Resolution 50/2008's Six-Item Schedule: WhatsApp for Indian Law Firms

What Resolution 50/2008 permits, and what it does not

An Indian law firm's WhatsApp Business number sits on the same device the senior partner uses to book a car. That much is the same everywhere. What may cross that channel in India is not.

Three federal instruments determine most of what a firm may do with WhatsApp today.

The first is Resolution No. 50/2008 (dated 30 April 2008) of the Bar Council of India, which added a proviso to Rule 36 of the Bar Council of India Rules Part VI Chapter II. The proviso permits an advocate to furnish, on a website, a defined six-item schedule of information — name; address, telephone numbers, email; enrolment details (number, date, state bar council); membership in any bar association; professional and academic qualifications; areas of practice — "under intimation to and as approved by the Bar Council of India." The resolution's own text then closes the schedule: "Any additional other input in the particulars than approved by the Bar Council of India will be deemed to be violation of Rule 36," with the consequence being punishment for misconduct under Section 35 of the Advocates Act 1961. The proviso opens a narrow website window and nothing beyond it; the underlying rule to which Resolution 50/2008 attached its schedule is not analysed here from primary text.

The second is the Prevention of Money-Laundering Act 2002 and its post-2023 notification landscape. The Ministry of Finance's F.No. P-12011/12/2022-ES Cell-DOR of 3 May 2023 extended the reporting-entity regime to three specifically named categories of certificate-holders under the Chartered Accountants Act 1949, the Company Secretaries Act 1980, and the Cost and Works Accountants Act 1959. Practising advocates are not in the notification's definition of "relevant person," and no equivalent notification has extended the regime to the legal profession. Not "excluded" — not included. The distinction matters for how a firm frames its own compliance posture; a further notification could change the position at any time.

The third is the Digital Personal Data Protection Act 2023, whose Rules were notified on 14 November 2025 with an eighteen-month phased-compliance period running from that date. The Act relies on Section 6's general consent standard, Section 7's enumerated legitimate uses (from which direct marketing is absent), and a Section 9(3) prohibition on targeted advertising directed at children. It does not create a bespoke marketing gate. Per-provision phasing is announced through further gazette notifications rather than in the Rules press release.

The practical question a firm asks itself before pressing send on WhatsApp: does the intended communication fit the Resolution 50/2008 schedule (if it is a public disclosure); if it is instead service to an existing retainer, that class of communication is by its nature not solicitation and this piece does not analyse the underlying Rule 36 from primary text; does the underlying processing have a lawful basis under DPDP Section 6 or fall within Section 7's enumerated uses; and does the transactional character of the underlying file bring in PMLA obligations that in fact do not attach to a law firm under the current notifications.

Resolution 50/2008 and its three silences

Resolution 50/2008 sits in Section IV of Chapter II of Part VI of the Bar Council of India Rules. It amends Rule 36 by adding a proviso. The proviso permits an advocate to furnish, on a website, a defined schedule of information "under intimation to and as approved by the Bar Council of India" — the six-item schedule set out above. The proviso then closes its own logic: "Any additional other input in the particulars than approved by the Bar Council of India will be deemed to be violation of Rule 36," and an advocate breaching the proviso "would be liable to punishment for misconduct" under Section 35 of the Advocates Act 1961.

Three things the resolution does not do, each a positive finding rather than a gap.

It does not name any communication channel outside the website context. The proviso regulates what appears on an advocate's website; it does not open a WhatsApp channel, an email-list channel, or an in-message solicitation channel. A WhatsApp broadcast to a prospect list is not a website disclosure — it is not covered by the proviso's permission, and it is inspectable under the underlying Rule 36 to which Resolution 50/2008 added the schedule as a narrow exception rather than a general opening.

It does not create an exception for existing or former clients. SRA para 8.9 does — the English rule explicitly permits solicitors to make unsolicited approaches to "current or former clients." Resolution 50/2008 gives no equivalent carve-out. A message to an existing client about their live matter is defensible as service to the retainer rather than as solicitation, but Resolution 50/2008 does not create a carve-out for that class as a matter of the resolution's own text.

