WhatsApp Marketing After the DPDP Act: What Small Businesses Can Do

Transactional or promotional: why the difference matters

Section 7(a) allows processing for a specified purpose for which a person has voluntarily provided personal data, unless they object. When a customer gives a number to receive a bill, a delivery update or an appointment reminder, sending those messages fits that purpose.

Promotional messages are a different purpose. Under section 6 consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed. Using a billing number for offers relies on consent the customer never gave.

The test for each message is simple: did the customer ask for this, or are we asking them to buy something new? If it is the second, you need marketing consent.

What does valid marketing consent look like?

Ask separately from the transaction. An unticked box at billing (‘Send me offers on WhatsApp’), a website checkbox, or a reply ‘YES’ to an opt-in message all work. A pre-ticked box, or consent buried in terms and conditions, does not.

Tell people what they will receive and how often, link to your privacy notice, and tell them how to stop. Under section 6(4) withdrawal must be as easy as giving consent, so ‘Reply STOP’ should actually stop messages.

Record each consent: the number, date, channel and wording shown. If a customer complains, the consent log is your evidence.

What about my existing WhatsApp and email lists?

Lists built from billing, delivery or enquiry numbers usually lack marketing consent. Before May 2027, send each contact one clear message asking whether they want offers, and keep only those who say yes.

Expect the list to shrink. A smaller list of people who want to hear from you converts better and carries far less risk than a large list that generates complaints.

Purchased, scraped or shared lists should be deleted. They carry no valid consent and are a common source of complaints.

WhatsApp Business, broadcast tools and your vendors

If you use the WhatsApp Business API through a solution provider, or an SMS or email platform, that provider processes your customers’ data for you. You need its data processing terms, and you remain responsible for the consent behind each message.

Keep personal WhatsApp accounts out of customer marketing. Staff phones with customer chats and contact lists are hard to secure and impossible to clean up when someone leaves.

Sector rules still apply alongside DPDP. Telecom commercial-communication rules govern promotional SMS and calls, and WhatsApp’s own business policy requires opt-in. DPDP consent sits on top of these.

How to re-consent a WhatsApp list in five steps

1. Split the list

   Separate contacts who opted in to offers from those collected only for billing, delivery or enquiries.

2. Send one opt-in message

   Explain what you will send and how often, link your privacy notice and ask them to reply YES to receive offers.

3. Record the replies

   Log number, date, channel and the wording shown for each YES in a consent register.

4. Remove non-responders from marketing

   Keep their numbers only for the transactional purpose they were given for, if still needed.

5. Make opting out easy

   Honour STOP replies promptly and sync opt-outs across every tool you use.