DPDP Act for WhatsApp, AI Chatbots and Voice Agents in India (2026): What Changes by May 2027, With a 12-Point Checklist

• 13 Nov 2025DPDP Rules notified; Data Protection Board established
• 13 Nov 2026Consent Manager registration provisions commence
• 13 May 2027every remaining duty on Data Fiduciaries commences
• 12 stepsa practical checklist for your customer-data workflow

If your WhatsApp bot, website chat or AI voice agent collects a name, a phone number or an order detail from a person in India, you are a Data Fiduciary under the Digital Personal Data Protection Act, 2023. The Act was enacted on 11 August 2023. Its Rules were notified on 13 November 2025, and the duties that matter to you commence eighteen months later, on 13 May 2027.

Between now and then you need four things: a standalone notice that itemises the data and the purpose, a consent record you can produce in a proceeding, a way to withdraw as easily as agreeing, and a breach and erasure process that reaches your processors. The telecom side of outbound calling is a separate rulebook, covered in our TRAI and DLT guide; this article is only about the data.

The Act did not start on assent. Section 1(2) let the government bring provisions into force on different dates, and it did so in three tranches by notification G.S.R. 843(E), dated 13 November 2025. The Rules, notified the same day as G.S.R. 846(E), follow the same tranches in Rule 1.

One date needs a footnote. The gazette issue carrying the Rules is dated Thursday, 13 November 2025, as is the notification. The e-Gazette document code and the Press Information Bureau’s explainer of 17 November say 14 November. Eighteen months from the printed date is 13 May 2027; from the upload date it is 14 May. Plan for the earlier one.

The Board exists, but is not yet staffed

G.S.R. 844(E) established the Data Protection Board of India from 13 November 2025. MeitY invited applications for a Chairperson and four Members on 6 May 2026; we found no notification appointing them, and an analysis published on 1 August 2026 reported the posts still vacant. That is not a reason to wait: the clock on your duties runs from the gazette, not from the Board.

Section 2(i) defines a Data Fiduciary as any person who, alone or with others, determines the purpose and means of processing personal data. Section 2(t) defines personal data as any data about an individual who is identifiable by or in relation to it; a phone number is identifying by design. Section 2(x) defines processing to include collection, recording, storage, use and sharing, and section 3(a) applies the Act to personal data collected in digital form within India.

So the business running the bot is the fiduciary, the customer is the Data Principal under section 2(j), and the platform running the bot — Adya, or any vendor — is a Data Processor under section 2(k). Section 8(1) is the line to remember: the fiduciary is responsible for compliance in respect of any processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary. Section 8(2) requires a valid contract with every processor, and Rule 6(1)(f) requires that contract to provide for security safeguards.

Significant Data Fiduciary is a label the government gives

Section 10 lets the Central Government notify a fiduciary or a class as Significant, based on volume, sensitivity and risk, bringing a Data Protection Officer based in India, an independent auditor and an annual impact assessment under Rule 13. We found no class notified as of this article. Assume you are an ordinary fiduciary unless told otherwise. Section 17(3) lets the government exempt notified startups from some duties; no such exemption has been notified either.

Section 4 allows processing on two grounds only: consent, or one of the “certain legitimate uses” in section 7. Section 6(1) sets the consent standard in one sentence: it must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, and limited to the data necessary for the specified purpose. The Act’s illustration is a telemedicine app that asks for the contact list; consent to the app does not extend to the contacts.

Three subsections decide how your bot should behave. Section 6(3) requires the request in clear and plain language, accessible in English or any Eighth Schedule language, with the contact details of a person who can answer. Section 6(4) gives the right to withdraw at any time, “with the ease of doing so being comparable to the ease with which such consent was given”. Section 6(10) puts the burden of proof on you: in a proceeding, the fiduciary must prove that notice was given and consent received.

The notice is a separate document

Section 5(1) requires every consent request to be accompanied or preceded by a notice stating the data, the purpose, how to exercise rights and how to complain to the Board. Rule 3 adds that the notice must be understandable independently of any other information, itemise the data, state the specific purpose and carry the link through which the person can withdraw, exercise rights or complain. A line in your terms of service is not a notice. For people who consented before commencement, section 5(2) requires the same notice “as soon as it is reasonably practicable”, and processing may continue until they withdraw.

The auto-enrol trap

The common WhatsApp pattern is to add every buyer to a broadcast list and let them opt out. Under section 6(1) that is not consent: nothing was affirmative, and nothing was specific to marketing. Section 7(a) rescues the transactional part: data a person voluntarily provides may be used for the purpose they provided it for, as long as they have not indicated they do not consent. The Act’s illustration is a pharmacy sending a receipt to the number the customer gave. An order update is that; a festive offer is not.

The DPDP Act is the law. Meta’s WhatsApp Business Messaging Policy, last updated 23 September 2026, is the contract, and it is enforced faster. Its opt-in page says a business may message a person only after receiving their permission, which must clearly state that they are opting in and name the business, with separate opt-ins per message category recommended. The policy requires you to respect every request, on or off WhatsApp, to block, discontinue or otherwise opt out. It also limits use of information obtained from WhatsApp to what is reasonably necessary to support messaging with that person, and bans asking for full payment-card or financial account numbers.

The practical reading: a DPDP-grade consent record and Meta’s opt-in are the same artefact if you build it once, properly. What Meta charges per message is in WhatsApp Business API pricing in India.

