DPDP Act and WhatsApp Opt-In: The Consent Records to Keep

If your business stores customer phone numbers and sends them WhatsApp messages, India's Digital Personal Data Protection framework applies to you. There is no turnover threshold and no small-business exemption — collecting a name and a mobile number through a digital channel makes you a Data Fiduciary.

The obligations are phasing in. Consent Manager provisions take effect around November 2026, and the bulk of substantive obligations — notice, consent standards, security, breach reporting and data principal rights — around May 2027. That gives most businesses a build window rather than an emergency, but the window is closing.

This article covers what the framework means for WhatsApp specifically. It is not legal advice; consult a qualified adviser for your circumstances.

What counts as valid consent

The standard is that consent must be free, specific, informed, unconditional and unambiguous, given through clear affirmative action. Applied to WhatsApp opt-in, several common practices fall short:

The purpose-specificity point is the one that catches marketers. A customer agreeing to order updates has not agreed to promotional broadcasts. Those are different purposes and need separate consent.

What a compliant WhatsApp opt-in looks like

At the point of collection, present a clear notice stating what data you collect, the specific purpose, and how the person can withdraw consent later. Separate the marketing consent from the transactional one.

A workable pattern on a checkout or lead form:

☐ Send me order and delivery updates on WhatsApp ☐ Send me offers and product news on WhatsApp

Two unticked boxes, two purposes, two records. The customer who ticks only the first should never receive a promotional broadcast.

Notice language matters. Consent notices must be available in English or any of India's scheduled languages on request — relevant for businesses serving customers across states.

What to store for every contact

This is the operational core. For each consented contact, keep:

1.   Phone number and identifier

2.   Timestamp of consent, to the minute

3.   Purpose consented to — transactional, marketing, or both, stored separately

4.   Source and method — checkout form, landing page, QR code, click-to-WhatsApp ad, in-store tablet

5.   Exact notice text shown at the time, or a version reference to it

6.   Withdrawal timestamp, if consent was later withdrawn

Point 5 is the one most businesses miss. If your consent wording changes in March, you need to know which version a customer from January agreed to. Version your notice text and store the reference.

Guidance around the framework points to consent records being retained for a substantial period — reporting on the rules indicates seven years — which makes this a data architecture decision rather than a spreadsheet. Build it into your CRM now rather than reconstructing it later.

Whatify's contacts CRM stores source and timestamp against each contact, which covers part of this — see how contact records work.

Withdrawal must be as easy as consent

A person can withdraw consent at any time, and withdrawal must not be harder than giving it. Practically, for WhatsApp:

·     Offer a clear opt-out in marketing messages, such as a Stop button or a documented keyword.

·     Process it immediately and automatically. A manual queue is a compliance risk and an operational one.

·     Record the withdrawal timestamp.

·     Continue sending only what the person still consents to — a marketing opt-out does not necessarily end transactional consent, provided those were captured separately.

There is a practical benefit here beyond compliance. A customer who opts out cleanly is far better for your account than one who blocks you, because blocks damage your quality rating. Our quality rating recovery playbook explains the mechanics.

Consent Managers — the November 2026 piece

The rules introduce Consent Managers: registered intermediaries that give individuals a single interface to grant, review and withdraw consent across the organisations they deal with. Businesses relying on consent are expected to be technically ready to work with registered Consent Managers from around November 2026.

For most SMBs the practical near-term implication is architectural: consent needs to be stored in a structured, queryable, exportable form rather than scattered across form submissions and spreadsheets.

A note on DLT

DLT registration under TRAI rules applies to SMS, not to WhatsApp. Businesses moving from SMS to WhatsApp sometimes assume the DLT framework carries over — it does not. WhatsApp messaging is governed by Meta's own policies plus applicable data protection law.

What to do in the next 60 days

1.   Audit your existing contact list. For each contact, can you evidence when and how consent was given? Contacts where you cannot are your risk concentration.

2.   Split your consent capture into transactional and marketing, with separate records.

3.   Version your notice text and store which version each contact saw.

4.   Automate withdrawal end to end.

5.   Designate someone accountable for data protection queries and publish contact details.

6.   Take legal advice on your specific obligations, particularly if you handle children's data or operate in a data-intensive sector.

Penalties under the framework are substantial, and reporting indicates 2026 is a build-and-test year with active enforcement expected after the 2027 deadline. The cost of building consent infrastructure now is far lower than retrofitting it under enforcement.

Verify the current position

The DPDP Rules and their implementation schedule are set by the Government of India and interpretations continue to develop. Confirm current requirements and dates against the Ministry of Electronics and Information Technology and take professional advice before finalising your compliance programme.

EXTERNAL SOURCES

1.   Ministry of Electronics and Information Technology, Government of India — Digital Personal Data Protection Act and Rules, official source for the legislation and implementation schedule. https://www.meity.gov.in/

2.   Meta — WhatsApp Business Messaging Policy: opt-in requirements under Meta's own rules, which apply alongside Indian law. https://business.whatsapp.com/policy

3.   TRAI — Telecom Commercial Communications Customer Preference Regulations, the DLT framework, cited to establish that it governs SMS rather than WhatsApp. https://www.trai.gov.in/