DPDP Act for companies: what your WhatsApp bot and AI agents must change before May 2027

Picture a 3-chair dental clinic in Ahmedabad. A patient messages its WhatsApp number at 10 pm on a Sunday asking for a Monday slot. The bot books her in and saves her to the CRM. An AI model writes her reminder, and the chat lands in a log and a nightly backup. By Monday her phone number sits in five places, and nobody at the clinic could list them.

That's what the DPDP Act for companies comes down to in practice. India's Digital Personal Data Protection Act, 2023 and its Rules decide what you may do with that number, how long you keep it and what you tell her first. Most of it starts on 13 May 2027.

I build WhatsApp and AI agents, so I've read the Act and the Rules line by line. I'm not a lawyer, and this isn't legal advice.

Most "DPDP Act 2026" searches are really about dates. The Rules were notified on 13 November 2025 and switch on in three stages:

• 13 November 2025: the Rules that set up the Data Protection Board (Rules 1, 2 and 17 to 21).
• 13 November 2026: Rule 4, on registering consent managers, the platforms people can use to give or withdraw consent. You don't have to use one, so this date mostly matters to firms that want to become one.
• 13 May 2027: what a bot owner cares about. Notice, consent, security safeguards, breach reporting, retention and people's rights over their data (Rules 3, 5 to 16, 22 and 23).

There's no size or turnover threshold. Section 3 covers digital personal data processed in India, including scanned paper records. The heavier duties, like a Data Protection Officer based in India and yearly audits, fall only on companies the government names as Significant Data Fiduciaries.

In January 2026, MeitY proposed cutting the 18-month runway to 12. MirvoLegal's tracker, last reviewed on 20 September 2026, found no amending notification. So 13 May 2027 still stands, but check the Gazette before you plan around it.

Yes. A phone number, a name in a chat, a Zoho CRM note saying "wants 2BHK, budget flexible": all of it is digital personal data about a person the Act calls a Data Principal.

You're the Data Fiduciary, because you decide why and how the data is used. Your WhatsApp provider, CRM, AI model provider and developer are Data Processors. Section 8(2) lets you use them only under a valid contract, and section 8(1) keeps you responsible for what they do. So "our vendor handles it" doesn't get you off the hook.

I'd rather follow one number than list obligations. Say a buyer messages a Rajkot real-estate broker about a 2BHK.

1. Her WhatsApp message. Section 7(a) allows you to use data for the purpose someone voluntarily gave it for, until she says no. The Act's own example is a person messaging a broker for help finding a rental: he may send her options, and must stop when she says she's done. My reading: answering her enquiry fits. Next month's offers don't.
2. The bot's first reply. Anything past the answer, like reminders or offers, needs consent. Rule 3 says the notice must make sense on its own, in plain language, with an itemised list of the data, the purpose, and a link to withdraw consent, use her rights and complain to the Board. Section 6(1) wants a clear yes, so "by continuing you agree" won't do. She can ask for the notice in English or any Eighth Schedule language, so keep a Gujarati version ready.
3. The CRM. Consent covers only the data the purpose needs. Budget and area, yes. Her Aadhaar number, no. If a lead score decides who gets a callback, section 8(3) wants that data accurate.
4. The AI prompt. This is the DPDP Act for AI in practice: her message goes to a model provider, which is your Data Processor. OpenAI says API data isn't used for training unless you opt in, and keeps abuse-monitoring logs for up to 30 days. Anthropic says it deletes API inputs and outputs within 30 days and doesn't train on commercial data by default. Both list exceptions. Rule 15 allows transfers abroad unless the government restricts them, and OpenAI's India residency covers storage, not processing. Rule 6 names masking and tokens as safeguards, so swap her number for a reference ID before the prompt.
5. The logs. Rule 6 wants logs of who accessed personal data, and Rules 6 and 8 say you keep them, with the related data, for at least a year. "Delete everything when the deal closes" is wrong too. I'd keep a lean audit log for the year and clear the working data once the purpose is over, as section 8(7) requires unless another law says keep it.
6. The backup. Rule 6 expects backups, which is where deleted data hides. When she withdraws consent, section 6(6) says you and your processors stop, and section 8(7)(b) says processors erase what you gave them. Know which backups hold her chat and when they roll over.