It does not address referral fees, commissions to intermediaries, or the financial arrangements underlying representative-driven solicitation. The resolution's schedule is content-based (what may appear on a website). The resolution's construction — treating any addition beyond the schedule as a Rule 36 violation — implies that the underlying rule reaches beyond website content, but this piece does not analyse the underlying rule's reach from primary text. A firm working with any lead-generation vendor should treat the arrangement as inspectable without relying on Resolution 50/2008's silences as permission.

The practical rule for a firm's WhatsApp use follows. A message to a current client about their live matter is defensible as service, not solicitation. A broadcast advertising services to a purchased list or a set of contacts collected at a business event is not covered by Resolution 50/2008 — the proviso opened a specific website schedule and nothing beyond it.

The AML perimeter — CAs, CSs, Cost Accountants, and not lawyers

The Prevention of Money-Laundering Act 2002 places its reporting-entity obligations on the definition in Section 2(wa): "a banking company, financial institution, intermediary or a person carrying on a designated business or profession." The designated-business-or-profession list at Section 2(sa) enumerates specific activities and does not name lawyers, advocates, or the legal profession.

The Ministry of Finance notification F.No. P-12011/12/2022-ES Cell-DOR of 3 May 2023 extended the reporting-entity regime to three specific chartered professions, defining "relevant person" as: an individual who obtained a certificate of practice under Section 6 of the Chartered Accountants Act 1949; an individual who obtained a certificate of practice under Section 6 of the Company Secretaries Act 1980; an individual who has obtained a certificate of practice under Section 6 of the Cost and Works Accountants Act 1959. The notification lists five specific financial activities carried out by such certificate-holders on a client's behalf as within scope of the extended regime. Practising advocates are not among the three named categories, and no equivalent notification has extended the regime to the legal profession.

The framing that matters for a legal-audience post: this is not an exclusion, it is a non-inclusion. The regulator has extended the AML perimeter to CAs, CSs, and Cost Accountants; it has not extended it to lawyers. A firm's compliance position rests on the specific state of the notifications rather than on a doctrine of exemption or a treaty-style carve-out. If the position changes — a further notification could add advocates at any time — the firm's stance changes with it.

For a firm's WhatsApp use, the practical consequence is direct. PMLA Section 12(1)(a) requires reporting entities to "maintain a record of all transactions, including information relating to transactions covered under clause (b), in such manner as to enable it to reconstruct individual transactions"; Section 12(1)(b) requires the entity to furnish information on transactions to the Director within prescribed time and manner; Section 12(1)(e) requires records of documents evidencing identity of clients and beneficial owners as well as account files and business correspondence; Section 12(3) sets a five-year retention period on transaction records. Those obligations attach to CAs, CSs, and Cost Accountants under the 3 May 2023 notification, and to the pre-existing enumerated categories under Section 2(sa) and 2(wa). They do not attach to a law firm as a matter of the PMLA statute and its current implementing notifications.

That does not make the firm's WhatsApp exchanges regulatory-free. Client-file communications remain within the confidentiality obligations of the profession, enforceable through Section 35 of the Advocates Act 1961 as misconduct. Communications that touch client transactions can also create evidence in a broader civil or criminal proceeding independent of any PMLA reporting duty. What is absent is the specific reporting-entity duty structure — the STR obligation, the transaction-record retention, the FIU information-furnishing — that attaches to reporting entities under the Act.

Personal data — DPDP Section 6, Section 7's enumeration, and the running clock

The Digital Personal Data Protection Act 2023 (Act No. 22 of 2023) sets India's federal data-protection regime. Section 1(2) provides that the Act "shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act." The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 and, per the Ministry of Electronics and Information Technology press release, "introduce an eighteen-month period for phased compliance." The eighteen-month clock is running on the date of this article; per-provision phasing is announced through further gazette notifications rather than in the Rules press release.

