For many small businesses in India, WhatsApp is the shop counter, the support desk and the order book. That makes the account a target and the chats a store of personal data. Meta's own guidance starts with a six-digit two-step verification PIN, and India's DPDP rules allow penalties of up to ₹250 crore for weak safeguards. This guide covers account security, Meta's data rules, consent and what to do if something goes wrong.
Why WhatsApp needs a security plan
A WhatsApp Business number collects names, phone numbers, addresses, order details and sometimes photos of documents. If someone takes over the account, they can impersonate the business to every customer in the chat list. If staff share a single phone, there is no record of who said what or who saw which data.
Social engineering is the main threat. The UK Cyber Security Breaches Survey 2025/2026 found phishing in 38% of businesses and impersonation in 12%. On WhatsApp, the usual trick is a message asking staff to share a registration code or click a link, so account settings and staff habits matter more than technical tools.
Lock down the account
Meta's security best practices for businesses start with two-step verification, which asks for a six-digit PIN whenever the number is registered on a new device. Turn it on under Settings, Account, Two-step verification, and store the PIN in the company password manager rather than with one person.
Next, control access. Meta advises limiting access to people who need it, reviewing linked devices regularly and removing any you do not recognise, and changing the PIN when someone leaves. Rather than sharing the phone or login, use Meta Business Suite to share the inbox with assigned roles and permissions. Keep the app and the phone's operating system on automatic updates.
- Two-step verification on, PIN kept in the company password manager
- Linked devices reviewed weekly; unknown ones removed
- PIN changed whenever a team member leaves
- Shared inbox through Meta Business Suite roles, not a shared phone
- Automatic updates for WhatsApp Business and the phone OS
WhatsApp's built-in protections
WhatsApp added three protections in April 2023. Account Protect may ask you to confirm on your old device before the account moves to a new one, which warns you of takeover attempts. Device Verification runs background checks to protect the account if the phone is infected with malware. Automatic Security Codes use key transparency to confirm a chat is secure without manual code comparison.
These features help, but they assume the business phone itself is controlled. Use a dedicated company phone for the business number, protect it with a screen lock, and do not install unrelated apps on it. If the phone is lost, follow the same steps as a compromised account straight away.
Meta's rules on customer data
The WhatsApp Business Messaging Policy, last updated on 23 September 2026, sets hard limits. Businesses must not share, or ask people to share, full payment card numbers, financial account numbers, personal ID card numbers or other sensitive identifiers. Data received from WhatsApp, other than message content, may be used only as reasonably necessary to support messaging with that person, and information from one customer's chat must not be shared with another customer.
Build processes around those rules. Send payment links to a secure checkout instead of asking for card details in chat, collect ID documents through a proper upload form if you need them, and train staff never to forward one customer's details to another. WhatsApp can limit or remove access for policy violations.
Consent, opt-out and message types
Meta requires businesses to get opt-in before messaging people. The person must be told clearly that they are opting in to messages from your business, and your business name must be stated. Opt-in can be collected by website, SMS, IVR or a paper form, and you must honour requests to stop or block. If quality stays low, WhatsApp will rate-limit the business.
The platform's pricing rules also shape what you can send. Since 1 July 2025, Meta charges per message rather than per conversation. Free-form replies are only possible inside a customer service window, so templates must be used for anything else.
| Rule | Detail | Source |
|---|---|---|
| Customer service window | 24 hours from the customer's last message | Meta pricing docs |
| Free entry point window | 72 hours after a Click to WhatsApp ad or Page button chat, if you reply within 24 hours | Meta pricing docs |
| Template categories | Marketing, utility, authentication | Meta pricing docs |
| Billing model | Per message since 1 July 2025 | Meta pricing docs |
| Opt-in | Required before messaging; business name must be clear | Meta opt-in guidance |
| Sensitive identifiers | Never request full card, account or ID numbers | Business Messaging Policy |
DPDP duties for chat data
India's Digital Personal Data Protection Rules were notified on 14 November 2025 with an 18-month phased rollout. Under them, a business that suffers a personal data breach must inform affected individuals without delay, in plain language, explaining what happened, the likely impact, the steps taken and who to contact. Requests to access, correct, update or erase data must be handled within 90 days.
For WhatsApp, that means knowing where chat data goes. If chats are exported to a CRM or a spreadsheet, include those copies in your data map, set a retention period, delete old exports and restrict who can download them. The maximum penalty for failing to keep reasonable security safeguards is ₹250 crore.
If the account is compromised
Meta's guidance is to re-verify the phone number to log out unauthorised users, reset the two-step PIN, remove unfamiliar linked devices and report impersonators in the app. Then warn customers through your other channels that messages from the number may not have come from you.
Indian businesses should also check CERT-In obligations. Its April 2022 directions require covered entities to report cyber security incidents, including identity theft and phishing, within six hours, and to keep logs for 180 days. XDQ Labs builds and secures WhatsApp-connected systems for small businesses, and the checklist above is a sound first step for any team.
Frequently asked questions
How do I secure my WhatsApp Business account?
Turn on two-step verification with a six-digit PIN, store the PIN in a password manager, review and remove unknown linked devices, change the PIN when staff leave, use Meta Business Suite roles instead of a shared phone, and keep the app and phone updated.
Can a business ask for card or Aadhaar numbers on WhatsApp?
No. The WhatsApp Business Messaging Policy bars businesses from asking people to share full payment card numbers, financial account numbers, personal ID card numbers or other sensitive identifiers. Use a secure payment link or upload form instead.
Do I need customer consent to message on WhatsApp Business?
Yes. Meta requires opt-in before you message someone. The person must be told clearly they are opting in to messages from your business, and your business name must be stated. You must also honour requests to stop or block.
What should I do if my WhatsApp Business account is hacked?
Re-verify your phone number to log out the intruder, reset the two-step PIN, remove unfamiliar linked devices and report impersonators in the app. Warn customers through other channels. Indian entities covered by CERT-In's directions must report incidents within six hours.
Sources
- Protecting your business on WhatsApp: security best practices, WhatsApp Business (Meta), 2026
- Pricing on the WhatsApp Business Platform, Meta for Developers, 2026
- Digital Personal Data Protection Rules, 2025: backgrounder, Press Information Bureau, Government of India, 2025
- Cyber security breaches survey 2025/2026, GOV.UK (Department for Science, Innovation and Technology), 2026
- New security features: Account Protect, Device Verification, Automatic Security Codes, WhatsApp Blog, 2023
- WhatsApp Business Messaging Policy, WhatsApp (Meta), 2026
- Get opt-in for WhatsApp, Meta for Developers, 2026
- The CERT-In Cyber Security Directions: More Questions Than Answers, Cyril Amarchand Mangaldas, 2022
