If you send WhatsApp messages to customers in India, two laws of the game matter: India's Digital Personal Data Protection (DPDP) Act, which decides what counts as permission to use someone's details, and WhatsApp's own Business Messaging Policy, which decides who you may message at all. The short version: for most small businesses the date that matters is 13 May 2027, and the habits that will be checked then — opt-in, clear notices, honouring "stop" — are things WhatsApp already asks for today.
The dates at a glance
The DPDP Rules were notified in November 2025 and switch on in three phases, according to the law firms tracking them.2
| Date | What starts | Does it affect a small business? |
|---|---|---|
| 13 Nov 2025 | The Data Protection Board of India is set up as an institution2 | No action needed |
| 13 Nov 2026 | Consent Managers — registered platforms where people give, review and withdraw consent — can apply to register3 | No new duty. Make sure you can act on a withdrawal that reaches you |
| 13 May 2027 | The main duties: notice, consent, security, breach reporting, and penalties2 | Yes — this is the deadline to be ready for |
What happens on 13 November 2026?
Rule 4 of the DPDP Rules takes effect and companies can apply to become Consent Managers. To qualify, a company must be incorporated in India with a net worth of at least ₹2 crore, according to Mondaq's analysis.2
The compliance firm Ampcus Cyber says this date creates no new obligations for ordinary businesses.3 The one practical step: if a customer later withdraws consent through a Consent Manager, your systems should be able to receive that and stop messaging them.
What starts on 13 May 2027?
This is when the substantive rules begin — the ones about how you tell people what you collect, how you get and record consent, how you keep data safe and how you report a breach. Mondaq puts the maximum penalty at ₹250 crore per instance.2
These dates and amounts come from law-firm and consultancy summaries, not from the government's own text. Before relying on a specific clause, read the official notification or ask a lawyer.
WhatsApp already requires opt-in
You don't need to wait for 2027 to know the rule for WhatsApp. Meta's WhatsApp Business Messaging Policy says you may only contact someone on WhatsApp if they gave you their phone number and you received opt-in permission from them.1
The same policy says you must respect every request to block, stop or opt out of your messages — whether it reaches you on WhatsApp or anywhere else — and recommends a separate opt-in for each kind of message (offers, reminders, updates) and for calls.1
What counts as consent — and what doesn't
The DPDP Act says consent must be "free, specific, informed, unconditional and unambiguous", given by a clear action from the customer, according to a July 2026 analysis on SCC Online.4
| Counts as consent | Does not count |
|---|---|
| The customer ticks "Send me offers on WhatsApp" on your form | Adding everyone to a broadcast and waiting for complaints |
| The customer messages you and you ask "Can we send you offers here?" — they say yes | Using a number collected for a booking to send festival offers |
| A separate "Yes" for appointment reminders and another for promotions | One hidden line in your terms and conditions |
SCC Online adds three points worth copying:4
- Name the channel. The notice should say you will message them on WhatsApp and what kinds of messages to expect, in plain language, separate from other terms.
- One purpose at a time. Details collected for one purpose (say, an account or a booking) need fresh consent before being used for something materially different.
- Keep the proof. Record when, where and how each person agreed. The article suggests keeping these consent records for at least seven years.
A worked example: a clinic with 1,200 numbers
A dental clinic has 1,200 phone numbers from three places. Here is how to treat each group:
| Group | Where the numbers came from | Appointment reminders | Festival offers |
|---|---|---|---|
| 300 people | Messaged the clinic on WhatsApp after an ad | Yes, inside the conversation they started | Ask first |
| 400 patients | Gave their number to book | Yes — that's why they gave it | Ask first: it's a new purpose |
| 500 people | An old exhibition sign-up sheet | No recorded permission | Leave out until they opt in |
The clinic can keep all 1,200 in its contact book. It just shouldn't broadcast to people who never agreed to receive WhatsApp messages from it.
A consent message you can adapt
For people who already talk to you on WhatsApp, a short question in the chat is the cleanest opt-in:
"Would you like us to send you offers and health tips on WhatsApp now and then? Reply YES to join. You can reply STOP any time and we'll stop."
Save who said yes, when, and the exact wording you used. Ask your lawyer to review the wording before using it at scale.
What bananaleaf.ai does here
When you import a list into bananaleaf.ai, cold lists are not marked as ready to message, and the audience builder always leaves out anyone on the Suppressed list. The assistant spots opt-out replies such as STOP, "unsubscribe" or Hinglish phrases like "mat bhejo", records the first time and the exact words, and blocks automated messages to that person — a human can still reply inside the 24-hour window. If they message you again later, they come off the list. It helps you keep the records; the notice and consent wording are still yours to write.
What to do this month
- List every source of your numbers: bookings, ads, forms, old spreadsheets.
- Mark who agreed to receive WhatsApp messages. Leave everyone else out of broadcasts.
- Write one plain notice: "We'll message you on WhatsApp about X. Reply STOP any time."
- Ask separately for promotions and for service updates.
- Record consent per person: time, source, and the wording they saw.
- Test your opt-out: send STOP from a spare phone and check every automation stops.
- Diary 13 May 2027, and re-check it — the date may move earlier.
Questions people ask
Do I have to register as a Consent Manager on 13 November 2026?
No. That date opens registration for companies that want to RUN Consent Manager platforms. It creates no new duty for an ordinary business that messages its own customers.
Is having a customer's phone number enough permission to send WhatsApp marketing?
No. WhatsApp's own policy needs two things: the person gave you their number, and they gave you opt-in permission to receive messages from you on WhatsApp.
What should I do when a customer replies STOP?
Stop all automated and marketing messages to them at once and keep a record of when and how they asked. WhatsApp's policy requires you to honour every opt-out request, whether it arrives on WhatsApp or anywhere else.
Does this apply to replies when a customer messages me first?
Answering someone who wrote to you is the conversation they started. Promotions you send them later are a separate purpose, so ask for that permission separately.
Sources
Every numbered link in the article points to one of these. Dates are when the source was published or last updated.
- 1WhatsApp Business Messaging Policy (last updated 23 Sep 2026) whatsappbusiness.com · back to text ↑
- 2Mondaq — DPDP Act and Rules: the 2026 compliance milestones (14 Aug 2026) mondaq.com · back to text ↑
- 3Ampcus Cyber — DPDP consent managers go live in November (8 Oct 2026) ampcuscyber.com · back to text ↑
- 4SCC Online — WhatsApp chatbots and DPDP Act compliance (29 Jul 2026) scconline.com · back to text ↑
- 5Storyboard18 — MeitY seeks views on a 12-month DPDP compliance timeline (28 Jan 2026) storyboard18.com · back to text ↑