Definition
The DPDP Act is India's Digital Personal Data Protection Act, 2023, which governs how organisations process digital personal data, including the phone numbers used for SMS and WhatsApp messaging.
The Digital Personal Data Protection Act 2023 sets rules for processing digital personal data of people in India. For messaging teams the practical point is that a mobile number on a contact list is personal data, so the way you collect it, store it and use it for marketing falls under the Act.
The Government notified the DPDP Rules in November 2025. The Press Information Bureau describes a phased timeline of about eighteen months for compliance, with a Data Protection Board and consent managers in the framework. Which provisions apply on a given date should be confirmed with your own counsel.
In day-to-day messaging the Act points to the same habits as good opt-in practice: keep a record of who agreed to receive messages, when, where and with what wording, and let people withdraw consent easily. The Act sits on top of sector rules rather than replacing them, so SMS senders still follow TRAI's DLT requirements and WhatsApp senders still follow WhatsApp's opt-in rule.
Buying or renting contact lists makes it hard to show valid consent, so avoid it. This entry is a general explanation, not legal advice.
Frequently asked questions
Does the DPDP Act apply to WhatsApp marketing?
The Act governs the processing of digital personal data, which includes phone numbers, so marketing to a list of numbers falls within its scope. Record who agreed, when, where and with what wording, and let people withdraw easily. Confirm your legal basis and timelines with your own counsel.
When do the DPDP Rules apply?
The Government notified the DPDP Rules in November 2025, and the Press Information Bureau describes a phased timeline of about eighteen months for compliance. Because provisions take effect in stages, check the current position with counsel before fixing your plans.
Does the DPDP Act replace TRAI's DLT rules for SMS?
No. The DPDP Act covers personal data, while TRAI's regulations and the DLT registry cover commercial SMS headers, templates and consent. Indian SMS senders need to meet both, and WhatsApp senders also follow WhatsApp's own opt-in policy.