A practical, date-specific workflow for making business messages expected, permission-based, traceable and easy to stop.
A saved phone number is not a marketing permission. A previous purchase, enquiry, visiting-card exchange or group membership does not automatically mean a person expects promotional WhatsApp messages. Indian businesses need a workflow that identifies the business, states the message purpose, records an affirmative choice and makes stopping messages simple.
Use this guide with GPTWala’s WhatsApp selling system for product businesses. Consent quality is part of customer experience, not a box added after the campaign list is built.
What rules and controls apply?
| Layer | What it governs | Owner action |
|---|---|---|
| WhatsApp Business Messaging Policy | Who a business may contact and user experience | Review current policy before every campaign programme |
| WhatsApp product rules | Templates, messaging windows, quality and available features | Use current app/platform guidance |
| Indian data-protection law | Processing digital personal data, notice, consent and rights as provisions commence | Track statutory commencement and legal applicability |
| Other Indian laws/sector rules | Commercial communications, consumer, financial, health or regulated products | Ask qualified counsel for the specific use case |
| Business promise | What the person was actually told | Do not stretch a narrow opt-in into unrelated messages |
WhatsApp policy baseline
WhatsApp’s current Business Messaging Policy says a business may contact people when they have given the business their mobile number and the business has received opt-in permission confirming that they wish to receive later messages or calls. It also requires businesses to respect requests to stop or opt out.
The policy recommends setting expectations for message categories, obtaining separate permission by category where useful, clearly explaining value and making opt-out intuitive. WhatsApp can review opt-in flows and user feedback. Treat screenshots of old guidance as historical; check the live policy.
India data-protection timeline as of 23 August 2026
The Digital Personal Data Protection Act, 2023 is subject to phased commencement. The Government’s 13 November 2025 notification states that several operational provisions, including sections on notice, most consent requirements, obligations and rights, commence 18 months from that Gazette date. Other provisions commenced earlier, and one consent-related provision has a one-year commencement.
MeitY’s Digital Personal Data Protection Rules, 2025 page likewise identifies phased commencement. Businesses should build toward clear, specific and traceable consent now, while confirming the precise legal position and effective dates with counsel. WhatsApp’s own opt-in policy applies independently to use of its business services.
| Question | Operational answer |
|---|---|
| Can we wait for every DPDP provision before improving opt-in? | No. WhatsApp policy and customer expectations apply now, and system changes take time. |
| Can a policy page replace legal review? | No. Applicability, sector rules and lawful bases are fact-specific. |
| Should we quote a penalty in marketing training? | Use current official text and counsel; do not circulate undated penalty claims. |
Design a useful WhatsApp opt-in
- Name the business. Do not make the person guess who will message.
- Name the channel. Say WhatsApp, not only “updates”.
- Name the purpose/category. For example, order updates, back-in-stock alerts or relevant offers.
- Describe likely frequency. Use an honest range or event trigger.
- Use a clear affirmative action. Leave the choice unticked by default.
- Link the applicable notice. Explain data use and contact method.
- Explain how to stop. Keep withdrawal comparable in ease.
- Record the evidence. Store wording, source, time, version and choice.
For a website form, use the product landing-page workflow and keep WhatsApp marketing permission separate from the minimum details needed to answer an enquiry.
Opt-in wording examples
These are drafting examples, not legal templates. Review them for your business, product category, current policy and law.
| Use case | Example affirmative wording | Avoid |
|---|---|---|
| Order updates | “Send order and delivery updates from [Business] to this number on WhatsApp.” | Bundling unrelated promotions |
| Back-in-stock | “Tell me on WhatsApp when [product/variant] is available from [Business].” | Permanent general marketing permission |
| Relevant offers | “I want up to [honest frequency] product offers from [Business] on WhatsApp. I can reply STOP any time.” | Pre-ticked box or vague “partner updates” |
| Wholesale enquiries | “Contact me on WhatsApp about this wholesale request and its follow-up.” | Adding the lead to a consumer promotion list |
| Call request | “I want [Business] to call this WhatsApp number about [purpose].” | Assuming message permission covers calls |
Keep consent records that answer real questions
| Field | Why retain it |
|---|---|
| Normalised phone number | Links the choice to the intended recipient |
| Business identity | Shows who received permission |
| Source and timestamp | Shows where and when the choice occurred |
| Exact notice/wording version | Shows what the person was told |
| Message categories and frequency promise | Limits later use to the expected scope |
| Affirmative action evidence | Distinguishes consent from assumption |
| Withdrawal/suppression time | Prevents re-import and repeat messaging |
| System/vendor origin | Supports audit and deletion across processors |
Store only what is necessary, protect access and define retention. Connect consent status to the CRM fields and ownership model rather than maintaining ungoverned spreadsheets across staff phones.
Make opt-out easy and durable
Accept common words such as STOP and equivalent local-language requests, plus clear natural-language requests like “do not send offers”. Do not make a person complete another form to stop a WhatsApp campaign. Confirm the request, suppress the category or all marketing as requested, and propagate the change to vendors.
- Record the request and time.
- Stop relevant sends promptly.
- Confirm the category or scope stopped.
- Keep a minimal suppression record where appropriate so old imports do not reactivate the number.
- Review why the person opted out and reduce surprise for others.
Separate service messages from marketing
An order confirmation or requested support reply serves a different purpose from a promotion. Maintain separate categories and access rules. Do not hide a sale inside every delivery update, and do not assume an order update creates indefinite permission for offers.
Use the order-confirmation workflow for factual service content. Use the respectful recovery workflow for abandoned enquiries, with frequency and suppression controls.
Control uploads, vendors and staff devices
- Do not buy phone-number lists or import scraped contacts.
- Require documented source and consent category before every upload.
- Limit staff access to the minimum necessary list.
- Contractually define roles, security, deletion and incident response with providers.
- Reconcile opt-outs across app, platform, CRM and exports.
- Remove departing staff access and review linked devices.
Pre-send audit checklist
- Current WhatsApp policy was checked.
- Each recipient has a documented mobile number and affirmative opt-in.
- The planned message fits the named category and frequency.
- The business identity and purpose are clear.
- Opt-out works in the actual channel.
- Suppression lists are applied before upload.
- Content and product are permitted under current policy and law.
- Vendors, templates, access and incident ownership are documented.
- Legal commencement and sector rules were reviewed for the current date.
Frequently asked questions
Do customers need to opt in for WhatsApp marketing in India?
WhatsApp policy requires the person to provide their number and opt in to later messages or calls. Indian legal requirements and commencement dates must also be checked for the specific activity.
Is saving a customer number the same as WhatsApp consent?
No. A saved number shows possession of contact data, not an affirmative, informed expectation of promotional messages from the named business.
Can I add past customers to a WhatsApp broadcast list?
Do so only when the recorded permission covers WhatsApp, the business identity, the intended message category and current legal requirements. A past purchase alone is not enough.
What should a WhatsApp opt-in record contain?
Keep the number, business identity, source, time, wording version, categories, affirmative action, frequency promise, notice version and later withdrawal or suppression state.
How should a customer opt out of WhatsApp marketing?
Provide a simple in-chat method such as replying STOP or an equivalent clear request, honour category-specific choices and prevent old lists from reactivating the person.
Is the DPDP Act fully in force in August 2026?
No. The Government notified phased commencement. Check the 13 November 2025 Gazette notification and current MeitY material because different provisions have different effective dates.