DPDP and your WhatsApp list:Can you still message your customers after 13 November?

Written by Madhur Tyagi, founder of The Human Algorithm. 8+ years, 25+ brands, since 2017.

Not legal advice. This is a plain language guide to help you get organised. It is our reading of the Act and of a dated legal explainer. For your own case, please talk to a lawyer.

Picture Sharma ji’s kirana shop in Jaipur. New basmati arrives on a Tuesday. He does not blast it to 400 numbers. He looks up at Mrs Mathur at the counter and says, “Bhabhi ji, naya basmati aaya hai. WhatsApp pe photo bhejun?”

She says yes. He remembers she said yes. The day she says “bas, ab mat bhejna”, he stops. No hard feelings.

That is it. Ask, remember, stop when told. That is most of what India’s new data law asks of you.

But here is what I see instead. An owner hears “new privacy law, crores in fines” and goes quiet. No offers, no restock alerts, no thank you notes. The list goes cold. Silence is not compliance. Silence is just silence. And silence loses customers the law never asked you to lose.

What actually happens on 13 November 2026?

The DPDP Rules 2025 were notified on 13 November 2025. They switch on in three steps. A Vera Causa Legal explainer from 22 September 2026 lays them out clearly.

So what is a Consent Manager? Think of it as a single counter where a customer can see, give and take back consent for many businesses at once. It is registered with the Board and works for the customer, not for you. Most shops, coaches and D2C brands will never need to become one.

Is DPDP applicable to small businesses like mine?

Yes. The Act applies to digital personal data processed in India. It also covers data collected on paper and saved digitally later (Section 3). So the number in your bill book counts the moment it goes into your phone.

There is no size cut off for shops in the Act. The government can exempt some businesses, including notified startups, from a few duties under Section 17(3). Read that list carefully: it names notice and some other duties. It does not name consent.

One thing sits outside the Act: personal data used for your own personal or domestic purpose. Your family group is not a business list. Your customer list is.

Can I still send WhatsApp offers to old customers?

Here is the simple version, in our reading of the Act.

A number given for a job can be used for that job. Section 7(a) allows use for the purpose a person gave their data for, until they say no. The Act’s own example: a pharmacy may send a payment receipt to the number a buyer gave for it. So a delivery update, a bill, an answer to their question, all fine.

Offers are a different job. From 13 May 2027, consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (Section 6(1)). A customer who gave a number for delivery did not say yes to a Diwali sale blast.

Stopping must be easy. Section 6(4) says withdrawing consent should be as easy as giving it. If yes took one tap, no should take one word.

Meta also asks for an opt in before businesses message people on WhatsApp. We explain that rule, with its source, in our guide to sending a WhatsApp broadcast without a ban. So the law and the app point the same way.

The Kirana Rule: Ask, Record, Honour

Here is the one model I want every owner to keep. Three habits. They work for the law, for WhatsApp, and for trust.

Save this framework

The Kirana Rule: Ask, Record, Honour

1AskBefore you send offers, ask once in plain words. Say who you are and what you will send. A yes must be a clear action, a tap or a reply, never a pre ticked box.

2RecordWrite down who said yes, to what, and when. A tag in your WhatsApp Business app, a column in your sheet. If you can’t show it, you don’t have it.

3HonourWhen someone says stop, stop that day. Make stopping as easy as starting. One word should be enough.

Ask like a neighbour · remember like a register · stop like a gentleman

Save it, or send it to a founder friend

Send on WhatsAppCopy link

Tool: can I message this contact?

Tap where your numbers came from. You get a plan for each group. Two minutes, no signup, nothing leaves your phone.

Tool · two minute list sort

Can I message this contact?

Tap every place your numbers came from. Then see your plan in Green, Amber and Red.

They messaged me asking about a productThey bought and gave the number for delivery or a billThey ticked or replied yes to offers on WhatsAppWalk in customer, I noted the number at billingOld chat, no reply in over a yearWebinar or event signup, form said nothing about WhatsAppA friend or another business passed me the numberTaken from a WhatsApp group or a public pageA bought or downloaded number listThey once said stop or blocked me

Sort my list

Our reading of the DPDP Act, for planning. Not legal advice.

Want the full safe broadcast steps after this? Read how to broadcast on WhatsApp without a ban.

Your six month plan, November 2026 to May 2027

You don’t need to do this in a weekend. Here is a calm month by month plan. One small job each month.

1. November 2026 · SortExport or list your contacts by where they came from. Mark them Green, Amber or Red with the tool above.
2. December 2026 · Stop RedStop messaging bought lists and scraped numbers. Delete what you don’t need. Less data is less risk.
3. January 2027 · Ask AmberSend one kind yes or no message to Amber contacts. One message, no follow up chase.
4. February 2027 · RecordTag every yes with the date and what they agreed to. A label in WhatsApp Business or a column in your sheet.
5. March 2027 · New chatsAdd a short consent line to your opening WhatsApp reply, your bill and your checkout.
6. April 2027 · Stop buttonMake sure “STOP” in any language gets an easy, polite exit the same day.
7. May 2027 · CheckBefore 13 May, walk the list again with your lawyer. Fix gaps. Then keep talking to the people who said yes.

