The WhatsApp Group and the Law: When Does Digital Conversation Become Legally Actionable?
Wishing one another on birthdays and other occasions, sharing messages and wisdom, debating or discussing current issues, and announcing one's opinions and announcements over WhatsApp is more or less nothing new. These all are some of the latest versions of traditional communication without which our lives seem to be an un-escaped miss. Therefore, to state the obvious, WhatsApp is the platform that offers a group of good friends (as decided by the user) to communicate over – sharing information or ideas over a digital platform.
The practice of sharing allegations, images, videos, and hyperlinks through WhatsApp groups on an indiscriminate basis is becoming more and more prevalent and naturally raises the pertinent question: When does the ordinary digital conversation become actionable?
To answer this question, we need to differentiate between what is obnoxious, what is hurtful and what is illegal. There may be overlap between them, but they are not the same thing.
1. The Legal Distinction Between Offensive Expression and Unlawful Communication
The law does not impose on the individual an obligation to communicate respectfully. Criminal liability cannot be founded upon irritation or disapproval. It must be one that is defined by law.
Where a message simply contains info that is forbidden by law, a CRIMINAL threat or libellous imputations, matters are substantially different. Take the defamation provision of the Bharatiya Nyaya Sanhita, 2023 (BNS), Section 356, for instance. To arrive at the conclusion that a certain commentary constitutes defamation, one must look at the nature of the imputation which is attributed, the knowledge and intention concerning the reputational injury and the statutory exception as applicable. If the recipient finds the commentary offensive, it does not necessarily mean that it is defamatory. Similarly, the protection granted to criticism or fair remark cannot be interpreted as an unrestrained license to publish harmful accusations regardless of their veracity, rationale, or sincerity.
In addition, pornographic and sexually explicit material sent electronically is governed by a separate law. The Information Technology Act, 2000, has Sections 67 and 67A that relate to the publication or distribution of pornographic or sexually explicit material, respectively. Section 67B relates to certain kinds of sexually explicit content involving minors. These provisions are not just different in wording but also in material substance.
In short, there are different regulations that regulate the publication or transmission of sexually explicit and pornographic material electronically. Sections 67 and 67A of the Information Technology Act of 2000 deal with the publication or transmission of such materials, while Section 67B deals with certain kinds of sexually explicit material involving children. The application of these clauses depends on content and circumstance.
2. Forwarding Is an Act, Not Merely a Gesture
The idea that a WhatsApp forward is just something that has been "shared" tends to downplay the importance of the act. Forwarding can increase the audience for a piece of content, make it easier for it to spread, and, in certain situations, even help someone commit a crime. The issue of accountability for its future dissemination is not always resolved by the fact that the original content was produced by someone else.
This is exemplified in cases of copyright infringement. The Copyright Act of 1957 protects original literary, artistic, musical and other works. While Section 63 of the Act prescribes the criminal punishment for any act committed with intent to infringe on copyrighted work or for knowingly aiding or abetting such infringement, Section 51 defines what constitutes the infringement of copyright. The simple act of sharing a link to a movie, a book, a software program or any other work protected by the Act will not always necessarily amount to 'crystal clear' criminal responsibility; an investigation into the nature of the content, rights owned, nature of behaviour of the person sharing and required law must be made. A messaged group is not something that questions or impacts the rights of copyright owners.
If a recipient sends such content without checking it, they might unintentionally aid in its spread. Depending on the relevant statutory elements and supporting documentation, it is a different matter entirely whether or not that individual faces legal obligation. However, indiscriminate sending is not a responsible practice just because there is no criminal culpability in a given situation. Even though digital communication does not in and of itself create a legal responsibility, it does create an ethical duty of care.
3. Freedom of Speech, Intermediary Obligations and Group Administrator Liability
Article 19(1)(a) of the Constitution provides for the right to freedom of speech and expression. But sub-article 19(2) provides for reasonable restrictions on this right, and these restrictions, as they have been provided, are reasonable restrictions under the following grounds, namely: – public order, decency or morality, and defamation. So, the right is not absolute.
