The DPDP Act does not ban WhatsApp or spreadsheets, but it expects you to know why you collect personal data, keep it secure, and limit who sees it. Use a business account, separate work numbers, avoid forwarding documents, set deletion habits and write down which vendors handle messages.
- Personal phones and groups are the biggest blind spot.
- Share the minimum, and avoid forwarding documents with personal details.
- Whether a use is lawful depends on your facts; take advice for sensitive data.
Why WhatsApp needs attention
Messaging apps are fast and familiar, which is why personal data ends up in them: parent groups with phone numbers, patient reminders, ID photos, fee screenshots. The data is often spread across staff phones with no central control.
Common patterns to review
- One phone number shared by several staff members
- Large groups that expose members’ phone numbers to each other
- Medical reports, results or ID documents shared in chats
- Lead lists exported into spreadsheets that anyone can edit
- Marketing broadcasts to numbers collected for another purpose
Safer habits to adopt
- Use a business account on an official number, not a personal one.
- Keep a list of who has access to the account and remove people who leave.
- Share the minimum: avoid forwarding documents that contain personal details.
- Use broadcast lists or a business API rather than open groups where possible.
- Set a rule for deleting old chats, media and exports.
- Ask for clear opt-in before sending promotional messages, and honour opt-outs.
Know who else touches the data
If you use a WhatsApp Business API provider, CRM or bulk-messaging tool, that vendor may act as a Data Processor. Record what each vendor does with the data and have a contract that covers security.
Take extra care with health and children’s data
Reports, prescriptions and student details deserve stricter habits. The Act and Rules include special provisions for children’s data, and clinics and schools may have sector-specific duties. Read our guides for clinics and schools.
Frequently asked questions
Can I add parents to a WhatsApp group?
You can, but consider whether each parent must see others’ phone numbers. A broadcast list shares messages without exposing numbers, and the notice you give should explain the purpose.
Is sending a prescription by WhatsApp allowed?
The Act has no tool-specific ban, but health data is sensitive and sector rules may apply. Use an approved channel where you can and take professional advice.
Sources
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.