Summarise this article with:
On this page6 sections
The DPDP Rules, 2025 were published in the Gazette on 13 November 2025 and take effect in three stages. The Data Protection Board's rules applied at once, consent-manager registration follows one year later, and the duties that shape WhatsApp messaging, from notices to breach reporting, apply eighteen months after publication: 13 May 2027 on a plain count.
This post sets out what the notified text says and what a WhatsApp messaging team should have ready at each stage. It is not legal advice. Your obligations depend on what data you process and why, so confirm your plan with counsel.
The three commencement dates at a glance
Two notifications in the same Gazette issue, dated 13 November 2025, set the timetable. G.S.R. 843(E) brings sections of the Digital Personal Data Protection Act, 2023 into force, and G.S.R. 846(E) makes the Rules. Both use the same three stages.
| Stage | Date on a plain count | What comes into force | What it means for a WhatsApp team |
|---|---|---|---|
| On publication | 13 November 2025 | Rules 1, 2 and 17 to 21; Act sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3) | Definitions and the Data Protection Board. No new duty on your messaging yet |
| One year | 13 November 2026 | Rule 4; Act sections 6(9) and 27(1)(d) | Consent managers can register with the Board |
| Eighteen months | 13 May 2027 | Rules 3, 5 to 16, 22 and 23; Act sections 3 to 5, 6(1) to 6(8) and 6(10), 7 to 17, 27 (except 27(1)(d)), 28 to 34, 36, 37 and 44(2) | Notices, consent and withdrawal, security, breach intimation, retention, rights, children's data and penalties |
The government still describes it this way. In a Lok Sabha answer on 12 August 2026, MeitY set out the same three phases over an eighteen-month transition: the Board first, consent managers within one year, and compliance obligations for Data Fiduciaries within eighteen months.
Since 13 November 2025: the Board exists, your duties do not yet
The first stage set up the Data Protection Board of India and its procedure, and the Board is to work as a digital office. In the same August 2026 answer, MeitY said the advertisement for the Board's Chairperson and Members appeared in Employment News on 6 June 2026.
What did not start is anything a WhatsApp team must do differently. The duties on Data Fiduciaries, the Board's power to inquire into them and the penalty schedule all sit in the eighteen-month batch. A Data Fiduciary is whoever decides the purpose and means of processing personal data, which for your own customer messaging is normally your business rather than the platform you send through.
Use this stage for the work nobody can do in a hurry:
- Map where WhatsApp personal data lives. Phone numbers, names, chat transcripts, media, consent logs and campaign exports, across your messaging platform, CRM, spreadsheets and any staff phones running the WhatsApp Business app.
- List every purpose. Order updates, support, payment reminders, marketing broadcasts. Each one needs a basis: consent, or a legitimate use such as data a customer volunteered for a purpose they asked for.
- Find consent you collected before commencement. Section 5(2) of the Act requires a notice to these people as soon as reasonably practicable once it applies, so you need to know who they are and how you will reach them.
13 November 2026: consent managers can register
Rule 4 lets a person who meets the conditions in Part A of the First Schedule apply to the Board for registration as a consent manager, and the Board publishes registered consent managers on its website. The first condition in Part A is that the applicant is a company incorporated in India. Under the Act, a consent manager is a single point of contact that lets a person give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
Nothing here requires a WhatsApp team to file anything on 13 November 2026. The customer-facing right, section 6(7), which lets a person give or withdraw consent to you through a consent manager, starts with the eighteen-month batch. InfiQ's glossary entry on consent managers covers the model.
What to have ready by 13 May 2027 is plumbing. Withdrawal must reach every system that sends, whether it arrives as a STOP reply in WhatsApp, an email to your grievance address or, later, a signal from a registered consent manager.