The due diligence specifications for intermediaries are contained in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended. Read along with these are the prescribed obligations of due diligence which must be placed into the context of the intermediary versus that of the criminal wrongdoer of a user or group admin. Even a consent to a malevolent post being posted on a WhatsApp group cannot itself be deemed a general violation of the rules.
In addition, the role and liability of a group admin are matters that should be pondered upon. Merely having the power to include or exclude members from the group, without proof of being responsible for every post made by a certain participant, cannot be grounds for holding an admin responsible for any offensive post made by any of the others. In Kishor v. State of Maharashtra, the Bombay High Court considered the question of the liability of an admin for offensive posts made by another member of the group.
This finding does not mean an administrator will always be free from criminal liability. There could be a different situation if the administrator personally creates, distributes, enables or aids in publication of illegal material or even conduct that constitutes a crime. The difference is the existence of duties under the control of the administrator as opposed to duties under their own lawful conduct.
4. The Case for Responsible Digital Conduct
The law has the ability to recognise wrongful behaviour and impose a sanction, but alone it cannot ensure that all use of the medium is thoughtful, proportionate and respectful. It’s mainly the audience that has that obligation.
False allegations, unapproved copyrighted content, personal images, fake links, and content that violates the dignity and rights of another should not be part of a WhatsApp group. Admins can assist by setting out what a group's aims are, banning abuse, and reacting to something that needs reacting to. To post content, members should exercise their judgement, particularly if the content is related to another person's reputation, privacy, or finance.
The principle is quite straightforward: ease of transmission should not be mistaken for lack of responsibility. There remains a potential for illegal behaviour and rights breaches in what is essentially a private gathering. Nevertheless, it is essential to think about the details in each case and the factors of the law before asserting any legal consequences.
Think before you type. Verify before you forward. Respect before you post.
Related Blogs
Executive Summary:
A misleading video of a child covered in ash allegedly circulating as the evidence for attacks against Hindu minorities in Bangladesh. However, the investigation revealed that the video is actually from Gaza, Palestine, and was filmed following an Israeli airstrike in July 2024. The claim linking the video to Bangladesh is false and misleading.
Claims:
A viral video claims to show a child in Bangladesh covered in ash as evidence of attacks on Hindu minorities.
Fact Check:
Upon receiving the viral posts, we conducted a Google Lens search on keyframes of the video, which led us to a X post posted by Quds News Network. The report identified the video as footage from Gaza, Palestine, specifically capturing the aftermath of an Israeli airstrike on the Nuseirat refugee camp in July 2024.
The caption of the post reads, “Journalist Hani Mahmoud reports on the deadly Israeli attack yesterday which targeted a UN school in Nuseirat, killing at least 17 people who were sheltering inside and injuring many more.”
To further verify, we examined the video footage where the watermark of Al Jazeera News media could be seen, We found the same post posted on the Instagram account on 14 July, 2024 where we confirmed that the child in the video had survived a massacre caused by the Israeli airstrike on a school shelter in Gaza.
Additionally, we found the same video uploaded to CBS News' YouTube channel, where it was clearly captioned as "Video captures aftermath of Israeli airstrike in Gaza", further confirming its true origin.
We found no credible reports or evidence were found linking this video to any incidents in Bangladesh. This clearly implies that the viral video was falsely attributed to Bangladesh.
Conclusion:
The video circulating on social media which shows a child covered in ash as the evidence of attack against Hindu minorities is false and misleading. The investigation leads that the video originally originated from Gaza, Palestine and documents the aftermath of an Israeli air strike in July 2024.
- Claims: A video shows a child in Bangladesh covered in ash as evidence of attacks on Hindu minorities.
- Claimed by: Facebook
- Fact Check: False & Misleading
Executive Summary
A picture of Mohan Bhagwat is going viral on social media, showing him allegedly laying the foundation stone of a so-called “52nd Shakti Peeth” named Bharatdurga. Users are claiming that the RSS chief insulted Sanatan Dharma by creating a new Shakti Peeth in Nagpur. Research by CyberPeace Research Wing found that the claim is false. The viral image is AI-generated, and Mohan Bhagwat did not inaugurate any “52nd Shakti Peeth.” In reality, he laid the foundation stone of the Bharatdurga Temple.
