Consent and opt-in under India's DPDP Rules: a WhatsApp guide

The Digital Personal Data Protection Act 2023 became operational in stages once its Rules were notified on 13 November 2025. For any business messaging customers on WhatsApp, the consent provisions are the part that matters most. They define what a valid opt-in is and what you must let people do afterwards.

What counts as valid consent

Under the framework, consent must be free, specific, informed, unambiguous, and given by a clear affirmative action. In plain terms: the person actively agrees, they know what they are agreeing to, and the agreement covers the specific use you have in mind. Bundling consent into unrelated terms, or assuming it from silence, does not meet the bar.

The consent notice

You have to give people a clear notice of what data you collect and why, in a form they can understand, and it should stand on its own rather than being buried in long terms. Where you rely on consent, the notice needs to tell people how to withdraw it and how to raise a grievance.

Withdrawal must be easy

A key principle: withdrawing consent must be as easy as giving it. If someone opted in with one tap, they should be able to opt out roughly as simply. For WhatsApp that maps neatly onto a clear opt-out keyword or instruction that you honour promptly.

The timeline

The Rules roll out in phases. The Data Protection Board of India was established immediately in November 2025. The consent-manager registration framework follows around November 2026. The core obligations, including notice, consent, breach reporting, and data-principal rights, apply in full from 13 May 2027. That gives businesses a runway, but the direction is set: get your consent house in order now.

This article is general information, not legal advice. Rules change and your situation may differ, so check the current text of the law or speak to a qualified adviser before you act.