That WhatsApp campaign you ran last month? It could be a problem now.
You ran a sale campaign. You collected phone numbers on a Google Form. You sent WhatsApp messages to everyone who filled it. Sounds normal, right? But under the new DPDPA law, this is exactly where trouble starts. If you did not tell customers why you are collecting their number — and get their clear yes — you may already have a problem. And you may not even know it yet.
Say you sell skincare online. A customer fills your Instagram lead form during a sale. You save their number. You add them to a WhatsApp broadcast list. You send offers every week. Under DPDPA, you needed their clear yes before doing all this. Same for returns — when a customer returns a product, you collect their address and bank details. That information must be deleted once the return is done. Keeping it forever is not allowed. Small steps today save big fines later.
Add a clear checkbox to your lead form asking for WhatsApp permission.
Delete phone numbers of customers who have not bought in over one year.
Check if your business is ready. Takes 3 minutes. Visit saralprivacy.com/assessment
“Bad campaign hygiene can become a privacy problem long before it becomes a legal problem.”
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