Claim
An X user named Sandeep Dev shared the viral image and alleged that after creating “fake Shankaracharyas,” the RSS had now introduced a new form of Goddess Durga called “Bharat Durga” and declared it the 52nd Shakti Peeth. The post further claimed that the RSS was redefining Hinduism and creating new religious sites.
Fact Check
To verify the claim, we searched relevant keywords and found reports published on April 24, 2026, by India TV and Navbharat Times. According to these reports, Mohan Bhagwat laid the foundation stone of the world’s first Bharatdurga Temple in Nagpur during a ceremony organized at the Jamtha campus of Dr. Abaji Thatte Seva and Research Institute. Several prominent saints and religious leaders attended the event. Importantly, none of the reports described the temple as the “52nd Shakti Peeth.”
Further research led us to the full video of the foundation ceremony uploaded on the YouTube channel of Devendra Fadnavis. The stage backdrop and video thumbnail clearly mention “Bharatdurga Temple Foundation Ceremony.” However, the viral image frame was not visible anywhere in the authentic footage.
We also analyzed the viral image using AI detection tools, which indicated that the image was AI-generated.
Conclusion
Our research confirms that the claim about Mohan Bhagwat laying the foundation of a “52nd Shakti Peeth” is false. The viral image is AI-generated. In reality, he participated in the foundation ceremony of the Bharatdurga Temple in Nagpur.
Somewhere in a compliance meeting right now, someone is saying "we have eighteen months, we're fine." That sentence is doing the same thing a snooze button does at 6 a.m.: technically buying time, while quietly making the actual wake up call worse. India's data protection law just started its countdown, and the 18 months everyone keeps citing is not a grace period to procrastinate through. It is closer to a runway before takeoff. Runways exist for one purpose: building up speed until the plane has no choice but to leave the ground. Standing still on one is not a strategy.
What actually got notified, and when
On 13 November 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, giving operational shape to the Digital Personal Data Protection Act that Parliament had passed back in August 2023. Alongside the Rules themselves, MeitY issued a separate Enforcement Notification setting out exactly when different provisions kick in, and a further notification establishing the Data Protection Board of India, headquartered in the National Capital Region with four members. The final Rules followed a genuinely deliberative process, MeitY had floated draft Rules in January 2025 for public consultation and received 6,915 individual inputs from startups, industry bodies, civil society groups, and citizens before finalising the version now in force. The headline structural decision, and the one causing the most confusion in boardrooms, is that the Rules do not commence all at once. They commence in three distinct phases spread across eighteen months, and different obligations become legally binding at each stage.
The phased timeline, laid out plainly
That third date, 13 May 2027, is the one that matters most for the vast majority of organisations, since it is where the bulk of actual operational obligations, the parts that touch product design, customer facing notices, and breach response, become enforceable. Legal commentary tracking the rollout has been consistent that this is described as a hard deadline with no grace period expected once it arrives, since the Data Protection Board is already operational and can begin receiving complaints well before Phase 3 obligations formally take effect.
Why "later" is a genuinely expensive plan
The financial stakes attached to Phase 3 non-compliance are not modest. The Schedule to the DPDP Act sets fixed penalty ceilings rather than turnover linked fines, which sounds gentler than Europe's GDPR model until you look at the actual numbers. Failure to implement reasonable security safeguards that results in a data breach can draw a penalty of up to 250 crore rupees per instance, the single highest tier in the Schedule. Failing to notify the Board or affected individuals after a breach occurs can draw up to 200 crore rupees, as can non-compliance with the Act's specific protections for children's data. Because these are assessed per instance rather than as a single capped exposure, a single incident that trips more than one obligation, say, inadequate safeguards that also delay breach notification, can compound into penalty exposure running into hundreds of crores from one event. All penalties collected go to the Consolidated Fund of India rather than to affected individuals directly, meaning the deterrent is aimed squarely at organisational behaviour, not compensation.
