The nonprofit needed a yes, with proof, from the parents of about 80,000 students. Three months later, 82% of records had a parent's consent, given on WhatsApp or an automated call, with no one from the organisation phoning. Field agents helped with another 9%. The last 9% belonged to families nobody could reach, and the organisation deleted their personal details.
The method is easy to copy: ask the cheapest way first, and spend staff time only on whoever is left. The organisation did this with Commons Trust. We have not named it.
What made this hard
In most organisations like this, the problems are familiar. Phone numbers are collected at enrolment, often years earlier. Numbers change, a family shares one phone, and some parents use basic phones that cannot open a link.
And the data is about children. From 13 May 2027, before processing a child's personal data, an organisation needs verifiable consent from her parent (s. 9(1)). Students who are 18 or older are adults and give consent themselves.
Three waves, each for the people the last one missed
- WhatsApp campaign. Every parent first got the consent request on WhatsApp, to read and answer on her own phone.
- Automated voice call (IVR). Parents who had not answered on WhatsApp got an automated call. A call reaches people who do not read messages or who use a basic phone.
- Field agent's call. For parents still not reached, a field agent called. During the call, the agent sent a WhatsApp message to the parent's phone so she could give consent herself.
The third wave is the one worth copying. The agent triggered a WhatsApp message instead of recording a yes. The parent took the action herself, so the record shows her own consent. That fits what the Act asks for, a clear affirmative action by the person consenting (s. 6(1)), and the organisation has to be able to prove it (s. 6(10)).
Why this order, in our view: a WhatsApp message is the cheapest way to reach a family and an agent's time the dearest, so each wave went only to the families the last one missed.
What every request carried
Every request, on every channel, carried a properly formed notice that told the parent:
- What data, and why. The data listed item by item, with each purpose it would be used for (s. 5(1)(i), Rule 3(b)).
- How to withdraw, including a link to the parent's consent page (the Data Principal portal), where she can withdraw consent herself. Withdrawal must be as easy as giving consent (s. 6(4)).
- How to complain: the organisation's grievance route, and her right to go to the Data Protection Board (s. 5(1)(ii)–(iii), s. 13).
A properly formed notice also tells her how to use her other rights, such as access, correction and erasure (s. 5(1)(ii), s. 13), gives contact details for a person who can answer her questions (s. 6(3)), and lets her choose to read it in English or any language listed in the Eighth Schedule to the Constitution (s. 5(3), s. 6(3)). Our guide to writing a DPDP notice has sample text.
Two details are worth planning for. Our view: parents who agreed on a voice call should also be able to withdraw by phone. Section 6(4) asks for comparable ease, and a web link may not give it. And the notice must give a link to the organisation's own website or app through which she can withdraw, use her rights and complain, and describe any other means (Rule 3(c)); if the portal sits elsewhere, reach it from there.
The check this story does not cover
A WhatsApp tap or a keypress shows that someone said yes. For a child's data, Rule 10 also requires due diligence, before processing, that the person saying yes is an identifiable adult, using reliable identity and age details the organisation already holds or that she provides, for example through DigiLocker.
We have left that step out of this story, so don't read the three waves as covering it. If you plan a campaign like this, choose your method before the first message goes out. Our guide on children's data sets out the options.
The 9% nobody could reach
After three waves, about one record in eleven still had no answer. The organisation deleted all personal identifiers from those records instead of chasing further.
A parent who never answered gave no consent in this campaign. Some may have agreed at enrolment. Our view: where that earlier consent cannot be shown and the family cannot be reached, it is reasonable to treat the purpose as no longer served, and from 13 May 2027 the Act then requires erasure unless another law requires the data to be kept (s. 8(7)(a)). Keeping a child's details with no consent and no way to reach her family serves no programme and leaves a child's details exposed.
With every identifier gone, those records should no longer point to anyone, and the Act covers only data about a person who is identifiable (s. 2(t)). Check that rather than assume it: could a mix of the remaining fields still lead back to one child? Copies held by the messaging or calling vendors, and in backups, need the same treatment (s. 8(7)(a) and (b)).