A recorded call is personal data twice over: the audio, and the transcript an AI agent produces from it. Both are processing under section 2(x), so both need a section 5 notice and a section 4 ground. For an inbound support call, section 7(a) covers handling the caller’s request; it does not obviously cover keeping the recording for training or quality review, so state that purpose in the notice and treat it as consent-based. The Act has no call-recording rule of its own.

An opening line that names the business, says the call may be recorded and transcribed, states the purpose and tells the caller how to object satisfies section 5(1) in the only place a caller can hear it. Our acceptable use policy already requires whatever recording disclosure the law demands. Whether an AI must announce that it is an AI is not a DPDP question; see the TRAI article.

How long to keep recordings

Section 8(7) is the rule: erase personal data when the person withdraws consent or when it is reasonable to assume the purpose is no longer served, whichever is earlier, unless a law requires retention. Rule 8(1) and the Third Schedule deem the purpose served after three years of inactivity, but only for e-commerce and social-media platforms with two crore registered users and gaming platforms with fifty lakh. No period is prescribed for anyone else, so you set one and justify it.

Two provisions pull the other way. Rule 6(1)(e) requires logs of access to personal data to be kept for one year. Rule 8(3) requires personal data, traffic data and processing logs to be retained for a minimum of one year from processing for the Seventh Schedule purposes, then erased. Lawyers read Rule 8(3) differently: some as a one-year floor on everything, others as a log-retention duty. Until the Board clarifies, keep processing logs for a year and apply your own, shorter purpose-based period to the audio itself.

Chapter III gives the Data Principal rights you must be able to serve from whatever channel the request arrives on. Section 11 gives access to a summary of the data processed and the identities of every fiduciary and processor it was shared with. Section 12 gives correction, updating and erasure. Section 13 gives grievance redressal, and section 14 the right to nominate someone to act after death or incapacity.

The hard part is not the policy page. A WhatsApp thread, a web chat, a call recording and a CRM row about the same person usually sit in four systems, and an erasure request that clears the CRM but leaves the transcript with your bot vendor has not been fulfilled. Sections 6(6) and 8(7)(b) both require you to cause your processor to erase too, so the processor contract needs a deletion clause with a deadline.

Prepare a clear breach-response process

Section 2(u) defines a personal data breach as any unauthorised processing or accidental disclosure, sharing, alteration, destruction or loss of access; an export mailed to the wrong address qualifies. Rule 7(1) requires a plain-language message to each affected person without delay, describing the breach, its likely consequences, what you have done and what they can do. Rule 7(2) requires an initial intimation to the Board without delay and a detailed report within seventy-two hours. The Schedule prices failure to notify at up to ₹200 crore.

Section 6(1) limits consent to the data necessary for the specified purpose, and section 4 forbids processing without a ground. An agent that collects more than the task needs is collecting without a ground, and the burden of showing otherwise is yours under section 6(10). Put the limits in the agent’s instructions, not in a policy document the agent never reads.

Children deserve a separate line. Section 2(f) defines a child as anyone under eighteen. Section 9(1) requires verifiable parental consent, and Rule 10 requires due diligence that the person claiming to be the parent is an identifiable adult, by reference to identity details you already hold or a token from an authorised entity. The Fourth Schedule exempts clinics and schools for narrow purposes. A coaching institute’s WhatsApp bot that enrols students by name and class is squarely inside section 9, and the penalty is up to ₹200 crore.

Work through this before 13 May 2027. Each item maps to a provision quoted above, and each is something your CA or an auditor can ask to see.

1. List every point where a bot, agent, form or call collects personal data, and the purpose of each (section 5(1), Rule 3).
2. Write a standalone notice per purpose: itemised data, specific purpose, a link to withdraw, exercise rights and complain, in English and your customers’ languages (Rule 3, section 6(3)).
3. Decide the ground for each purpose: consent under section 6, or a section 7(a) voluntary-provision use. Marketing is consent; order updates usually are not.
4. Capture consent by affirmative action, per channel and per message type, with a timestamp and the notice text shown (sections 6(1) and 6(10)).
5. Make withdrawal as easy as opt-in: a STOP keyword, a spoken request, a link, honoured across channels (section 6(4)).
6. Treat absent consent as absent, not as declined and not as granted; only a recorded choice is a choice.
7. Put a recording and transcription notice at the top of every AI call, with the purpose and how to object (section 5(1)).
8. Set a retention period per data type, keep processing logs for one year, and erase on withdrawal or when the purpose ends (section 8(7), Rules 6(1)(e) and 8(3)).
9. Sign a processor contract with every vendor that touches the data, with security, deletion and sub-processor clauses (section 8(2), Rule 6(1)(f)).
10. Publish a contact person, a rights-request channel and a grievance process that answers within ninety days (Rules 9 and 14).
11. Write the breach runbook now: who tells affected people, who tells the Board, and how you meet the seventy-two-hour report (Rule 7).
12. Restrict what the agent may ask for in its instructions, and add a parental-consent branch if anyone under eighteen can reach it (sections 6(1) and 9).

Put these controls to work with a clear operating process: describe your data uses in your notice, establish the basis for each campaign, assign a grievance contact and test an erasure request across your systems. Your team and advisers determine the legal requirements for your business; Adya gives you documented product controls and processor terms to assess as part of that work.