The part everyone keeps underestimating: this is not just a legal department problem
Perhaps the most consequential shift buried inside the DPDP framework is who actually has to own it. Reading the Rules as a checklist for the legal or privacy team alone misses how far the obligations actually reach. Building a compliant consent lifecycle touches product design. Security safeguards touch cybersecurity and IT infrastructure directly. Retention and deletion logic touches data governance and engineering. Third party risk review touches procurement. Breach preparedness touches internal audit and incident response. And increasingly, as organisations deploy AI systems that process personal data, AI governance enters the picture too, since a model trained or fine tuned on personal data inherits the same DPDP obligations as any other processing activity.
That cross functional reality is where most readiness programmes currently fall short. Treating DPDP compliance as a documentation exercise, updating a privacy policy PDF and calling it done, produces the appearance of compliance without the operational substance a Data Protection Board investigation would actually test. A breach response plan that exists only on paper and has never been rehearsed will not hold up against the 72 hour data principal notification window the Rules impose once Phase 3 lands. A consent mechanism bolted onto a website without corresponding backend logic to honour withdrawal requests will not satisfy an actual audit.
What a serious readiness posture looks like right now
Organisations that are ahead of this curve are already treating the eighteen month window as three overlapping workstreams rather than one deadline to hit at the end.
- The first is discovery: mapping what personal data exists, where it flows, who owns each system that touches it, and why it is collected in the first place, since compliance is structurally impossible without first knowing what you are protecting. This stage typically surfaces uncomfortable findings, shadow data sets nobody formally owns, vendor integrations nobody fully mapped, legacy systems still holding data well past any reasonable retention justification.
- The second is build: standing up the actual mechanisms, consent flows that can genuinely honour a withdrawal request end to end, rights request handling that does not depend on a single overworked employee checking an inbox, retention and deletion logic wired into the systems themselves rather than described only in a policy document, and security controls proportionate to the sensitivity of what is being protected.
- The third is proof: generating the internal evidence, audit trails, documented decisions, tested response procedures, that demonstrates governance was real rather than retrofitted after the fact. A Data Protection Board investigation, when it eventually happens, will not be satisfied by a well written policy; it will look for evidence that the policy was actually operational.
The actual question worth asking
The right question was never "when does DPDP become enforceable." Phase 1 already answered that; the law is live, and the Data Protection Board already exists and can act. The better question, the one worth taking into any leadership review between now and May 2027, is simpler and considerably less comfortable: will the organisation actually be ready when each phase's obligations become operational, or will readiness be assembled in a scramble once the deadline stops being theoretical. 18 months sounds long right up until the week it does not, and by the time Phase 3 lands, "we'll get to it" will no longer be a sentence any organisation gets to finish.
References
- Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, notified 13 November 2025. Press Information Bureau, "Digital Personal Data Protection Rules, 2025 Notified," 14 November 2025. https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
- Shardul Amarchand Mangaldas & Co, "Enforcement of the DPDP Act and notification of the DPDP rules." https://www.amsshardul.com/insight/enforcement-of-the-dpdp-act-and-notification-of-the-dpdp-rules/
- S&R Associates, "India's Digital Personal Data Protection Regime Takes Effect." https://www.snrlaw.in/indias-digital-personal-data-protection-regime-takes-effect/
- Khurana & Khurana, "MeitY Notifies Rules Operationalising The DPDP Framework." https://www.khuranaandkhurana.com/update-meity-notifies-rules-operationalising-the-dpdp-framework-in-india
- Exchange4media, "DPDP Act 2025: Penalties for violations can reach Rs 250 crore." https://www.exchange4media.com/digital-news/dpdp-act-2025-penalties-for-confirmed-violations-can-reach-rs-250-crore-149360.html
- Seclore, "DPDP Rules 2025: India's Complete Compliance Guide." https://www.seclore.com/fundamentals/dpdp-rules-2025-compliance-guide/