Where it ended
Every record ended in one of two places: carrying a recorded consent with its notice, or stripped of everything that identifies a person. That is what we mean by DPDP-ready, and it is a fair point for a funder to ask every partner to reach before May 2027.
Most duties under the Act and Rules start on 13 May 2027 (the notification under s. 1(2); Rule 1(4)), so we do not call this organisation compliant with duties not yet in force. But the burden of proof sits with the organisation (s. 6(10)), and building proof for tens of thousands of families takes months. Our view: it is easier now than in April 2027, when vendors and field teams are likely to be stretched.
What you can take into your own organisation
- Count your contacts. How many numbers you hold, how many are on WhatsApp, and how many are basic phones.
- Write one notice and use it in every channel.
- Go cheapest first. Send each wave only to the people the last one missed.
- Let the parent act herself. On assisted calls, explain, then send her the request on her own phone.
- Give phone users a phone route to withdraw.
- Settle the parent check before the first message goes out (Rule 10).
- Decide early what happens to people you cannot reach. Check whether another law requires you to keep anything, and keep the processing logs Rule 8(3) will require from May 2027.
- Name one person who owns the list of who agreed.
If you fund NGOs
Questions worth putting to your partners:
- How will you reach parents who do not use WhatsApp?
- Who records the yes: the parent, or your staff?
- Can a parent withdraw without calling your office?
- How do you check that the person saying yes is the parent?
- What happens to the records of families you cannot reach?
If your organisation holds data about children and their parents and you want to know how far you are from this point, take our readiness check or write to us for a first call. More on taking consent in the field is in our guide to informed consent from beneficiaries.
This case study explains the law as of 26 October 2026; it is not legal advice.
Questions people ask
Does a WhatsApp yes count as verifiable parental consent?
Not on its own. A reply shows that someone agreed. For a child's data, Rule 10 also requires due diligence, before any processing, that the person consenting as the parent is an identifiable adult. The organisation can rely on reliable identity and age details it already holds, or details she provides, including through a virtual token such as one issued via DigiLocker (Rule 10(1)(b)(ii), Rule 10(2)(b)). The reply carries the consent; the identity and age check is a separate step you must plan for.
Is consent collected before 13 May 2027 still good after that date?
Section 5(2) covers people who consented before the Act commenced. You must give each of them a notice as soon as reasonably practicable, covering the data and purpose, how to withdraw and exercise rights, and how to complain to the Board, and you may keep processing until the person withdraws (s. 5(2)(b)). Which commencement date section 5(2) refers to is not settled, and it does not replace the Rule 10 parent check. Our view: if your original notice already carried everything section 5(2)(a) lists and you can prove it was received, a fresh notice adds little, but record that reasoning. Confidence: low to medium.
Could a field agent simply note down the parent's spoken yes instead?
The Act prescribes no medium for consent. It asks for a clear affirmative action by the person herself (s. 6(1)) and puts the burden of proving notice and consent on you (s. 6(10)). Our view: a yes typed in by a staff member is weaker evidence, because the record shows the agent's action, not the parent's. Let the parent act on her own phone wherever she can, and keep agent-entered consent for people with no other route.
Can we keep the records of families we cannot reach, just in case?
You must erase personal data once it is reasonable to assume the purpose is no longer served, unless another law requires you to keep it (s. 8(7)(a)). Check whether any law you work under does, such as accounting, grant or education rules, and keep only what it needs. From 13 May 2027, Rule 8(3) also requires you to keep processing logs and the associated data for at least a year, so plan deletion so those logs survive.
Does a nonprofit need a registered Consent Manager to do this?
No. A person may give, review or withdraw consent through a Consent Manager (s. 6(7)), but the Act does not require you to use one. You can take consent directly, as long as each request carries a proper notice (s. 5(1), Rule 3), withdrawal is as easy as giving (s. 6(4)) and you can prove both (s. 6(10)). Consent Managers must register with the Board; those provisions start on 13 November 2026 (Rule 4).