Section 6 sets the consent standard. Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action," and must signify the data principal's "agreement to the processing of her personal data for the specified purpose." It is limited to such personal data "as is necessary for such specified purpose." Consent is withdrawable "at any time, with the ease of doing so being comparable to the ease with which such consent was given."

Section 7 lists the "legitimate uses" for which personal data may be processed without consent. The enumeration covers: data voluntarily provided by the data principal for a specified purpose; state and its instrumentalities providing subsidies, benefits, services, certificates, licences, or permits; state functions under law and interests of sovereignty, integrity and security; compliance with any judgment or order of a court; medical emergencies; medical treatment during epidemics and threats to public health; safety measures during disasters and breakdowns of public order; employment purposes and safeguarding the employer from loss or liability. Direct marketing is not in the list.

The Act does not create a bespoke marketing gate. The general position is that cold marketing to a natural person requires consent under Section 6 that meets the "free, specific, informed, unconditional and unambiguous" standard, and no Section 7 legitimate use covers cold marketing on the firm's own initiative. Section 9(3) of the Act specifically prohibits "tracking or behavioural monitoring of children or targeted advertising directed at children" — a child-specific provision, not a general marketing rule.

Sections 11 to 14 set the rights of the data principal: access (Section 11); correction and erasure (Section 12); grievance redressal (Section 13), which the data principal must exhaust before escalating to the Data Protection Board; and designation of a representative (Section 14).

For a firm considering WhatsApp use during the DPDP compliance window: file-service communications to a current client rest most cleanly on the Section 6 consent obtained at engagement, on the "specified purpose" of providing legal services under the retainer. Whether Section 7's "voluntarily provided by the data principal for a specified purpose" limb also independently covers the same processing is a question of how that limb is read, and firms should not rely on Section 7 as an alternative to a Section 6-standard consent without a considered position. Cold WhatsApp outreach to a non-client requires Section 6 consent, and Section 7 does not offer a shortcut for that case. Firms should treat the running eighteen-month clock as a period for aligning existing consent practices, notice text, and internal grievance redressal procedures rather than as a period of permissive latitude before those obligations bite.

Client money — Section 35 discipline, without a statutory accounts framework located

This piece did not locate a federal statutory scheme prescribing where advocates hold client money, how it is segregated from firm money, or how an accountant's report demonstrates compliance for the legal profession — an equivalent to the UK SRA Accounts Rules. What Resolution 50/2008 makes plain — because it names the enforcement route in its own text — is that misconduct by an advocate in relation to any client-facing communication is punishable under Section 35 of the Advocates Act 1961. The formal control this piece was able to source runs through the disciplinary regime.

For a firm using WhatsApp with clients, one implication follows directly. A WhatsApp reply confirming that the firm will hold a deposit, or committing to a specific handling of client funds, becomes evidence in any subsequent disciplinary proceeding regardless of whether the underlying transaction was compliant. The message-thread's evidentiary weight in a Section 35 proceeding does not depend on whether India has a statutory client-money regime — it depends on the message having been sent by the advocate in the firm's name.

A second implication follows for money instructions to the client. The instruction telling a client where to send funds — the account details, the beneficiary name, the reference number — is a message a firm may reasonably send by WhatsApp to a current client. What the message cannot do is substitute for the firm's actual banking arrangement; funds have to land through the account the firm operates rather than through an in-thread payment mechanism.

A Section 17 file — where WhatsApp fits, where it doesn't

The Registration Act 1908 governs the compulsory registration of documents affecting immovable property in India. Section 17(1) sets out the categories of instruments that must be registered: "instruments of gift of immovable property" (clause a); "other non-testamentary instruments which purport or operate to create, declare, assign, limit or extinguish… any right, title or interest… of the value of one hundred rupees and upwards, to or in immovable property" (clause b); "non-testamentary instruments which acknowledge the receipt or payment of any consideration on account of the creation, declaration, assignment, limitation or extinction of any such right, title or interest" (clause c); "leases of immovable property from year to year, or for any term exceeding one year, or reserving a yearly rent" (clause d); "non-testamentary instruments transferring or assigning any decree or order of a Court or any award" affecting immovable property of the value of one hundred rupees and upwards (clause e). Section 17(3) adds authorities to adopt a son, executed after 1 January 1872 and not conferred by will.

