India's Digital Personal Data Protection (DPDP) Act is moving from paper to practice. The Consent Manager framework becomes operative on 13 November 2026, and the core consent and notice duties become enforceable on 13 May 2027. If you send WhatsApp or SMS marketing to Indian customers, this is the six-month window to get your consent records in order.
This article is general information, not legal advice. For decisions about your business, speak to a qualified lawyer.
The DPDP timeline at a glance
The DPDP Rules are being rolled out in three phases:
Phase | Date | What changes |
|---|---|---|
Phase 1 | 13 Nov 2025 | Data Protection Board of India set up |
Phase 2 | 13 Nov 2026 | Consent Manager framework (Rule 4) becomes operative |
Phase 3 | 13 May 2027 | Notice, consent, security safeguards, breach intimation, data principal rights, retention and erasure become enforceable |
Penalties under the Act can reach ₹250 crore for failing to take reasonable security safeguards. As of August 2026, reports said the Data Protection Board was not yet fully constituted, so Consent Manager registrations may take time to appear. That is not a reason to wait. The consent duties that matter most for marketers arrive in May 2027 regardless.
What a Consent Manager is, and why marketers should care
Under the Act, a Consent Manager is a registered entity that gives people (called "data principals") a single, interoperable place to give, manage, review and withdraw consent across businesses. Think of it as a consent dashboard that sits between your customers and you.
From 13 November 2026, the framework that allows these entities to register and operate is live. For a WhatsApp or SMS marketer, the practical effects are:
Some customers may give or withdraw consent through a Consent Manager rather than directly with you.
Your systems will need to accept those consent signals and act on them, including withdrawals.
Your own consent records need to be clean enough to reconcile with an outside source.
You do not have to use a Consent Manager to collect consent. But you should be ready for customers who do.
What changes on 13 May 2027
From Phase 3, the core duties of a data fiduciary (any business deciding why and how personal data is processed) become enforceable. For messaging, the key ones are:
Notice: before or when you ask for consent, tell people what data you collect, the purpose, and how they can withdraw consent or complain. The notice should be clear and available in English or any language in the Eighth Schedule of the Constitution.
Consent: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the stated purpose.
Withdrawal: withdrawing consent must be as easy as giving it. After withdrawal, you must stop processing for that purpose within a reasonable time.
Security safeguards and breach intimation: protect contact lists and chat data, and report breaches as the Rules require.
Retention and erasure: do not keep personal data longer than the purpose needs.
A phone number on its own is personal data. So is a chat history tied to that number.
How DPDP fits with WhatsApp and SMS rules you already follow
DPDP sits on top of existing channel rules, not in place of them:
WhatsApp: Meta's Business Messaging Policy already requires opt-in before you message people, and lets users block or report you. Low-quality or unwanted messages hurt your quality rating and limits. Our WhatsApp opt-in guide covers Meta's rules.
SMS: TRAI's commercial communication rules already require DLT registration, approved templates and respect for customer preferences.
The DPDP difference is evidence and purpose. You need to show what each person agreed to, when, and for what, and you need to honour withdrawal across every system that holds their number.
A practical consent checklist for WhatsApp and SMS marketing
1. Separate your purposes
Order updates, OTPs and appointment reminders are a different purpose from offers and promotions. Ask for marketing consent separately, with its own checkbox or button. Do not bundle it into terms of sale or make a purchase conditional on it.
2. Use an unticked opt-in with clear wording
Example for a checkout or lead form: "Send me offers and new arrivals on WhatsApp and SMS. I can opt out any time by replying STOP." The box should start unticked.
3. Record every opt-in
For each contact, store at least:
Phone number (and business-scoped user ID if you receive it)
Date and time of consent
Source (website form, QR code, Click-to-WhatsApp ad, in-store)
Exact wording or version of the notice shown
Purposes agreed to (for example, "marketing" and "service updates")
Language of the notice
In Splashify Pro's built-in CRM you can hold these as custom fields and tags on each contact, and our WhatsApp CRM guide shows how to structure them.
4. Make withdrawal one step
Add a line such as "Reply STOP to unsubscribe" to marketing templates, or a quick-reply button. Set an automation so that STOP, UNSUBSCRIBE and local-language equivalents remove the marketing tag immediately and log the time of withdrawal.
5. Honour withdrawal everywhere
If a customer opts out on WhatsApp, check whether your consent covered SMS and RCS too. Your broadcast segments should exclude anyone whose marketing consent is withdrawn, across all channels that relied on that consent.
6. Keep service messages to their purpose
A shipping update should not become a sales pitch. Utility and service messages rely on a different basis from marketing, so keep promotional content out of them.
7. Clean up imported lists
Old spreadsheets, purchased lists and numbers collected without a notice are a risk. If you cannot show consent for marketing, do not broadcast to them. Rebuild the list through fresh opt-in campaigns instead.
8. Set retention rules
Decide how long you keep inactive contacts and chat logs, and delete or anonymise data you no longer need.
9. Lock down access
Limit who can export contacts, use role-based access for your team inbox, and keep an audit trail of exports and deletions.
10. Plan for Consent Manager signals
If you use webhooks or an API to sync contacts, design a way to receive consent changes from outside sources and update the contact record. See our WhatsApp webhooks guide for the plumbing.
A six-month action plan
November 2026: audit every place you collect numbers and every list you broadcast to.
December 2026: rewrite notices and opt-in wording; add STOP handling to all marketing templates.
January–February 2027: backfill consent fields in your CRM; run re-permission campaigns for contacts with no record.
March–April 2027: set retention and access rules; test withdrawal end to end.
May 2027: review with your legal adviser before Phase 3 takes effect.
Frequently asked questions
Do I need a Consent Manager to send WhatsApp marketing?
No. A Consent Manager is an option for data principals, not a requirement for every business. You can collect consent directly, but you must keep proper records and accept withdrawals, including those that may come through a Consent Manager.
Is consent needed for order updates and OTPs?
Transactional messages serve a different purpose from marketing, and the DPDP Act allows some processing for "legitimate uses" such as a purpose the person voluntarily provided data for. Where that line falls for your business is a legal question, so check with your adviser.
Does a Click-to-WhatsApp ad chat count as marketing consent?
A person messaging you can reply to that conversation, but that is not automatically consent to future promotional broadcasts. Ask for marketing opt-in inside the chat and record it.
What happens if I ignore this?
Beyond penalties, which can run up to ₹250 crore for security failures, unwanted messages lead to blocks and reports on WhatsApp, which can lower your quality rating and messaging limits.
The bottom line
DPDP does not stop WhatsApp or SMS marketing. It asks you to prove that people agreed, to say why you are messaging them, and to stop when they ask. Businesses that clean up consent now will also see better engagement, because they message people who want to hear from them. This article is not legal advice, so confirm the details with your lawyer. To keep opt-in records, tags and STOP automations in one place, start a 7-day free trial of Splashify Pro, or book a demo to see the setup.
- #consent manager
- #data privacy india
- #dpdp act
- #opt-in records
- #sms marketing compliance
- #whatsapp marketing consent