5 scripts to ask for a yes on WhatsApp

Copy, fill the brackets, make them sound like you. Short beats clever.

Free kit: 5 consent scripts

1 · The one time ask (Amber contacts)

Hi [name], this is [your name] from [business]. You bought from us earlier, thank you. Can we send you new arrivals and offers here on WhatsApp, about [twice a month]? Reply YES to stay, or NO and we won’t message offers again.

Copy

2 · The opening line for new chats

Namaste, thanks for messaging [business]. We’ll use your number to answer you and for your order. Want offers and new stock here too? Reply YES. You can say STOP anytime.

Copy

3 · The thank you after a yes

Done, [name]. You’ll hear from us about [what you send], around [how often]. Reply STOP any day and we stop, no questions.

Copy

4 · The polite stop reply

Of course, [name]. We won’t send offers anymore. If you ever need help with an order, just message here. Thank you for being with us.

Copy

5 · The bill or checkout line

[ ] Yes, send me offers and new arrivals from [business] on WhatsApp. I can stop anytime by replying STOP.

Copy

Notice what script 5 does: the box starts empty. A pre ticked box is not a clear action. And if a bot sends these lines for you, our guide on whether a WhatsApp bot should say it is AI covers the honesty part.

What is the penalty under the DPDP Act?

We read the Schedule in the Act itself. The amounts are ceilings. The Board decides the actual figure case by case.

Two honest notes. The big ₹250 crore number is about security, not about one wrong WhatsApp message. And these are maximums. Still, the real cost of a messy list is usually earlier and quieter: blocks, reports and customers who stop trusting you.

How we help you keep talking, with every yes on record

Our method, labelled as ours

Revenue Desk, consent built in

1. We sort your list with you. Green, Amber, Red, so you know who you can message today.
2. We put the ask in every new chat. Your opening reply carries a clear consent line, and every yes is saved with a date.
3. We honour every no. STOP works in Hindi, English and Hinglish, the same day. An AI that feels human and keeps improving itself, with your team in charge.

Questions owners ask about DPDP and WhatsApp

What changes on 13 November 2026 under DPDP?

Rule 4 of the DPDP Rules 2025 comes into force. It lets companies apply to the Data Protection Board to register as Consent Managers. It is a licensing step for that new kind of company. The bulk of business duties, including notice, consent, user rights, breach reporting and penalties, start on 13 May 2027 (Vera Causa Legal, 22 Sep 2026).

Is DPDP applicable to small businesses?

The Act applies to digital personal data processed in India, including data collected on paper and saved digitally later (Section 3). It has no size cut off for shops. The government can exempt some businesses, including notified startups, from a few duties under Section 17(3), but that list does not include consent under Section 6.

Can I send WhatsApp offers to old customers under DPDP?

From 13 May 2027, offers need a clear yes. Section 7(a) lets you use a number for the purpose a customer gave it, like a delivery update or a receipt, until they say no. Offers are a different purpose. Ask once, kindly, and keep a record of the reply. This is our reading, not legal advice.

What is a Consent Manager in simple words?

A company registered with the Data Protection Board that gives people one place to give, review and withdraw consent across many businesses. It works for the customer, not for the business. Most small businesses do not need to become one.

What is the penalty under the DPDP Act?

The Schedule to the Act sets ceilings. Up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not reporting a breach or for children’s data duties, and up to ₹50 crore for breaching any other provision. These are maximums, not fixed fines.

Do I need a lawyer for DPDP?

For your exact case, yes, talk to one. This guide is plain language help to get organised, not legal advice. Sorting your list and recording consent are good habits whatever your lawyer says.

The kirana uncle was never scared of a law. He just asked before he sent, in his own words, and remembered the answer. Be that shop.

Know an owner sitting on a big WhatsApp list? Send them this.

WhatsAppLinkedInCopy link

About this guide: sources, all checked 3 Nov 2026. The Digital Personal Data Protection Act, 2023, Gazette of India, 11 Aug 2023 (Sections 3, 6, 7, 17 and the Schedule, read on the MeitY copy). Vera Causa Legal, “DPDP Consent Managers Go Live in November 2026”, 22 Sep 2026 (the three phase dates). Deccan Herald, 7 Aug 2026 (WhatsApp age checks, as reported). Meta’s WhatsApp opt in rule is explained with its source in our broadcast guide. Not legal advice. This is plain language help to get organised. The Green, Amber, Red sort, the six month plan, the scripts and the Kirana Rule are ours, labelled as ours, and they are our reading of the Act. Check your own case with a lawyer. Madhur Tyagi is the founder of The Human Algorithm., a growth and automation practice in New Delhi that helps Indian founders, coaches and creators reply faster, follow up kindly and earn trust in their DMs and WhatsApp. 8+ years, 25+ brands, since 2017.