DPDP Rules 2025 for SMS & WhatsApp Marketing: What Indian Businesses Must Change Before May 2027
Most Indian marketers already know TRAI's rules: DLT registration, headers, templates, consent for promotional traffic. What many haven't yet planned for is a second layer of regulation that applies to the customer data itself — the phone numbers, names and purchase histories that every SMS and WhatsApp campaign runs on.
That layer is the Digital Personal Data Protection (DPDP) Act, 2023, made operational by the DPDP Rules notified by MeitY in November 2025. The clock for full compliance is running, and messaging databases are one of the first places it will bite.
Note: this article is general information, not legal advice. For decisions specific to your business, consult a privacy lawyer.
The timeline that matters
The Rules were notified in mid-November 2025 (the official PIB explainer describes an eighteen-month phased rollout). In practice that breaks into three stages:
| Phase | When | What it means for marketers |
|---|---|---|
| Phase 1 | November 2025 (already live) | Data Protection Board provisions and definitions in force |
| Phase 2 | Around 13–14 November 2026 | Registration framework for Consent Managers opens |
| Phase 3 | Around 13–14 May 2027 | Core obligations apply: notice, consent, security safeguards, breach reporting, data principal rights |
Phase 2 places no direct obligation on an ordinary business that isn't applying to become a Consent Manager. But the heavy lifting — fixing how you collect, store and prove consent — needs to be done well before May 2027, not started in April.
How DPDP differs from TRAI consent
This is where many businesses get confused. TRAI's framework governs how commercial communications travel over telecom networks. DPDP governs whether you are allowed to process someone's personal data at all, and for what purpose.
- A number can be correctly registered on DLT with a valid consent template and still be processed in a way DPDP doesn't permit — for example, if it was collected for order delivery and is now being used for unrelated promotions without fresh consent.
- WhatsApp has no DLT layer at all, but DPDP still applies to the phone numbers you upload to your WhatsApp Business API platform.
- Email lists, CRM records and retargeting audiences are all covered too.
What "valid consent" looks like under DPDP
The Act and Rules describe consent that is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and withdrawable at any time as easily as it was given. In marketing terms, that translates to:
- No pre-ticked boxes. A customer must actively opt in.
- Purpose-specific. "We'll send you order updates" is not consent for festive offers. Ask separately.
- A clear notice. Tell people what data you collect, why, and how to withdraw — in plain language, and the Rules expect this to be understandable on its own rather than buried inside other terms.
- Easy withdrawal. An opt-out keyword in SMS, a "Stop" button on WhatsApp, and a one-click email unsubscribe all support this.
- Proof. You must be able to show when, where and how each person consented, and which version of the notice they saw.
The five biggest risks in a typical Indian marketing database
1. Purchased or "rented" number lists
If you can't show that each person consented to hear from you for this purpose, these lists are a liability. Stop using them.
2. Old data with no consent record
Many businesses have years of numbers from billing counters, walk-ins and events. Run a re-permission campaign on a transactional or service basis where allowed, and keep only those who opt in again.
3. Transactional numbers drifting into promotions
The phone number captured for an OTP or delivery update should not automatically flow into the promotional list. Separate them at the CRM level.
4. Vendors and agencies holding your data
Your SMS provider, WhatsApp BSP, CRM and agency all process data on your behalf. Contracts should cover security, purpose limits, deletion and breach notification.
5. Keeping data forever
DPDP expects data to be erased once the purpose is served and consent is withdrawn. Define retention periods for inactive contacts.
A practical compliance checklist for messaging teams
- Map every source of phone numbers and emails (website forms, POS, events, ads, marketplaces).
- Tag each record with its consent source, date, purpose and notice version.
- Split lists into transactional/service and promotional, with separate consent for each.
- Rewrite sign-up forms and WhatsApp opt-in flows with clear, separate purpose statements and no pre-ticked boxes.
- Make withdrawal instant across all channels and sync opt-outs between SMS, WhatsApp and email.
- Review vendor contracts with your SMS, WhatsApp and CRM providers.
- Set retention rules and purge contacts with no valid consent.
- Prepare a breach response plan — who decides, who informs, and how fast.
The upside: cleaner lists perform better
Compliance is usually framed as a cost, but consent-based lists consistently produce fewer complaints, fewer blocks and better engagement. A smaller list of people who actually asked to hear from you is worth more than a large list of strangers — and it protects your sender reputation on both telecom routes and WhatsApp quality ratings.
Frequently asked questions
Does DPDP replace TRAI's DLT rules?
No. They run in parallel. You still need DLT registration and TRAI-compliant templates for SMS, and DPDP adds data-protection obligations on top.
Is consent collected before the Rules still valid?
That depends on whether it meets DPDP standards and whether you can prove it. Many businesses will need to refresh consent for older records. Take legal advice for your situation.
Do I need to sign up with a Consent Manager?
The Consent Manager registration framework starts in November 2026, but using one is not mandatory for ordinary businesses. It is one option for managing consent at scale.
Does DPDP apply to WhatsApp marketing?
Yes. Any digital personal data you process — including phone numbers uploaded to a WhatsApp Business API platform — falls under the Act.
Build a consent-first messaging stack
OM Enterprises helps businesses run SMS, WhatsApp and RCS campaigns on clean, consent-based lists — with DLT-compliant templates, opt-out handling and list segmentation built in. Speak with our team to review your messaging setup before the 2027 deadline.