Section 49 sets the consequence of non-registration in India's specific formulation: "No document required by section 17… to be registered shall — (a) affect any immovable property comprised therein, or (b) confer any power to adopt, or (c) be received as evidence of any transaction affecting such property… unless it has been registered."

The mechanic is worth naming precisely. Section 49 does not say the transaction itself is invalid; it says the unregistered document does not affect the property, does not confer the power to adopt, and is not received as evidence of the transaction it purports to record. A transaction that ought to have been documented in a Section 17 instrument, and was not, may leave the parties with an underlying agreement whose enforceability then has to be argued through separate doctrines — a very different posture from one where the transaction is void ab initio.

Against that regulatory floor, a client-facing property file has WhatsApp-natural touchpoints where the message is service to a live retainer rather than solicitation, built strictly around what Section 17(1) and Section 49 say:

• Confirming to the client which of the instruments in their transaction fall within Section 17(1)'s compulsory categories — a gift instrument under clause (a); a transfer of interest at or above ₹100 under clause (b); a receipt-of-consideration document under clause (c); a lease "from year to year, or for any term exceeding one year, or reserving a yearly rent" under clause (d); a decree-transfer document under clause (e).
• Confirming which instruments in the same transaction do not fall within Section 17(1) — including any authority to adopt not falling within Section 17(3)'s specific window — so the client understands where the compulsory-registration duty attaches and where it does not.
• Once a document within Section 17(1) has been registered, confirming that the registration entry has been made, and providing the client with the specific reference of that entry, because that reference is what will overcome Section 49's default of no-effect and inadmissibility if a later question arises about whether the document was ever registered.
• For a lease specifically, confirming to the client that a term "exceeding one year, or reserving a yearly rent" places the lease into Section 17(1)(d) and therefore into Section 49's consequence regime for as long as it remains unregistered.

Each of these is a service message on a live retainer, tied to a specific sub-clause of Section 17 or a specific consequence under Section 49. None substitutes for the underlying regulatory workflow — the drafting itself, the applicable registration procedures, and the Section 49 exposure that persists until registration is completed — which happens through the firm's own arrangements rather than in the WhatsApp thread.

WhatsApp Business Platform costs — what Meta publishes, what it doesn't

Meta moved the WhatsApp Business Platform to per-message pricing on 1 July 2025. Under the current model, businesses are only charged when a template message is delivered; utility templates sent inside an open customer service window — the 24-hour window that opens each time the client sends the firm an inbound message — are free; marketing and authentication templates are charged whether inside or outside the window. Meta publishes actual per-market rates as downloadable rate cards (CSV and PDF, per currency including INR for India) rather than inline on the pricing page. The most current numbers live at developers.facebook.com/documentation/business-messaging/whatsapp/pricing — the rate-cards section links out to the specific CSV for INR, and any scheduled INR billing changes are listed on Meta's pricing update page.

For an Indian firm whose WhatsApp usage is dominated by file-service updates in reply to current clients' inbound messages — the utility-inside-CSW pattern — the platform bill is small. Firms considering outreach messaging outside that pattern run into both a bigger bill and the Rule 36 plus DPDP Section 6 analyses set out above at the same time.

Scope — federal position; state Bar Council directions may add jurisdiction-specific overlays

This piece covers advocates and law firms operating under the federal position: the Bar Council of India Rules, the Advocates Act 1961, the Prevention of Money-Laundering Act 2002 with its post-2023 notifications, the Digital Personal Data Protection Act 2023 with the Rules of 2025, and the Registration Act 1908. State Bar Councils may issue their own directions supplementing BCI Rules; firms operating in specific states should check whether the applicable State Bar Council has issued directions relevant to communication practices. High Court practice directions on advocate conduct in specific proceedings can also add jurisdiction-specific overlays; the analysis above is at the federal baseline.

