DPDP Act and WhatsApp Marketing in India: Opt-In, Consent Notices and What to Do Before 2027

India's Digital Personal Data Protection (DPDP) Act 2023 requires consent that is free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and says withdrawing consent must be as easy as giving it. The DPDP Rules 2025 were notified on 14 November 2025 with 18-month phased compliance, so most consent and notice duties apply from around May 2027. Meta already requires opt-in before you message anyone. For WhatsApp marketing, you need a clear, separate opt-in that names your business, a plain-language notice, and an easy way to stop. General information, not legal advice.

Even before DPDP obligations bite, Meta's rules apply today. Its opt-in guidance says you must clearly state that the person is opting in to receive messages from your business on WhatsApp, clearly name your business, and comply with applicable law. The WhatsApp Business Messaging Policy also expects you to respect requests to stop.

From the Act's text:

• Section 6(1): consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to the data needed for the specified purpose.
• Notice: before or when asking for consent, you must tell people what data you collect and for what purpose, and how to withdraw or complain.
• Withdrawal: the ease of withdrawing consent must be comparable to the ease with which it was given.
• Security: you must take reasonable security safeguards to prevent personal data breaches.

Penalties (from the Act's Schedule)

The government notified the Rules on 14 November 2025 (PIB explainer). PIB describes an eighteen-month period for phased compliance and says every Data Fiduciary must issue a separate, clear consent notice explaining the specific purpose. Commonly reported phasing:

Check the official notification and your lawyer for exact dates. Don't wait until 2027 to fix your opt-ins.

At checkout or on a booking form

☐ Send me order updates on WhatsApp from Kaveri Handlooms.

☐ Send me offers and new arrivals on WhatsApp from Kaveri Handlooms. (You can stop anytime by replying STOP.)

Two separate, unticked boxes: one for utility (order updates), one for marketing.

In a WhatsApp conversation (customer messaged you first)

Would you like Glow Studio to send you offers and new service updates on WhatsApp? You can stop anytime.

Buttons: Yes, send me offers · No thanks

At a clinic front desk

Add a line to the registration form: "I agree to receive appointment reminders from Sunrise Dental Clinic on WhatsApp." Staff tick it only after asking the patient.

What to record

For each contact: phone number, what they agreed to (utility, marketing or both), when, where (form, chat, ad), and the notice text shown. Keep it exportable. If you switch platforms, your consent records must come with you.

• Buy, rent or scrape phone number lists.
• Treat "they gave us their number for delivery" as consent for promotions.
• Bury WhatsApp consent inside terms and conditions.
• Use pre-ticked boxes.
• Make opting out hard ("call our support line").
• Keep messaging people who replied STOP.

These aren't just legal risks. "Didn't sign up" blocks hurt your quality rating and can get templates paused quickly.

TRAI's commercial communication rules (TCCCPR, with DLT registration) govern SMS and voice on telecom networks. See TRAI's advice to senders. WhatsApp is governed by Meta's policies and, for personal data, the DPDP Act. If you run both channels, keep separate consent and opt-out handling for each.

1. Map where you collect numbers (website, Shopify checkout, ads, front desk, events).
2. Rewrite consent text to name your business, WhatsApp and the purpose.
3. Split utility and marketing consent.
4. Add a "Stop promotions" button to every marketing template.
5. Store consent records with date, source and text.
6. Limit access to customer data (who on your team can export lists?).
7. Review with a lawyer before May 2027, earlier if you handle health or children's data.

WatsBerry is opt-in only: we don't support messaging lists without consent, and I'll help you set up separate utility and marketing audiences with a clear way to stop promotions. Meta bills WhatsApp usage to your own payment method (0% markup on Meta's per-message rates), and WatsBerry charges a separate platform plan (₹1,599 / ₹2,999 / ₹5,999 per month + GST).

Want a second pair of eyes on your consent text? Share your checkout or booking form wording via watsberry.com, and I'll give you practical feedback (not legal advice).

Abbas Ali, Founder, WatsBerry