Ensuring SMS Campaign Compliance in India

By Shailendra Jha
11/11/2026

TL;DR: To send compliant SMS campaigns in India, register as a Principal Entity on a telecom operator’s DLT platform, register your six-character sender header and message templates, collect and record consent under DPDP principles, and use approved transmission formats. Before sending, verify TRAI template and header approval, check every variable, include a working opt-out route such as 1909, and avoid ordinary mobile numbers that can trigger filtering or blocking.

A campaign can look ready to send and still get blocked because the sender identity, template, consent record, or variable content is wrong. That creates a nasty operational problem: delayed promotions on one side and complaints on the other. TRAI explains that commercial SMS is scrubbed against the sender’s registered content template and may not be delivered when it fails the check. This guide gives you a practical workflow to classify each message, register the sender and template, maintain consent, validate every send, and document opt-outs and complaints. It is operational guidance, not legal advice, and separates TRAI telecom duties from data-protection responsibilities.

Point	Details
Register Before Sending	Complete Principal Entity registration, header assignment, content-template registration, and consent steps before sending your first bulk SMS.
Use Approved Identities	Send commercial SMS through a registered header, not an ordinary mobile number, because non-compliant sender identities can lead to serious consequences.
Match Every Template	Ensure 100% of the final message matches its registered content template, including variable fields and required identifiers.
Make Consent Usable	Capture purpose-specific consent, retain the evidence, and make withdrawal or opt-out at least as easy as the original consent action.
Audit Each Campaign	Keep 1 pre-send record covering the audience source, consent status, template ID, header, PE ID, message content, and suppression results.

What Indian SMS compliance covers

What Indian SMS compliance covers, covering explain the roles of trai access.

Indian SMS compliance has two separate tracks: telecom delivery rules and personal-data responsibilities. When we help clients prepare campaigns, the common mistake is treating a vendor dashboard as proof of compliance. It is not. Your business still owns the campaign purpose, recipient list, consent record, and message content.

TRAI sets the telecom framework. Access providers, usually telecom operators, register and inspect the campaign assets before routing messages. A Principal Entity is the business sending the communication. It must use an approved header, which identifies the sender, and a registered content template. Consent templates record how a consumer agreed to receive relevant messages. The consumer can also report unsolicited commercial communication to 1909 within three days.

For bulk commercial SMS, TRAI identifies six operational activities:

Register the business as a Principal Entity.
Obtain an assigned, registered header.
Register each content template.
Transmit the required Principal Entity ID, header, and content ID with the message.
Register a consent template where applicable.
Acquire consumer consent where applicable.

A registered header is required for commercial communication, and the operator may block a message that fails scrubbing against its registered content template. Using an ordinary mobile number for promotional texting is especially reckless. A first complaint can lead to disconnection and a two-year blacklist.

Message type changes the route, not the need for care. Promotional SMS advertises an offer. Service messages support an existing account or transaction. Transactional messages confirm actions such as payments or bookings. Mixed-purpose messages combine these aims and need careful classification. Calling a sales message “service” does not remove consent, template, or data obligations.

Pro Tip: Treat each campaign as both a telecom submission and a personal-data processing activity; passing one review does not automatically satisfy the other.

Telecom approval answers, “Can this message be delivered?” Lawful processing asks, “May we use this person’s number for this purpose?” Under the DPDP Act, consent must be specific, informed, unambiguous, and easy to withdraw. Keep notice, consent, opt-out, and suppression records separately.

Rules and operator timelines change, including template requirements. Check current TRAI, operator, and privacy guidance before launch; then the next task is mapping each campaign to the right message category.

Build the compliant sender setup first

Build the compliant sender setup first, covering create or verify the principal entity.

Before you import a single phone number, make the sender identity work on paper and inside your SMS platform. When I onboard campaigns, this is where teams lose time: a salesperson says “the provider handles registration,” then the first test message fails because one identifier was never mapped.

Create or verify the Principal Entity account. Register your business with the chosen Access Provider or SMS platform, then confirm the legal name, authorised contact, and PE ID shown in the account. TRAI’s sender guidance treats Principal Entity registration, header assignment, template registration, identifier transmission, and applicable consent steps as separate activities, not one general approval.
Choose and register the header. Use a sender name your recipient can recognise and your business can defend. Keep the alphanumeric header within the 11-character maximum because registered headers are limited to that length for commercial communication. Do not substitute a normal mobile number when the campaign requires a registered header. That shortcut can trigger blocking and creates an avoidable compliance problem. TRAI explains the registered-header requirement here.
Register each message template. Submit the actual promotional, transactional, or service message structure, including variable fields and links where required. A template that looks “almost the same” to a human can still fail scrubbing when its wording, variable placement, or URL differs. Register a consent template too when your use case requires one, and keep the approved versions in your compliance folder.
Map the IDs in your campaign system. Record the PE ID, registered header, content-template ID, and consent-template ID or related consent details as mandatory fields. Do this before importing the audience, not in a spreadsheet after sending.

