WhatsApp Compliance in India

Key Rules for WhatsApp in India

WhatsApp Business API messaging must follow Meta's business and commerce policies, including opt-in and template approval. Customer data handling should also align with India's Digital Personal Data Protection Act, 2023 and its rules.

• WhatsApp is not covered by DLT registration, but Meta's policies require opt-in, approved templates and correct categories.
• The Digital Personal Data Protection Act, 2023 requires a clear notice and a lawful basis, usually consent, for processing customers' personal data.
• Keep records of where and when each customer opted in, and let them withdraw consent as easily as they gave it.

Practical Checklist

• Use the official WhatsApp Business Platform rather than personal or modified apps, which risk bans.
• Collect opt-in that clearly mentions WhatsApp and your business name, and store a record of it.
• Choose the correct template category and keep utility messages free of promotions.
• Respond within the 24-hour customer service window where possible, and use approved templates outside it.
• Honour opt-outs and blocks, and watch your quality rating in WhatsApp Manager.

Contact data

Format numbers in international E.164 format with the +91 country code, remove duplicates and invalid numbers, and keep consent records linked to each number.

Digital Habits and Channels in India

India has over a billion mobile connections and is WhatsApp's largest market, so WhatsApp, SMS and voice all play a big role in reaching customers. Commercial SMS and calls are governed by TRAI's Telecom Commercial Communications Customer Preference Regulations (TCCCPR) 2018, which created the DLT system where businesses register as entities, register headers (sender IDs) and content templates, and record consent. Since October 2024, links, APKs and call-back numbers in SMS must be whitelisted on DLT, and messages with unregistered URLs are blocked.

TRAI's February 2025 amendment requires promotional voice calls to use the 140 number series and service and transactional calls to use the 1600 series, and allows customers to report spam calls and messages within seven days of receipt. The Digital Personal Data Protection Act 2023, with the DPDP Rules notified on 13 November 2025, introduces consent and notice requirements that apply in phases, with most obligations taking effect by May 2027. UPI is used for most digital payments.

Advertising Alongside Messaging

Ad campaigns should follow Google and Meta advertising policies, the ASCI code for advertising content and influencer disclosures, and sector rules for areas such as healthcare, finance and real estate (for example, RERA registration details for property ads).

This guide is general information, not legal advice, and reflects our understanding as of October 2026. Rules change, so we check current requirements for India before every launch.