Fluxx Tech
Running customer conversations on WhatsApp and Instagram means holding a lot of personal information: phone numbers, names, addresses, order history, photographs, sometimes health or financial details mentioned in passing.
Two sets of rules apply: India’s data protection framework (the DPDP Act and the rules made under it), and Meta’s own platform policies. Both have changed and will change again.
This article is not legal advice. It sets out the practical questions to work through, and you should confirm your obligations with a legal adviser who knows your sector.
Two different things called consent
Platform consent. Meta requires opt-in before business-initiated WhatsApp messages, and restricts unsolicited outreach on Instagram. Breaking these rules gets your number restricted or your account disabled.
Legal consent. Data protection law concerns how you collect, use, store and share personal data, and what you tell people about it. Having a customer’s phone number because they messaged you is not the same as having the right to use it for marketing.
Comply with both. They overlap but are not the same.
Collecting consent properly
Good practice, generally:
• Ask clearly, in plain language, for a stated purpose
• Separate consent for service messages and marketing messages
• Never pre-tick a box
• Record what they agreed to, when, and how
• Make withdrawal as easy as giving it
• Do not make an unrelated service conditional on marketing consent
Workable opt-in points: a WhatsApp button on your site, a QR at your counter, an unticked checkbox at checkout, a question during a conversation, a click-to-WhatsApp ad.
Never: buy a list, scrape numbers, import a contact book, or add people who messaged once about something else.
Honour opt-outs immediately
• STOP, UNSUBSCRIBE, “don’t message me” and their Tamil equivalents should all work
• Automatic, not dependent on someone noticing
• Applies across channels: a person who opts out on WhatsApp should not start receiving Instagram outreach
• Keep a record of the opt-out, which is itself a legitimate reason to retain their number
• Service messages they still need, such as an order update, are a separate category; be careful not to use that as a loophole for marketing
Collect less
The easiest way to reduce risk is to hold less data.
• Do not ask for date of birth, address or ID unless you need it
• Do not store ID documents in chat threads; move them to a controlled system
• Be careful with health information: clinics, pharmacies and labs should treat it with far more care than a retailer treats a delivery address
• Do not screenshot conversations into WhatsApp groups
• Avoid storing payment details in chat
Ask: if this data leaked, what harm would it cause? If the answer is “a lot”, either do not collect it or protect it properly.
Access control inside your team
• Role-based access: agents see their conversations, not everything
• No shared logins; every action attributable to a person
• An audit trail of who viewed and exported what
• Remove access the day someone leaves
• Restrict bulk export to one or two people
• Agents on personal phones: decide your policy, and apply it
The most common real-world leak is not a hacker. It is an ex-employee with an export of your customer list.
Retention
Decide how long you keep conversations and why:
Data | Typical consideration |
Conversation history | Useful for service; set a limit rather than keeping forever |
Order and billing records | Statutory retention periods apply; check with your CA |
Marketing consent records | Keep while you rely on the consent |
Opt-out records | Keep, so you do not message them again |
Photos and documents in chat | Move to a controlled store or delete |
Write the policy down, apply it automatically where you can, and review it annually.
Rights requests
People may ask what data you hold about them, ask for corrections, or ask you to delete it. Decide in advance:
• Who receives such a request
• How you verify the person’s identity
• How you find all their data across your tools
• Your response time
• What you are legally required to keep despite a deletion request
A request arriving with no process is how a simple matter becomes a complaint.
Questions to ask your messaging vendor
1. Where is the data stored, and in which country?
2. Is it encrypted in transit and at rest?
3. Who at the vendor can access our conversations?
4. Is there role-based access and an audit log for our team?
5. Do you sign a data processing agreement?
6. Can we export everything, in a usable format?
7. What happens to our data if we cancel, and after how long is it deleted?
8. Do you use our customer data to train models, and can we opt out?
9. Are sub-processors disclosed, including any AI providers?
10. What is your breach notification process and timeline?
Get the answers in writing before signing. Question 8 matters more than it used to.
A practical checklist
• ☐ Privacy policy published, in plain language
• ☐ Opt-in captured and recorded at every entry point
• ☐ Separate consent for marketing
• ☐ Automatic opt-out handling, across channels
• ☐ Role-based access, no shared logins
• ☐ Retention policy written and applied
• ☐ Data processing agreement with your vendor
• ☐ A named person responsible for data questions
• ☐ A process for rights requests
• ☐ Access removed promptly when staff leave
• ☐ Legal review of the above for your sector
Frequently asked questions
Does the DPDP Act apply to a small business? Obligations depend on the rules in force and how you handle personal data. Take advice rather than assuming you are too small.
Can I message a customer who contacted me once? Replying to their enquiry is one thing; sending marketing later is another, and generally needs consent. Check both the law and Meta’s policies.
Do I need written consent? You need to be able to demonstrate consent. A recorded, timestamped opt-in in your system is normally more practical than paper.