FAQ

Can we message a current client on WhatsApp about their live matter?

Yes. A message to a current client about the client's live matter is service to the retainer, not solicitation, and processing the client's number for that purpose rests on DPDP Section 6 consent obtained at engagement for the specified purpose of providing legal services. PMLA reporting-entity duties do not attach because advocates are not reporting entities under the current PMLA notifications. The exchange still sits within the confidentiality obligations of the profession, enforceable as misconduct under Section 35 of the Advocates Act 1961.

Can an Indian firm run WhatsApp outreach to a purchased list of prospects?

No. Resolution 50/2008 opened a defined website schedule rather than a WhatsApp channel; any addition beyond that schedule is treated in the resolution's own text as a Rule 36 violation. Separately, DPDP Section 6 requires consent that is "free, specific, informed, unconditional and unambiguous" for the underlying processing of the recipient's contact details, and Section 7's enumerated legitimate uses do not include marketing. The two regimes reach the same practical conclusion by different routes.

Are Indian advocates reporting entities under PMLA?

Not under the current statute and its notifications. Section 2(sa) enumerates the designated business-or-profession categories and does not include lawyers or advocates. The 3 May 2023 notification (F.No. P-12011/12/2022-ES Cell-DOR) extended the reporting-entity regime to individuals holding certificates of practice under the Chartered Accountants Act 1949, the Company Secretaries Act 1980, and the Cost and Works Accountants Act 1959 — three specific categories. Advocates were not included. This is a non-inclusion rather than an exemption; the position rests on the specific state of the notifications rather than a doctrine, and a further notification could change it.

What does the DPDP Rules 2025 eighteen-month phased-compliance period mean for a law firm?

The Ministry of Electronics and Information Technology press release of 14 November 2025 states that the Rules "introduce an eighteen-month period for phased compliance." Specific per-provision phasing is announced through further gazette notifications rather than in the Rules press release itself; firms should track those notifications directly rather than rely on a single "everything is due by [date]" summary. Consent practices, notice text, and internal grievance redressal procedures should be built out during the window rather than after it.

What if the firm operates in multiple states — do State Bar Council rules add anything?

The Bar Council of India Rules are the federal baseline. State Bar Councils may issue directions supplementing them; firms operating across states should check whether the applicable State Bar Council has issued directions relevant to communication practices and to messaging channels specifically. High Court practice directions on advocate conduct in specific proceedings can add jurisdiction-specific overlays.

Our firm has cross-border practice — do we need to worry about UK or UAE regimes when messaging clients there?

Possibly. UK PECR regulation 22 imposes a prior-opt-in requirement for direct marketing electronic mail to individual subscribers, and SRA para 8.9 restricts solicitor solicitation with a defined carve-out for current or former clients. UAE FDL 34/2022 Article 45(1)(h) restricts advocate promotion under an evaluative ethics standard, and UAE PDPL Article 17 gives data subjects a right to object to direct marketing. Each of those regimes has its own criteria for extraterritorial application, and this piece does not analyse them. A firm sending WhatsApp messages into either jurisdiction — to a client based there, or on a matter conducted under that jurisdiction's rules — should check the applicable regime's extraterritoriality rule directly rather than assume the position by default.

Sources and methodology

This piece relies on primary text of Resolution 50/2008 (dated 30 April 2008) of the Bar Council of India; the Prevention of Money-Laundering Act 2002 as published on FIU-India, together with the Ministry of Finance notification F.No. P-12011/12/2022-ES Cell-DOR dated 3 May 2023; the Digital Personal Data Protection Act 2023 as published by the Ministry of Electronics and Information Technology and the Ministry's press release of 14 November 2025 announcing the DPDP Rules 2025; and the Registration Act 1908 as published on India Code. The underlying text of Rule 36 of the Bar Council of India Rules Part VI Chapter II is not reproduced from primary in this piece; where the underlying rule is referenced, the reference is derived from Resolution 50/2008's own text.