Compliance · 5 min read
WhatsApp and the DPDP Act: What a Vendor Can and Cannot Do
Start with the sentence that matters most: nobody can sell you compliance. A vendor claiming their product makes you DPDP compliant is describing something that is not for sale, because most of the obligation lands on decisions about your business that no software makes.
What a tool can honestly offer is mechanics — a way to show what you hold, a way to delete it properly, and a record of who looked at it. This post is about where that line sits.
The thing people get wrong first
A phone number is personal data. So is the message somebody sent you, the fact they messaged at all, and any note you attached to them afterwards.
That surprises people because a WhatsApp conversation feels like a chat rather than a database. It is a database. It sits on your business account, it persists, and somebody on your team can read it two years later.
Nothing about a channel feeling casual changes what it is holding.
Where the obligation actually lands
Four questions, and every one of them is answered by you rather than by software.
- Why do you have it? There has to be a reason you can state, and "we might want to market to them later" is not the same reason as "they asked us about an order".
- Did they agree to that specific use? Consent for one purpose is not consent for another. Somebody who messaged about a delivery has not opted into a festival campaign.
- How long will you keep it? Forever is an answer, and it is usually the wrong one. A retention period is a decision made once and then applied.
- Who inside your company can read it? This is the one most businesses have not thought about, and it is where the practical risk sits — a shared login that four people use means four people can read every customer conversation.
The consent problem is sharper on WhatsApp
On Instagram, the shape of a conversation carries an implicit boundary: the person commented or messaged first, and you may reply for a bounded time. There is nowhere to put a consent checkbox in a comment, so the honest line is that you are answering a question they asked rather than acquiring a subscriber.
WhatsApp is a channel where businesses genuinely do build lists, which makes consent an active decision rather than an incidental one. Two things worth being clear about:
A phone number you obtained elsewhere is not consent. A number from an order form, a business card, or a purchased list is a number, not permission to message it. Whatever a vendor's onboarding suggests, the obligation is yours.
Opt-in has to be revocable, easily. If somebody asks to stop, stopping has to actually happen — everywhere, immediately, including in whatever automation is running. A stop request that only pauses one campaign is not a stop.
What a tool should give you
Here is where software can honestly help, and it is worth asking any vendor for each of these specifically.
Ask for this
Be sceptical of this
How we do the mechanics on the channel we actually run
PostEngage does not ship WhatsApp. On Instagram, where it does run, the parts that correspond to the above work like this, and they are the parts we would carry across.
A data request produces a downloadable export. Erasure is a separate operation and it walks a fixed list of tables in a fixed order — the same list that drives the export, so what you can download and what gets deleted cannot drift apart. Staff access is by named account rather than a shared login, and administrative actions are written to an append-only record by the same guard that authorises them, so an endpoint cannot forget to log itself.
That last point is the one worth stealing regardless of vendor: the least risky data is the data you did not collect. A lead record here holds what the person typed and which post they typed it under. It does not hold a guessed email, an inferred demographic, or a score nobody can explain — partly because those are not useful, and partly because each one would be another thing to export, delete and justify.
What to do this week
Read one week of your own inbox and ask, for each conversation, why you still have it and how long you intend to. Then write the answer down. That document is worth more than any vendor's compliance page, and producing it is usually the moment a business discovers it is keeping things for no reason.
If you want the corresponding Instagram detail, the data post covers what is collected and what a person can demand. If you want the obligations framing rather than the data framing, that is here.
