Can Indian businesses still send WhatsApp and SMS marketing under DPDPA?

WhatsApp broadcasts and bulk SMS are the backbone of Indian sales and marketing, from D2C brands and coaching institutes to NBFC collections teams, and most of them already live with TRAI's DLT registration, headers and templates. The question we are asked most often now is whether the Digital Personal Data Protection Act, 2023 adds anything on top, and whether lists built over the last five years can still be messaged. This post sets out what each rulebook requires and what a CRM has to record so that the answer to a complaint is a file rather than a scramble.

Why does DPDPA change WhatsApp and SMS marketing when TRAI rules already exist?

Because the two regimes regulate different things. TRAI's Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR) govern the channel: who may send commercial communications over Indian networks, from which headers and number series, using which registered templates, and what happens when subscribers complain. The DPDP Act governs the personal data: a mobile number tied to a name is personal data, and sending a promotional message is processing it. TRAI compliance answers "may we use this pipe?"; DPDPA compliance answers "may we use this person's data for this purpose?"

That is why a DLT consent template does not stand in for a DPDP consent record. Section 6(10) places the burden of proving valid consent on the Data Fiduciary, so the business must be able to show, for each number, when consent was given, for what purpose, after which notice, and whether it has since been withdrawn. A DLT entry records that a template was approved, not that a particular person agreed to receive it.

What counts as valid marketing consent under Section 6?

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the personal data necessary for the specified purpose. Section 7 lists the legitimate uses that do not need consent, such as processing for employment, medical emergencies or compliance with law; promotional marketing is not among them. Three practical consequences follow for a messaging programme:

1. No pre-ticked boxes or silent opt-ins. A number collected at checkout, on a lead form or at an exhibition stall is not automatically opted in to offers; the affirmative action must be the person's own.
2. No bundling. Making a service conditional on agreeing to marketing fails the "unconditional" test. Order updates and promotional offers need separate consents, which is also what Meta's WhatsApp Business Messaging Policy recommends.
3. A real notice. Section 5 and Rule 3 of the DPDP Rules, 2025 require a notice, understandable on its own, that itemises the data, states the purpose, and explains how to withdraw, exercise rights and complain to the Data Protection Board, in English or any of the 22 Eighth Schedule languages.

How do TRAI's rules and the DPDP Act compare for a marketing team?

Requirement	TRAI TCCCPR 2018 (as amended 2025)	DPDP Act, 2023 and Rules, 2025
What it regulates	Commercial voice calls and SMS over telecom networks	Processing of digital personal data, including the number and the profile behind it
Sender identity	DLT registration; promotional headers with a -P suffix; promotional calls only from the 140 series, service calls from 160; no ordinary 10-digit numbers	Identified Data Fiduciary named in the notice, with a contact for grievances
Consent	Registered consent templates; inferred consent lasts only for the contractual relationship; Digital Consent Acquisition via short code 127	Free, specific, informed, unconditional, unambiguous consent by affirmative action (s.6); fiduciary must prove it (s.6(10))
Opt-out	Preference registration (DND); complaints within 7 days of the message	Withdrawal as easy as giving consent (s.6(4)); processing stops within a reasonable time (s.6(6))
Enforcement trigger	Five complaints in ten days against a sender; action on unregistered senders within five days	Complaint to the fiduciary's grievance officer, then to the Data Protection Board (s.13)
Consequence	Header and template suspension, disconnection of all telecom resources, blacklisting for up to two years	Monetary penalties under the Schedule, up to ₹50 crore for most contraventions and ₹250 crore for security-safeguard failures

The table also shows the gap WhatsApp sits in. WhatsApp Business messages do not travel over DLT, so TRAI's header regime does not apply to them today; Meta's own policy requires opt-in and honouring opt-outs made on or off the platform, enforced through quality ratings and messaging limits. The DPDP Act applies to WhatsApp, SMS and email alike, because it follows the data, not the pipe.

Can you keep messaging the customer list you already have?

For service and transactional messages, generally yes: an order confirmation, an OTP, a renewal reminder or a payment receipt is processing for the purpose the person provided their number for, and TRAI classifies them under -S and -T headers. For promotional messages the position is harder. Section 5(2) lets a fiduciary send a notice to people whose data was collected before the Act commenced, but a notice is not consent. TRAI's 2025 amendment likewise limits inferred consent to the life of the contractual relationship, so a customer who bought once in 2023 is not a standing marketing contact.

The approach most compliance teams are taking is a single re-permission campaign before the 13 May 2027 deadline: one clearly worded message that asks for marketing consent on each channel, records the response, and suppresses non-responders from promotional sends while leaving service messages untouched. Lists that were purchased or scraped have no consent to refresh; see our note on purchased lead lists and cold outreach under DPDPA.

What must an opt-out actually do?

Under Section 6(4), withdrawing consent must be comparable in ease to giving it: if opting in was one tap on WhatsApp, opting out cannot require an email to a legal mailbox. Under Section 6(6) processing must stop within a reasonable time, and Section 8(7) then requires erasure unless another law requires retention, a point covered in our guide to how long customer data can stay in a CRM. A working opt-out has to reach every system that sends, from the WhatsApp Business API provider to the SMS aggregator and the dialer, with suppression confirmed back to the CRM. A "STOP" that updates one tool is a complaint waiting to happen, and five complaints in ten days is now enough for TRAI action against the sender.

How should a CRM record consent for each channel?

A compliant programme is a data-model question before it is a messaging question. For each contact, the CRM should hold:

1. Per-channel consent flags for WhatsApp, SMS, email and voice, rather than one "marketing opt-in" field.
2. Purpose and basis: promotional offers, product updates, surveys; or a Section 7 legitimate use for service messages.
3. Provenance: timestamp, source (form, store, chatbot, short code 127), notice version shown and language.
4. TRAI references: DLT principal entity ID, header, consent template ID, so the telecom record and the DPDP record match.
5. Withdrawal events with the time received and the time each downstream system confirmed suppression.
6. Evidence that can be exported for a grievance or a Board enquiry without re-exposing the data.

This is the model built into QQCRM, Qodequay's AI CRM accelerator, which connects to DAPro (Data Adhikaar), our DPDPA compliance platform, for consent notices in 22 languages, a tamper-evident Evidence Vault and 25+ connectors to messaging and marketing tools. If you run another CRM, our eight-check DPDPA CRM audit is the place to start, and our explainer on Consent Managers versus consent management platforms clarifies which one a marketing team actually needs.

What happens on 13 November 2026 and 13 May 2027?

The DPDP Rules, 2025, notified on 13 November 2025, bring the Act into force in stages. The Consent Manager registration framework under Rule 4 opens on 13 November 2026, two weeks from now; Consent Managers are registered intermediaries through which individuals can give, manage and withdraw consent, and they will become one more channel by which a marketing opt-out can arrive. The duties that govern marketing consent, the Section 5 notice, Section 6 consent, Section 8 obligations and the penalty Schedule, apply from 13 May 2027. TRAI's amended TCCCPR is already in force, with its complaint provisions effective from 13 April 2025.

Qodequay is ISO 27001:2022 certified and works with Indian sales, marketing and compliance teams to make WhatsApp, SMS and CRM programmes DPDPA-ready without losing reach. Book a 30-minute consent review and we will map your channels, lists and tools to a consent model you can defend.

This article is for general information and is not legal advice. Confirm obligations against the official texts of the DPDP Act, the DPDP Rules, the TRAI regulations and the platform policies that apply to you, and consult qualified counsel for your situation.