Can WhatsApp be used for customer communication without DPDP consent?
Millions of Indian businesses use WhatsApp for customer communication. Here is what DPDP requires before you send that first message.
Does DPDP apply to WhatsApp Business messages?
Yes. WhatsApp Business messages involve processing the recipient's phone number (personal data) and may involve processing the content of their messages. The DPDP Act applies to any processing of personal data by an Indian business, regardless of the communication channel used. WhatsApp as a platform is Meta's product — but the business using WhatsApp Business to contact customers is the Data Fiduciary for the customer's personal data, and DPDP obligations apply to that business.
What WhatsApp communications are covered by the contractual basis?
Transactional WhatsApp messages that are necessary to deliver a service the customer requested do not need separate consent: order confirmation and invoice sent via WhatsApp to the number used for checkout; delivery tracking updates for a purchase; appointment reminder for a booked service; OTP or authentication message for a login; and support responses to a customer-initiated query. The key test: did the customer initiate the transaction, and is this message necessary to complete it?
What WhatsApp communications require explicit consent?
Consent is required for: promotional messages (discounts, new product launches, sale alerts); newsletters or content blasts via WhatsApp; re-marketing after a transaction has been completed; adding customers to WhatsApp broadcast groups or communities without their knowledge; and sharing customer contact details with third parties for WhatsApp marketing. If a customer provides a number for delivery and that number is then added to a WhatsApp promotional broadcast, that is a new processing purpose requiring separate consent.
How do you obtain valid WhatsApp consent?
Obtain consent at the point of data collection — at checkout, registration, or when the customer shares their number: 'I agree to receive WhatsApp updates from [Business] including offers and promotions. I can opt out at any time by replying STOP.' Keep a record of when and how consent was obtained. Implement opt-out: every WhatsApp message should include a way to unsubscribe (STOP reply handling). The WhatsApp Business Policy also requires documented opt-in — your consent record serves both purposes.
What about WhatsApp groups for customer communities?
Adding customers to a WhatsApp group without their prior consent is problematic: it reveals all group members to each other (privacy issue), is an unsolicited addition (consent issue), and creates a new processing purpose not covered by the original consent. Either get prior written consent before adding someone to a group, or use WhatsApp broadcast lists instead (where recipients cannot see each other and each receives the message individually). The safest approach: include 'WhatsApp group invitations' as a specific consent option in your customer onboarding flow.
What records must businesses keep for WhatsApp consent?
Document: when the customer provided consent; what they consented to (promotional messages? Service updates? Both?); the channel and mechanism of consent (checkbox at checkout, WhatsApp opt-in message); and when consent was withdrawn. For high-volume WhatsApp marketing, use a CRM that logs consent status per customer. In the event of a complaint to the Data Protection Board, you need to produce consent records for any customer who claims they did not consent to receiving WhatsApp messages from you.
Frequently asked questions
Does the TRAI DND registry apply to WhatsApp messages?
The TRAI Do Not Disturb (DND) registry applies to SMS and voice calls — it does not technically cover WhatsApp messages, which are delivered over the internet, not the telecom network. However, the principle is the same: if a customer has indicated they do not want marketing communications, sending them WhatsApp marketing messages is a DPDP consent violation. A customer who has opted out of SMS marketing should also be opted out of WhatsApp marketing unless they have specifically consented to WhatsApp communications.
If a customer shares their number on a website form, can we WhatsApp them?
Sharing a number on a website form to get a callback, download a resource, or submit an enquiry does not constitute consent to receive WhatsApp marketing. The number was shared for a specific purpose — the form's purpose. Using it for a different purpose (WhatsApp marketing) requires separate consent. Best practice: add a WhatsApp consent checkbox to the form — 'I agree to receive updates via WhatsApp' — and only message customers who check it.
Do B2B WhatsApp messages to business contacts need consent?
Sending WhatsApp messages to an individual at another business (their personal mobile number) for a business purpose — following up on a proposal, sharing a document, scheduling a meeting — is a personal data processing activity. For the core business relationship, this is covered by the legitimate use basis. For promotional WhatsApp messages to business contacts (sending product updates, newsletters, or promotional content), consent is best practice even in the B2B context, as the recipient's personal mobile number is personal data regardless of the business context.
Audit your WhatsApp customer communication for DPDP
Niti Bharat's Consent Audit covers WhatsApp Business, SMS, email, and push notification consent across every customer touchpoint — with remediation guidance for each channel.
Start Consent Audit