Pro Tip: Store registration IDs as campaign metadata so a future audit can connect every delivered message to its sender and approved template.

Test the provider’s submission path. Ask for a sample API request and confirm that every submission passes the required PE ID, header, and content-template ID. Also verify that the provider preserves accepted, rejected, scrubbed, and delivery records with timestamps and message references. If support cannot show where those logs live, treat that as a serious gap.
Use a written onboarding checklist. Include registration status, ID mapping, template approval, consent handling, API fields, log retention, and rejection escalation. Get each item confirmed in writing. Verbal assurance is cheap, and it does not help when a regulator or your own client asks why a message was blocked.

With the sender setup locked, you can prepare an audience that matches the approved purpose and consent record.

Manage consent, notices, and opt-outs

Manage consent, notices, and opt-outs, covering define a usable consent record recipient.

A phone number in your CRM is not proof that you can message its owner. Before approving a promotional send, check whether the consent is traceable, specific to the proposed use, and still active. TRAI’s expectations also require consent registration and acquisition where applicable, alongside the sender, header, and content-template steps.

Keep one consent event per recipient or identifier. Your record should show:

the mobile number or other recipient identifier;
collection date and source, such as your website, point-of-sale form, or call centre;
the exact stated purpose and channel, such as promotional SMS;
the wording or consent-version ID shown at collection; and
withdrawal status, withdrawal date, and suppression history.

The DPDP Act’s consent standard requires consent to be free, specific, informed, unconditional, unambiguous, and based on clear affirmative action. In practice, a pre-ticked box fails the spirit of that test. So does one checkbox that says “I agree to updates, partner offers, calls, and research.” You may have a timestamp, but you cannot show what the person knowingly accepted.

Purchased lists are worse than they look. You usually inherit no reliable purpose, wording version, collection context, or evidence that the seller had permission to pass the data to you. Partner data creates the same problem when “shared with affiliates” appears in vague small print. We reject these files unless the partner can produce a clear consent trail tied to your brand, purpose, and SMS channel.

Pro Tip: Keep the exact consent language version with each consent event; a timestamp alone cannot show what the recipient agreed to.

Make withdrawal as easy as signup. If consent came through a one-tap web form, provide a one-tap unsubscribe link or a simple SMS keyword, then sync the result to every sending system. The Act gives people the right to withdraw at any time, with withdrawal as easy as giving consent, and requires processing to stop within a reasonable time unless another lawful basis applies.

Separate promotional suppression from operational messaging. A customer who opts out of offers may still need a delivery alert, fraud warning, or service notice, but do not relabel a discount as “operational” to bypass an opt-out. Send unclear cases to legal review rather than guessing.

Use a standalone notice that names the personal data collected and the specific purpose. The DPDP Rules, 2025 introduce that requirement, but several operational rules have an 18-month delayed commencement from notification on November 13, 2025. Prepare the notice and evidence now, then verify the applicable commencement date before launch. Your bulk SMS setup checklist should not be considered complete until these consent and suppression checks pass.

With the audience suitable to contact, the next check is whether each message matches the registered template and sender identity.

Validate message content before launch

A draft can look harmless and still fail telecom scrubbing. When I review campaigns for AVM Cloud clients, the usual problem is not the offer itself. Someone changes one brand name, swaps a URL, or lets a variable contain more text than the registered template allows.

Put the approved version beside the exact SMS your system will render. Do not compare against a copy in a Word file. Use the final character string, including spaces, punctuation, links, app text, and phone numbers.

