DPDP Act 2023 & WhatsApp marketing: a compliance guide for India

India's Digital Personal Data Protection (DPDP) Act, 2023 changed the compliance picture for any business handling personal data — which includes every phone number in your WhatsApp contact list. This guide covers what the DPDP Act means for WhatsApp marketing in practice, not in theory.

Consent is the foundation

The DPDP Act requires explicit, informed consent before processing personal data for marketing. For WhatsApp, that means: the contact must have agreed to receive your messages, you must be able to prove when and how they agreed, and they must be able to withdraw consent easily. AiConva records the opt-in source against each contact for exactly this audit trail.

What counts as valid opt-in

Valid opt-in is a clear action: a checkbox at signup, a keyword reply, a click-to-WhatsApp ad that started a conversation. Invalid opt-in: bought lists, scraped numbers, 'they gave us their business card', 'they're a past customer so we assumed'. Read our opt-in compliance guide for the full taxonomy of valid vs invalid consent.

Opt-out and data rights

Every marketing message should include a clear opt-out ('Reply STOP'). AiConva honours STOP/UNSUBSCRIBE automatically — a contact who opts out is marked so system-wide and no campaign can message them. Under DPDP, individuals also have rights to access and erase their data — AiConva's full workspace export and contact deletion support these obligations.

Data retention and security

Retain personal data only as long as needed for the purpose it was collected. Don't keep opted-out contacts in marketing-eligible segments. AiConva encrypts connection credentials at rest and never logs message bodies in plaintext beyond the operational retention. For sensitive sectors (finance, health), apply stricter handling — see our financial services and healthcare playbooks.