13 May 2027: the duties that change WhatsApp operations
Almost everything a messaging team will be asked about starts here. The table maps each duty to its source and to the WhatsApp work behind it.
| Duty | Source | What to have ready on WhatsApp |
|---|---|---|
| Standalone notice | Act s.5; Rule 3 | Notice with an itemised list of data, the specific purpose and a link for withdrawing consent, exercising rights and complaining to the Board, linked from every opt-in point |
| Notice for existing consents | Act s.5(2) | A plan, and a budget, to send it to contacts who opted in before commencement |
| Easy withdrawal | Act s.6(4) and 6(6); Rule 3(c) | If someone opted in with a tap, a STOP reply should be enough, and processing must stop within a reasonable time, including at your processors |
| Security safeguards | Rule 6 | Access control on the shared inbox, logs of who accessed what, backups, and logs kept for one year |
| Breach intimation | Rule 7 | Draft messages for affected customers and the Board; a detailed report to the Board within 72 hours |
| Retention and erasure | Act s.8(7); Rule 8 | Erase when the purpose ends or consent is withdrawn, but keep processing logs for at least one year |
| Contact and rights | Rules 9 and 14 | A published contact for data questions and a published way to make requests, answered within 90 days |
| Children's data | Act s.9; Rule 10 | Verifiable parental consent where you message under-18s |
Notices and proof of consent
Rule 3 asks for a notice that stands on its own, in clear and plain language, and the Act lets the person read it in English or any language in the Eighth Schedule to the Constitution. Section 6(10) puts the burden of proof on you: if consent is questioned, you must show that notice was given and consent obtained. For WhatsApp, that means storing the notice version, the wording shown, the timestamp and the source against each contact. InfiQ's guide to WhatsApp opt-in under the DPDP Act covers the capture side in detail.
Security, breaches and the shared inbox
Rule 6 lists the minimum safeguards, including encryption or masking, access control, logs and monitoring, backups and contract terms with processors. Rule 7 then sets the breach routine. You must tell each affected person without delay, in plain language, what happened, the likely consequences, what you have done and what they can do. You must tell the Board without delay and send a detailed report within 72 hours of becoming aware, unless the Board allows longer.
Think through the WhatsApp-shaped breaches before May 2027: an agent account used after the agent left, a lost phone running the business app, a contact export shared in the wrong group. Each needs an owner and a drafted message.
Retention: erase on time, keep the logs
Section 8(7) requires erasure once consent is withdrawn or the purpose is no longer served, unless another law requires you to keep the data. Rule 8(3) adds a floor: keep personal data, traffic data and logs of processing for at least one year from the processing, for the purposes in the Seventh Schedule.
Three classes get a fixed clock under the Third Schedule: e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, and social media intermediaries with at least two crore. For them, data is treated as no longer needed three years after the person last engaged, and the person must be told at least 48 hours before erasure. WhatsApp is an obvious channel for that 48-hour message, so design the template early.
A working plan from now to 13 May 2027
Work backwards from 13 May 2027 and the months divide cleanly:
- October to December 2026. Finish the data map and purpose list. Draft the standalone notice and decide its languages. Review contracts with every platform that processes customer data for you, since section 8(2) allows processors only under a valid contract and Rule 6 expects it to cover security.
- January to March 2027. Rebuild opt-in points to link the notice and record its version. Wire STOP and other withdrawal routes to every sending system. Move agents off shared logins and personal phones.
- April to early May 2027. Send the notice to existing consented contacts, run a breach drill end to end, and switch on retention jobs.
Take a hypothetical coaching institute in Kota with 40,000 WhatsApp contacts, most of them students and parents. Its order of work changes: verifiable parental consent under Rule 10 comes first, because section 9 also bars tracking, behavioural monitoring and targeted advertising directed at children. The Fourth Schedule exempts educational institutions from part of that, but only for tracking and monitoring for educational activities or children's safety, so course offers aimed at under-18s get no exemption. The notice campaign comes second, and retention third.
Where InfiQ fits
InfiQ records the opt-in source and timestamp for every contact, enforces STOP at platform level with a suppression log, and lets your compliance team export those records without engineering help. SSO, audit logs and role-based access come with the Enterprise plan. The six-question readiness check on our compliance hub shows where your consent set-up stands today.
