I Protect Under India's DPDP Act?
Under the DPDP Act, phone numbers are personal data. Conversation contents may contain sensitive personal data (health information, financial details, identity information). Your WhatsApp Business API provider must process this data under a Data Processing Agreement. wChatFlowAI stores all conversation data on Indian servers and provides Data Processing Agreements for enterprise customers.
How Do DPDP Requirements Align with Meta's Own WhatsApp Data Policies?
Meta's WhatsApp Business Policy already requires opt-in before sending marketing messages — a requirement that predates and aligns with DPDP. Businesses that are already following Meta's opt-in rules are partially compliant, but DPDP goes further: it requires documented consent records, purpose limitation, and data subject rights handling that Meta's policy does not mandate.
This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your business under the DPDP Act 2023.
wChatFlowAI stores all data on Indian servers and supports DPDP compliance workflows including contact deletion and export. Start your free trial at app.wchatflowai.com.
Frequently asked questions
Do I need consent to send WhatsApp marketing messages under the DPDP Act?
Yes. Consent has to be free, specific, informed and unambiguous, so pre-ticked boxes are invalid. Use an explicit opt-in that is unchecked by default, and keep a record of when and how each person agreed.
Is a phone number personal data under the DPDP Act?
Yes. Phone numbers are personal data, and WhatsApp conversations can also contain sensitive details such as health or financial information, so your provider should process them under a data processing agreement.
Does following Meta's WhatsApp opt-in rules make me DPDP compliant?
Only partly. Meta already requires opt-in before marketing messages, but DPDP also expects documented consent records, purpose limitation and a way to handle data rights requests.
More articles in Compliance
Ready to get started with wChatFlowAI?
14-day free trial · No credit card required · Connect in minutes