If you message customers on WhatsApp in India, the Digital Personal Data Protection (DPDP) Act applies to you. It governs how you collect, use and store personal data, and WhatsApp contacts are personal data. This is not legal advice, but it is a practical guide to the obligations that matter most for a business using WhatsApp. When in doubt, check with a qualified advisor.
What the DPDP Act expects
At its heart, the Act is about handling personal data responsibly and with the person's consent.
- Collect data for a clear, stated purpose, not vaguely.
- Take free, informed, specific consent before processing.
- Give people a plain-language notice of what you collect and why.
- Let people withdraw consent and request deletion of their data.
What this means on WhatsApp
Good WhatsApp practice and DPDP compliance point in the same direction.
- Record how and when each contact opted in, in line with our compliance guide.
- Message people only for the purpose they agreed to.
- Make opting out genuinely easy and honour it promptly.
- Be able to export or delete a contact's data on request, as our data operations guide covers.
Consent is the foundation
The single most important habit is clean, recorded consent. Buying lists or messaging people who never opted in is both poor practice and a compliance risk. It also wrecks your number quality, so compliance and deliverability reinforce each other.
Protect the data you hold
The Act expects reasonable security safeguards. Limit who can access customer conversations, secure your tokens and webhooks, and avoid storing sensitive data in chat where it is not needed. Keeping data minimal is both safer and simpler.
Frequently asked questions
Does the DPDP Act apply to WhatsApp messaging?
Yes. WhatsApp contacts and conversations are personal data, so collecting and using them for business messaging falls under the Act. You need a clear purpose, valid consent, and the ability to honour deletion and withdrawal requests.
What consent do I need to message customers?
Free, informed and specific consent for the purpose you intend, recorded so you can demonstrate it. Avoid bought lists and people who never opted in, and make opting out easy and prompt to honour.
Do I have to delete customer data on request?
You should be able to. The Act gives people rights over their data, including deletion and withdrawing consent, so set up a reliable way to export or erase a contact's data when asked.
Is this legal advice?
No. This is a practical overview to help you build good habits. For your specific obligations, especially around sensitive data or large-scale processing, consult a qualified legal advisor.
Message compliantly in India. Explore WapBlaster or start free.