For DPDP compliance on WhatsApp, two sets of rules apply at once.

• Meta's opt-in policy says you must clearly state that the person is opting in to messages from you, name your business, explain how to opt out of specific categories and follow the law. The opt-in can be general rather than WhatsApp-only.
• The DPDP Act wants consent that is "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)), and withdrawal as easy as saying yes (section 6(4)). If she agreed with one tap, one STOP should end it.
• Separately, since 15 January 2026 WhatsApp's business terms bar general-purpose AI assistants where the AI is the main product. Meta says businesses using AI to serve their own customers aren't affected, so keep your bot about your business.

Here's a sample opt-in for a clinic. It's an example; rewrite it for your business and have it checked:

Hi, this is Shah Dental, Ahmedabad. To book your appointments and send reminders on WhatsApp, we keep your name, phone number and appointment times. An AI assistant drafts some replies and our staff read every chat. Reply YES to agree. Reply STOP at any time and we'll stop messaging you. To see your data, ask us to delete it or make a complaint, visit shahdental.in/privacy.

Ask for marketing as a separate yes. Agreeing to appointment reminders doesn't cover a Diwali offer.

Tick these off before 13 May 2027:

• Map every system a customer's number touches, logs and backups included.
• Write a standalone, plain-language notice with the data, the purpose and a link for withdrawal, rights and complaints (Rule 3).
• Get a clear yes before reminders or follow-ups, and a separate one for marketing.
• Make one STOP message reach the CRM and every processor.
• Sign contracts with security terms with your WhatsApp provider, CRM, AI provider and developer (Rule 6).
• Drop fields nobody uses, and mask phone numbers and IDs before they reach the AI model.
• Give each person and each bot its own login with only the access it needs.
• Keep access logs for at least a year, then delete them.
• Publish a contact for data questions (Rule 9) and a grievance response time of 90 days or less (Rule 14).
• Write down who tells the Board about a breach without delay, who files the detailed report within 72 hours and who messages affected customers (Rule 7).

The Schedule to the Act sets maximum fines:

• Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach.
• Up to ₹200 crore for not telling the Board or affected people about a breach.
• Up to ₹200 crore for breaking the extra rules on children's data.
• Up to ₹150 crore for a Significant Data Fiduciary breaking its extra duties.
• Up to ₹50 crore for any other breach, which covers most notice and consent failures.

Those are ceilings. Under section 33 the Board fines only after an inquiry finds a significant breach and gives you a hearing, and it weighs things like the type of data and how fast you limited the damage.

For most owners, the realistic risk is a leaked CRM export or a shared bot login. Both sit under the two biggest rows, so I'd fix those first.

This is how I read the Act and Rules as someone who builds these systems. It isn't legal advice. Get a privacy lawyer if:

• You handle children's data. A coaching institute or a paediatric clinic needs verifiable parental consent under section 9 and Rule 10.
• Patients send reports or prescriptions on WhatsApp. The DPDP Act for healthcare has no separate rulebook, but that clinic's notice and storage need a proper review.
• Clients send PAN cards and bank statements. A Surat CA practice should check its retention against the DPDP Act for CA firms and the tax laws that set their own periods.
• You bought or rented a contact list and want to message it.
• You've had a breach, or think you might have.

What I'd skip for now: if a person answers every WhatsApp by hand and you don't reuse the data, you don't need a consent platform before May 2027. A clear notice and a STOP that works will do more.

We put AI agents on top of the tools you already use, with a person approving every action, and we'd build yours around this checklist. See how our support agents work at /automation/support/ and how we build agents at /ai-agents/. If you already run a bot, email tea@dizilus.com with what it does and I'll tell you which items it misses.