DPDP Act and WhatsApp: a guide for Indian businesses

India's Digital Personal Data Protection Act, 2023 covers the customer numbers, names and chats a business handles on WhatsApp. Its duties on businesses, including notice, consent, honouring withdrawals, deletion, security and breach reporting, start in May 2027, 18 months after the DPDP Rules were notified on 13 November 2025. The Data Protection Board already exists.

Does the DPDP Act apply to your WhatsApp chats?

Almost certainly, if you use WhatsApp for business. The Act covers digital personal data processed in India, including paper records typed up later, such as a visiting card copied into a lead sheet. Personal data is any data about an identifiable individual: a lead's mobile number, a customer's name in a group, the chat itself. A dealer's number is still data about the person behind it.

Your business is the data fiduciary, because it decides why and how the data is used. A company whose software handles the data for you, such as a CRM or messaging tool, is a data processor: you may use one only under a valid contract, and you remain responsible for what it does on your behalf (section 8). The exemption for personal or domestic use doesn't cover a business's customer chats.

When do the DPDP Act and Rules take effect?

MeitY's website showed no change to these dates on 5 October 2026. Until May 2027, section 43A of the Information Technology Act, 2000, which the DPDP Act will omit, stays in force. Start now: changing how a team collects numbers and keeps chats takes months.

What does valid consent look like on WhatsApp?

Where you rely on consent, it must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs (section 6(1)). It must come with or after a notice which, under Rule 3, stands on its own and sets out in plain language:

• an itemised description of the personal data you will process;
• the specific purpose, and the goods, services or uses it makes possible;
• a link for withdrawing consent as easily as it was given, for exercising the person's rights and for complaining to the Data Protection Board.

The notice must be available in English or any language in the Eighth Schedule to the Constitution (section 5(3)), and if consent is disputed, the business must prove it gave notice and obtained consent (section 6(10)). On WhatsApp, that means an unticked box on the enquiry form saying what you will send, and a record of when and where each person agreed, kept with the lead (see WhatsApp lead management). WhatsApp's business messaging policy already requires opt-in, and leaves the method, and its legality, to the business.

Not every message needs fresh consent. Section 7(a) allows processing for the purpose someone voluntarily gave you their data for, unless they object. The Act's own example fits WhatsApp: a person messages a property broker for rental options, so the broker may use her details to send them, and must stop once she no longer needs help. Answering an enquiry is that purpose; a weekly offers list is another.

How should withdrawal of consent and opt-outs work?

People may withdraw consent at any time, as easily as they gave it (section 6(4)). The business must then stop processing within a reasonable time and make its processors stop too, unless the Act or another law requires or allows the processing (section 6(6)). WhatsApp's policy separately requires businesses to respect every request to stop, whether made on WhatsApp or elsewhere.

A "stop" usually reaches one rep on one number while campaigns go out from five, so:

• Keep one opt-out register for the whole business, not one per phone or rep.
• Check it at the moment of sending, not when a list is built.
• Record who withdrew, when, how and from what.
• Pass each withdrawal to every system holding the number, CRM and sheets included.

WavesFlo handles the enforcement: its opt-out register is checked at send time for every campaign, and every inbox reply passes it too, failing closed if the register can't be read. Once HubSpot or Zoho CRM is connected and a workspace admin switches on syncing for consent changes, each opt-out and opt-in is added as a note on the matching contact; for any other CRM or a consent sheet, WavesFlo's consent.withdrawn and consent.granted webhook events do the job through n8n or Power Automate; see webhooks with n8n. Contacts imported from either CRM arrive in WavesFlo with unknown consent, because being in a CRM isn't agreeing to WhatsApp messages. All of this supports a compliance process but isn't one.

How long can you keep WhatsApp chats and numbers?

Only as long as the purpose needs. Section 8(7) requires erasure once consent is withdrawn or once it is reasonable to assume the purpose is no longer served, whichever comes first, with processors erasing too, unless another law requires the data to be kept. Fixed inactivity periods have so far been set only for very large e-commerce, online gaming and social media platforms: three years, with 48 hours' warning before erasure (Rule 8 and the Third Schedule).

The Rules also set a floor. From May 2027, Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least a year for the purposes in the Seventh Schedule, and Rule 6 requires a year of logs and personal data for investigating unauthorised access. How the floor and the duty to erase fit together for chat content is a question for your lawyer.

Start by listing where WhatsApp data sits: phones, linked laptops, chat backups, exported chats, campaign spreadsheets, your CRM and any messaging tool. Then set a period for each purpose. WavesFlo lets a workspace choose how long message content is kept, or keep none of it; the inbox page lists the choices.

What must you do about security and data breaches?

Rule 6 sets minimum safeguards: measures such as encryption or masking, control over who can access data, logs that would reveal unauthorised access, backups so work can continue, and security terms in contracts with processors. On WhatsApp the weak points are people and phones: a former employee still in customer groups, an unlocked phone left in a cab, a lead sheet open to anyone with the link. In WavesFlo, an Agent sees only conversations assigned to them, and a number can be restricted to named teams or people.

If a breach happens, Rule 7 requires you to tell each affected person without delay, in plain language: what happened, the likely consequences for them, what you are doing about it, what they can do, and whom to contact. The Board must also be told without delay, followed by a detailed report within 72 hours of your becoming aware, unless it allows longer on a written request.

What rights do customers have, and what are the penalties?

• Access: a summary of their data and its processing, and who else has it (section 11).
• Correction and erasure, unless a law requires you to keep the data (section 12).
• Grievance redressal, answered within a period you publish of no more than 90 days (section 13; Rule 14). They must use it before going to the Board.
• Nominating someone to act for them on death or incapacity (section 14).

Publish how to make these requests and who can answer questions about your processing (section 8(9); Rules 9 and 14). Children need extra care: data about anyone under 18 needs verifiable parental consent, and tracking, behavioural monitoring and targeted advertising aimed at children are barred (section 9), with narrow exceptions such as an educational institution monitoring for its educational activities or children's safety. Coaching institutes should read that part closely.

The Board imposes penalties after an inquiry, weighing the nature, gravity and duration of the breach, whether it was repeated and what was done to limit it (section 33). Significant data fiduciaries, which the government designates, must also appoint a data protection officer based in India and an independent data auditor, and run an impact assessment and audit every year (section 10; Rule 13).