India's Digital Personal Data Protection (DPDP) Act sets rules for how businesses collect and use people's personal data — including the phone numbers you use for WhatsApp marketing. The DPDP Rules were notified on 14 November 2025, and most duties apply from 14 May 2027. Here is what DPDP and WhatsApp marketing mean for a small business, in simple words.
This is general information, not legal advice.
The timeline
- 14 November 2025: DPDP Rules notified; the Data Protection Board set up.
- November 2026: rules for consent managers begin.
- 14 May 2027: main duties start — notice, consent, security, breach reporting and people's rights over their data.
That leaves time to prepare, but good habits are worth starting now.
What "consent" means
- Clear action. The person must actively agree — tick a box, send you a message, scan your QR and say yes. A pre-ticked box is not enough.
- Specific purpose. Tell them what you will send: order updates, offers, reminders.
- Easy to withdraw. Saying stop should be as easy as saying yes.
A clear notice
When you collect a number, show a short, plain notice: who you are, what data you collect, why, and how to stop. For example: "We'll use your number to send order updates and occasional offers on WhatsApp. Reply STOP anytime to opt out."
Withdrawal: stop means stop
When someone replies STOP or asks not to be messaged, remove them from marketing lists promptly and keep a note of the date. Keep sending only what they still need, like updates on an order they placed.
Keep data safe
- Do not share customer lists on personal phones or in open spreadsheets.
- Give staff access only to what they need.
- Delete data you no longer need for the purpose it was collected.
A simple checklist for WhatsApp marketing
- Collect numbers only with a clear yes.
- Show a short notice explaining what you will send.
- Keep a record of when and how each person agreed.
- Add "Reply STOP to opt out" to marketing messages.
- Honour every opt-out quickly.
- Never buy or rent number lists.
- Keep customer data in one secure place, not on staff phones.
Penalties under the law can be very large for serious lapses, so it is worth taking seriously — but for most small businesses, these simple habits cover the basics.
How the official API helps
The official WhatsApp Business API already expects businesses to message only people who opted in, and Meta can limit numbers that get many blocks. Using one business number with a shared inbox keeps conversations off staff phones. On our platform, contacts and lists sit in one panel, and on Pro you can pause marketing to a contact for a set number of days after each campaign.
See our WhatsApp Business API plans or read how to collect WhatsApp opt-ins.
Sources: DPDP Rules 2025 (PIB, November 2025) and compliance guides. General information only — consult a lawyer for advice on your business.
FAQs
When do the DPDP Rules apply to businesses?
The Rules were notified on 14 November 2025. Most duties — notice, consent, security and people's rights — apply from 14 May 2027.
Do I need consent to send WhatsApp marketing messages?
Yes. Collect a clear, active yes for a stated purpose, and make it easy to withdraw. This is general information, not legal advice.
What should I do when a customer replies STOP?
Remove them from marketing lists promptly and note the date. You can still send updates about an order they placed.
Can I buy a list of phone numbers for WhatsApp marketing?
No. Bought lists have no valid consent and lead to blocks, reports and legal risk.
Need a custom solution?
Instacode builds production-grade software — algo trading, ecommerce, web apps. Let's talk.
Get in Touch
💬 Comments (0)
Be the first to comment 🚀