Checkpoint	Approved template	Final rendered SMS	What can go wrong
Sender identity	Registered header, PE ID, and content-template ID	Values transmitted by your provider	A missing or mismatched identifier can stop delivery
Language and brand	Approved language and registered brand reference	Actual language, spelling, and brand name	A translation or rebrand may no longer match
Fixed message	“AVM Cloud: Your plan expires on 30 June.”	Same fixed wording	Even small edits can create a template mismatch
Personalised variable	`{{customer_name}}`, customer name only	“Ravi”	A name field containing an offer or extra sentence is unsafe
URL or app link	Approved URL variable with permitted format	Rendered web link or app link	A changed domain, path, or tracking string may fail validation
Callback number	Approved callback-number variable	The number shown to the recipient	A new number, shortcode, or formatting change may be rejected

Commercial SMS is scrubbed against the registered content template, and a message that fails the check may not reach the customer. That makes template comparison more important than polishing a subject line that SMS does not even have. Also confirm that the sender uses the registered header and transmits the correct PE ID, header, and content-template ID.

TRAI’s November 18, 2025 direction adds a detail many teams miss: every variable must carry a descriptive label stating its content type, purpose, and validation criteria. Write the rules before launch, not after a rejection:

Fixed value: AVM Cloud | content type: brand name | purpose: identify sender | validation: exact match.
Personalised variable: {{first_name}} | content type: recipient name | purpose: greeting | validation: letters and spaces, maximum 30 characters.
URL variable: {{renewal_url}} | content type: HTTPS URL | purpose: account renewal | validation: approved domain and path pattern only.
Callback number: {{support_number}} | content type: Indian telephone number | purpose: customer support | validation: approved number, digits only.

For timing, new templates registered after the 10-day period following the direction date had to meet the tagging requirement. Existing templates have a separate 60-day update window, counted from the date variable-tag scrubbing starts, not automatically from November 18. Confirm that commencement date with your telecom provider before relying on a deadline.

Once the comparison passes, retain the rendered sample, IDs, and provider response with the campaign record before scheduling delivery.

Avoid sender and campaign mistakes

The failures I see in small-business campaigns are usually operational, not technical. A sender registers once, assumes the provider will handle the rest, and then changes the campaign in a spreadsheet. That assumption is expensive.

Using a personal number: Promotional SMS must use a registered header, not an ordinary mobile connection. TRAI says a regular connection can be disconnected after the first complaint and can lead to two-year blacklisting, so do not treat a familiar number as a shortcut. Read TRAI’s warning on promotional calls and messages.
Trusting a supplied list: Purchased, scraped, old, or partner-provided contacts are not proof of consent. Keep the consent source, timestamp, purpose, and wording, then check the current suppression list before every upload. A spreadsheet called “clean leads” proves nothing.
Editing a registered template: Changing the offer, URL, date, sender variables, or discount code can make the message differ from the approved content. Revalidate the template after every material edit. TRAI also requires descriptive pre-tagging for variable fields such as URLs and app links under its November 2025 direction.
Dropping identifiers or records: Your send request must carry the required PE ID, registered header, and content-template ID. Retain the request payload, recipient file version, approval, delivery response, and timestamps. Without those logs, even a genuine mistake becomes difficult to investigate.
Ignoring warning signals: Process opt-outs immediately and suppress complainants, DND indicators, and repeated delivery failures. Recipients can report UCC to 1909 within three days, so a complaint is a control signal, not just an inbox nuisance. See why SMS remains widely used in India.

A provider’s API does not transfer your legal responsibility. The provider handles routing, registration interfaces, and technical checks; you remain responsible for consent, audience selection, truthful content, suppression, and approvals. Confirm what the provider actually validates rather than assuming a successful API response means compliance.

Before sending, check: registered header; approved template and variables; PE ID, header, and content ID; consent evidence; suppression and DND screening; test delivery; logging enabled. If a complaint arrives, pause the campaign, preserve all files and API logs, identify the exact template and audience version, suppress the complainant, and investigate the source before resuming. Use the findings to amend the list or template, not merely to restart the same job.

The next control is ongoing monitoring, because a compliant launch can still become a problem after the first send.

Turn compliance into a repeatable operating system

A compliant SMS programme needs a paper trail that survives staff changes, rushed launches, and provider disputes. Registration is only the starting point. Give named people responsibility for registration, consent governance, content approval, technical validation, suppression handling, and incident response, with a deputy for each role. “Marketing” is not an owner.

