This article is general information for business operators, not legal advice. DPDPA rules and their enforcement practice are still evolving — consult a qualified lawyer for your specific situation.
If you market on WhatsApp in India, the Digital Personal Data Protection Act, 2023 (DPDPA) applies to you, and the operational core is simple to state: you may only send marketing to people who gave specific, informed, recorded consent; you must tell them what you'll do with their data; you must honour withdrawal as easily as opt-in; and you must not keep data longer than the purpose needs. India enacted the DPDPA in 2023 (per MeitY's data protection framework), and its consent rules sit alongside — not instead of — Meta's own opt-in policies. This guide translates the Act into a working checklist for WhatsApp marketing.
Key takeaways
- A phone number in your billing system is not consent to market — DPDPA consent must be free, specific, informed, unambiguous, and provable.
- You owe users a notice (what data, what purpose, how to complain) and working rights: access, correction, erasure, withdrawal.
- Withdrawal must be as easy as opt-in — an instant, global STOP is both the legal and the Meta-policy answer.
- The Act's penalty schedule reaches up to ₹250 crore for certain breaches (security-safeguard failures), with lower ceilings for others — amounts are set case-by-case by the Data Protection Board.
- In day-to-day practice, Meta's enforcement bites first: blocks and reports cut your quality rating within days, long before a regulator calls.
What DPDPA regulates (in WhatsApp terms)
DPDPA governs digital personal data — anything that identifies a person. On WhatsApp that includes phone numbers, names, chat transcripts, order history, and the segments you build from them. Two roles matter:
- Data fiduciary — you, the business deciding why and how the data is used (your campaigns, your segments).
- Data principal — your customer.
Your BSP or marketing platform processes data on your instructions; choosing one that supports your compliance duties (consent logs, deletion, export) is itself part of those duties.
Consent: the load-bearing requirement
For marketing, consent is your lawful basis. The Act requires it to be free, specific, informed, unconditional and unambiguous — a clear affirmative action for a specified purpose. Mapped to WhatsApp operations:
| Requirement | What it means in practice |
|---|---|
| Free | Not a condition of buying ("agree to marketing to place order" fails) |
| Specific | "Order updates" and "offers & promotions" are separate consents |
| Informed | Notice before the tick: what you'll send, how often, how to stop |
| Unambiguous | Unticked checkbox, YES reply, or signed form — never pre-ticked or silent |
| Provable | Log number, source, timestamp, purpose, and the notice version shown |
The practical capture patterns — checkout checkboxes, first-chat asks, QR-code journeys — are detailed in our opt-in list building guide. The compliance addition is the log: when a complaint arrives, "we have their number" is not an answer; "they ticked this box on this page on this date, here's the record" is.
Numbers collected before DPDPA aren't grandfathered into marketing use — the safe pattern is a one-time re-permission message on a channel you may use, after which only the YES-sayers stay on the marketing list.
Try WatEase for free
Set up your WhatsApp store in under 5 minutes. No credit card required.
Start Free Today →Notice and data principal rights
Alongside consent, you must give a clear notice: what personal data you collect, the purpose, how to exercise rights, and how to complain (including to the Data Protection Board). For WhatsApp marketing this is typically a short line at the capture point linking to your privacy policy.
Your customers can then exercise rights you must actually be able to serve:
- Access — a summary of what you hold about them.
- Correction — fix the wrong name, number, or attributes.
- Erasure — delete when the purpose is served (subject to other laws — tax records keep their own schedules).
- Withdrawal — stop marketing processing, as easily as consent was given.
- Grievance redressal — a named contact and a response process.
Operationally: STOP must work instantly and globally (not per campaign), your platform must support per-contact export and deletion, and someone must own grievance responses. On WatEase, opt-outs apply across all broadcasts automatically and contact records are exportable/deletable per customer — capabilities to verify on any platform you evaluate.
