WhatsApp Chats as Court Evidence India 2026: BSA 63

Yes — WhatsApp business chats are admissible as evidence in Indian courts, provided they are produced under Section 63 of the Bharatiya Sakshya Adhiniyam (BSA), 2023 (the successor to Section 65B of the old Indian Evidence Act), with the required certificate authenticating the electronic record. The catch is that a screenshot alone rarely holds up: courts want the record produced from the source system, its integrity vouched for, and a signed Section 63(4) certificate attached. This guide explains how to make your business WhatsApp records court-usable in 2026 — the BSA certificate workflow, why an official WhatsApp Business API thread beats a personal-number chat in a dispute, how to archive messages immutably from the API, and how to balance evidence retention against DPDP data-minimisation. It is written for founders, CAs, advocates and collections teams; verify the current position with your counsel, as case-law on the new BSA is still settling.

Are WhatsApp chats valid evidence in India?

They can be, but they are treated as electronic records, not ordinary documents. Since 1 July 2024 the Bharatiya Sakshya Adhiniyam, 2023 replaced the Indian Evidence Act, 1872, and Section 63 of the BSA now governs the admissibility of electronic records — carrying forward the framework that businesses knew as Section 65B. The core rule is unchanged in spirit: a computer/phone output (a chat export, a server log, a message record) is admissible as evidence of its contents if the conditions in Section 63 are met and it is accompanied by a certificate. Courts have repeatedly held that without that certificate, secondary electronic evidence can be refused — so the certificate is not a formality, it is the gate.

The Section 63 certificate — what it must say

Section 63(4) requires a certificate that identifies the electronic record, describes how it was produced, and gives particulars of the device or system involved, signed by a person occupying a responsible official position in relation to the operation of the relevant device or management of the relevant activities (verify the exact statutory wording and any notified format with your counsel). In plain terms, for a WhatsApp thread the certificate should establish:

• The source: which WhatsApp Business Account / number the messages came from, and the system used to export or archive them.
• The method: how the export or archive was generated (an in-app export, or an API-side webhook capture into your store).
• Integrity: that the record was produced in the ordinary course of the activity and has not been altered — a hash value computed at export time is strong corroboration.
• The signatory: a responsible person (proprietor, director, IT/compliance officer) who can attest to the above.

A phone screenshot fails most of this — it has no source-system provenance, no integrity proof, and is trivially editable. That is why a defensible workflow captures the record from a system, not from a screen.

Why an API (green-tick) thread beats a personal-number chat in court

Disputes over orders, payment terms, delivery commitments and cancellations are increasingly fought on WhatsApp threads. An official WhatsApp Business API account has evidentiary advantages a personal or free Business-app number does not:

• Verified identity: a green-tick, Meta-verified business name reduces "that wasn't our official channel" arguments about attribution.
• Server-side message logs: the API delivers every message and status (sent, delivered, read, failed) to your webhook, so you hold an independent, timestamped record on your own infrastructure — not just on a handset that can be lost, wiped or claimed to be tampered with.
• Immutable archival: you can pipe those webhooks into a write-once store the moment they arrive, giving a clean chain of custody. Our WhatsApp message & event data pipeline guide covers building exactly this webhook-to-store layer.
• Access governance: role-based access and audit trails on an API stack (see our WABA security hardening guide) support the "responsible person" and integrity assertions the certificate needs.

None of this guarantees a court will admit the record — that is always the judge's call on the facts — but it materially strengthens the provenance and integrity story behind the Section 63 certificate.

How to make your WhatsApp records court-usable — a workflow

A practical, defensible archival routine looks like this:

• Capture at source: for API threads, store every inbound and outbound message and its status from the webhook into an append-only archive as it arrives; for app-only numbers, use the built-in chat export.
• Hash on capture: compute and store a cryptographic hash (e.g. SHA-256) of each exported file or message batch at the moment of capture, so you can later demonstrate the record has not changed.
• Timestamp and log: keep server timestamps and the operator/system identity for each capture event — this is your chain of custody.
• Retain to a schedule: hold records for the period your contracts, limitation windows and sector rules require, then purge on a stated schedule (see the DPDP balance below).
• Certificate on demand: when a dispute arises, generate the Section 63(4) certificate referencing the specific record, its source system, method of production and hash, signed by your responsible person.

For businesses that already dispute receivables over WhatsApp — CAs chasing fees, firms chasing invoices — this turns the same thread that did the work into the evidence that proves it. Our WhatsApp guide for CA firms and guide for law firms and advocates show the client-communication side of this discipline.

The DPDP tension: keep enough, but not too much

Evidence law pulls toward keeping records; the Digital Personal Data Protection Act, 2023 pulls toward keeping less. The two are reconcilable, and the balancing test is the compliance work:

• Purpose and storage limitation: DPDP expects you to retain personal data only as long as necessary for the purpose. "Might need it as evidence" is a legitimate purpose — but it must be a defined, documented retention schedule, not indefinite hoarding of every customer's chats.
• Minimise what you archive: archive the transactional thread that could become evidence, not unrelated personal data swept up alongside it.
• Access and erasure requests: be ready to tell a data principal what you hold and to honour erasure where the law permits — while lawfully retaining what an active or anticipated dispute, or a statutory record-keeping duty, requires. Our DPDP grievance & data-portability guide walks the request-handling side.
• Sector archival rules override the default: regulated firms (SEBI, RBI, IRDAI-supervised) often have communication-archival and record-retention mandates that set the floor — those win over a shorter default. Verify your sector's current norms.

Document the retention schedule and its legal basis; that document is itself part of your DPDP and evidentiary posture. Verify commencement and the operative DPDP Rules with counsel — see our DPDP Rules 2026 business-changes guide for current status.

What a compliant WhatsApp stack costs on RichAutomate

Running your business on the official WhatsApp Business API — the version that gives you server-side logs and archivable webhooks — costs less than most teams expect. RichAutomate charges ₹0 platform fee, ₹0 setup and ₹0 monthly; you pay only for messages. Two models:

• Client Pay — ₹0.10 per message plus Meta's conversation charges billed to you directly at cost by Meta.
• SaaS Pay — ₹1.20 marketing / ₹0.30 utility per message, all-inclusive on one INR GST invoice, tiering down toward ₹0.30 at volume.

Going live on the official API needs a verified business, and in India GST is effectively required to move a WhatsApp Business Account to live status — treat it as necessary, not optional. See the full WhatsApp Business API cost breakdown for the per-conversation maths. A 14-day free trial with 100 free credits lets you stand up the webhook archive and test message logging before you commit.