When a comment-to-DM automation records who commented, or a DM link asks for a phone number, you are handling personal data. In India, that brings in the Digital Personal Data Protection Act, 2023 (DPDP Act). You do not need a legal team to follow its spirit, but you should know the basics.
This is general information, not legal advice. For your specific situation, speak to a lawyer.
What counts as personal data here
- Instagram usernames and IDs
- What people wrote in comments and DMs
- Phone numbers and emails collected through forms or WhatsApp
- Order and address details
The main ideas of the Act
Purpose. Collect personal data for a clear, lawful purpose and use it for that purpose. If someone commented to get a price list, using their username to send the price list is the purpose.
Notice and consent. When you ask for data, such as a phone number on a form, tell people what you will use it for, in clear language, and get their consent.
Minimum data. Ask only for what you need. A catalogue does not need a date of birth.
Accuracy and security. Keep data reasonably safe and correct.
Retention. Do not keep data forever. Delete it when the purpose is done or consent is withdrawn.
Rights. People can ask what you hold about them, ask for corrections, and ask for deletion. Have a way to respond, such as an email address.
Practical steps for Instagram sellers
- Add one line to your forms: "We'll use your number to send your order details and offers on WhatsApp. Reply STOP any time."
- Do not buy or sell lists. Ever.
- Limit access. Only people who need the contact list should see it.
- Delete old data. For example, clear contact exports older than a year.
- Publish a privacy policy on your website and link it from forms.
- Name a contact for privacy questions.
What your automation tool should do
The tool is processing data on your behalf. Check that it:
- Explains what it stores in a privacy policy
- Offers deletion of your data and your customers' data
- Keeps tokens and passwords secure
- Does not reuse your contacts for its own marketing
DM Flow's handling is described in its privacy policy and data deletion page.
Frequently asked questions
Does DPDP apply to small businesses?
The Act applies broadly. Some obligations are heavier for large "significant" data fiduciaries, but the basic duties apply to everyone processing personal data digitally.
Is a public comment personal data?
Yes. It is linked to an identifiable person.
Can I send offers to people who gave their number?
If they consented to offers, yes. If they only gave it for an order, ask first.
When do the rules apply?
The Act was passed in 2023, with rules notified by the government to bring it into force in phases. Check the current status before relying on specific dates.