Use this operating timeline for every campaign:

Before planning: The registration owner confirms the Principal Entity record, registered header, PE ID, and template IDs. The consent owner checks the audience source, consent wording, timestamp, purpose, and withdrawal history. TRAI’s required sender activities include entity registration, header and template registration, PE ID/header/content ID transmission, and consent registration or acquisition where applicable under its sender guidance.
Before approval: The content owner signs off the final copy and its business purpose. The technical owner runs a 100% template-match validation, confirms the registered header, checks variables, and blocks any send from an unregistered header. Treat a failed check as a stop, not a warning. Commercial SMS can fail scrubbing and remain undelivered when the rendered text does not match the registered template under TRAI’s delivery direction.
Before transmission: Store one campaign record containing the audience source, consent evidence, opt-out status, header, PE ID, template ID, rendered content, scheduled send time, provider response, delivery anomalies, and complaint outcomes. The suppression owner must run a 100% suppression-list check immediately before release, including recent opt-outs received in another system.
Within one business day after sending: The incident owner reviews rejection rates, complaints, opt-outs, delivery spikes, provider errors, and unexpected template changes. Record what happened, who investigated it, and whether you paused the next campaign. A spreadsheet can work at low volume, but people often forget to update it after a late-night send.
Monthly and quarterly: Review provider capabilities, TRAI directions, DPDP implementation status, and internal privacy notices. Confirm that consent remains specific and that withdrawal is as easy as giving consent. An API or bulk SMS platform can automate suppression checks, preserve logs, and capture provider responses, but it cannot decide the legal classification of a message or replace accountable approval.

This routine turns each send into evidence, making the next compliance review far less dependent on memory.

My honest take on SMS compliance in India

I have seen teams treat SMS compliance as a registration task: complete the sender onboarding, submit the template, and assume the hard part is over. That view is wrong. In practice, compliance is mostly a change-management and data-quality problem, and a correctly onboarded account can still create risk within minutes.

An imported spreadsheet may contain an unverified number, an old consent status, or someone who already opted out. A marketer may also edit a variable after approval, while an automation keeps sending to a suppressed contact. These mistakes are less dramatic than a failed registration, but they are the ones that trigger complaints and make an audit uncomfortable.

For a small team, I recommend a boring control system: one approved sender setup, a consent ledger, locked templates, automated suppression checks, and a documented final review before sending. It is mildly frustrating to add these checks, especially when a campaign feels urgent, but they prevent the usual scramble across spreadsheets, inboxes, and messaging dashboards.

I would not promise guaranteed delivery or legal certainty. The practical standard is traceability. You should be able to show why a person was contacted, which sender identity and template you used, what content went out, and how you handled a withdrawal or complaint. That evidence matters more than simply having a registration number.

— AVM Cloud Content Strategy Team

Send compliant campaigns with a controlled SMS workflow

When we help businesses review an SMS workflow, the gaps usually appear after a campaign goes out: an unapproved variable, missing PE ID or content-template ID, or delivery logs no one can produce during an audit. AVM Cloud’s SMS marketing capability, delivered through the DomainAdda business ecosystem, helps bring registration details, approved templates, API transmission, delivery records, and suppression steps into one more consistent process.

Before your next send, compare your provider against the practical checklist. Ask whether it supports registered headers, template and variable validation, consent handling, complete logs, and campaign-audit support. The setup can be tedious, especially when older contact lists contain unclear consent records, so support matters. Review the bulk SMS setup process or speak with the AVM Cloud team about a compliant implementation path before you schedule a campaign.

Frequently Asked Questions

Can I send promotional SMS in India from my personal mobile number?

No. Promotional commercial SMS should use a registered sender header, not an ordinary mobile number. TRAI states that using a regular telephone connection for promotional messages can lead to disconnection after the first complaint and blacklisting for 2 years, so a personal SIM is a poor shortcut.

What information should an SMS consent record contain?

Keep at least 6 details: the recipient identifier, collection date, collection source, stated purpose, consent wording or version, and withdrawal status. Tie that record to the campaign audience, because a generic database export rarely proves that each person gave clear, affirmative consent.

How long does a recipient have to report unsolicited commercial communication?

A recipient can report unsolicited commercial communication through 1909 within 3 days of receiving it, subject to the applicable DND registration conditions. Preserve the campaign, delivery, consent, and recipient records beyond that 3-day window so your team can investigate a complaint without guessing.

Can I change a URL or offer inside an approved SMS template?

Do not treat a small edit as automatically safe. URLs, dates, offers, and other variable values must pass the registered-template and variable validation process, and even 1 unapproved change can cause scrubbing failure or a mismatch with the registered content.

Does using an SMS API make my campaign legally compliant?

No. An API may transmit identifiers, check message content, apply suppression lists, and retain logs, but your business still owns the legal decisions. You remain responsible for message classification, sender registration, template accuracy, consent, and complaint handling, even when the API provider processes thousands of messages per minute.