Retention: don't hoard
DPDPA ties retention to purpose: once the purpose is served and no law requires keeping the data, it should go. A workable schedule for WhatsApp marketing data:
- Active consented contacts — retain while the relationship is live.
- Withdrawn/STOP contacts — suppress from marketing immediately; retain only a minimal suppression record (so you don't accidentally re-add them) and whatever transaction data other laws require.
- Dormant contacts (no engagement for an extended period, e.g. 12+ months) — re-confirm or delete; stale lists are also where blocks and per-user marketing limit suppressions concentrate.
- Chat transcripts — keep only as long as support/order purposes need, per your documented policy.
Write the schedule down. A documented, followed policy is worth more in a dispute than a perfect-sounding one nobody follows.
Penalties: the framework, briefly
The Act replaces criminal-style sanctions with civil monetary penalties set by the Data Protection Board of India, scaled to the breach. The schedule's ceilings include up to ₹250 crore for failing to take reasonable security safeguards, with lower maxima for other categories such as breach-notification failures or children's-data violations; the Board weighs nature, gravity, duration and mitigation. Two sober observations for marketers: the headline numbers attach most readily to security failures — so how your platform stores the list matters, not just how you message it — and enforcement practice is still maturing, which is a reason for diligence, not complacency. (Again: general information, not legal advice.)
Special cases worth flagging
Three areas where WhatsApp marketers trip on the Act's sharper edges:
- Children's data. Processing a minor's personal data requires verifiable parental consent, and tracking or targeted advertising directed at children is restricted. If your products attract under-18 buyers (coaching, gaming, fashion), design capture so age signals are respected rather than ignored.
- Significant Data Fiduciaries. The government can notify entities as SDFs based on volume and sensitivity of data, attracting extra duties — data protection officers, audits, impact assessments. Most SMBs won't be notified, but high-volume D2C brands building large behavioural datasets should track this boundary with counsel.
- Consent managers. The Act contemplates registered consent managers through whom users can give, manage and withdraw consent. As the ecosystem matures, expect customers to arrive with consent preferences attached — another reason to keep your own records interoperable and exportable.
How DPDPA and Meta policy interact
Think of it as two regulators with different speeds:
- Overlap: both require opt-in before marketing and working opt-outs. A clean consent operation satisfies the shared core of both.
- Meta is faster: user blocks and reports degrade your quality rating and messaging limits within days, and can get templates or numbers restricted. In practice Meta's machinery disciplines spammy senders long before the Board would.
- DPDPA is broader: Meta doesn't care how long you retain data, whether your notice is adequate, or how you answer access requests — the law does.
- Neither substitutes for the other: a Meta-approved template sent to a non-consented list is still a DPDPA problem; a fully consented list blasted 15 times a week is still a Meta problem.
The good news: the same architecture — explicit logged consent, instant opt-out, clean segmentation, restrained frequency — is what maximises deliverability and compliance. The full sending mechanics are in our bulk messaging without bans guide.
The compliance checklist
- Map your data: where WhatsApp contacts, consents and transcripts live, and who can access them.
- Fix capture: unticked boxes, purpose-specific wording, notice link at every capture point (tools here).
- Build the consent log: source + timestamp + purpose + notice version, exportable.
- Wire withdrawal: instant global STOP; suppression list that survives platform migrations.
- Write the retention schedule and automate the dormant-contact sweep.
- Assign grievance ownership: named contact, response SLA.
- Vet your platform: consent tracking, per-contact export/delete, opt-out enforcement — ask these questions before choosing any WhatsApp Business API provider.
- Re-permission legacy lists before resuming marketing to them.
DPDPA compliance for WhatsApp marketing isn't a legal tax on growth — it's the same discipline that protects your sender reputation, your deliverability and your customers' trust. The businesses that struggle are the ones treating consent as paperwork bolted on after the campaign; the ones that thrive wired it into capture, sending and retention from day one. Build the consent engine once, and both the regulator and Meta's algorithms become tailwinds instead of risks.
