You send an invoice by email. It sits in spam or gets buried in the inbox. A customer opens WhatsApp to confirm something else, sees your message pop up as a notification, and pays within 12 hours. That is not luck. WhatsApp invoices hit 80% open rates compared to 15% for email. For invoicing workflows in Malaysia, Indonesia, and Singapore—where WhatsApp is the default business channel—the conversion lift is real: payment in days instead of weeks, fewer follow-up calls, lower DSO. But PDPA (and equivalent laws in Indonesia and Singapore) require one thing: proof that the customer consented to receive business messages on WhatsApp . No consent log, no audit trail, and your compliance officer's career ends when regulators ask to see it. This post walks you through the setup that captures that proof, enforces it in your templates, and survives an audit. Why WhatsApp invoices work: The metrics that matter Email invoices lose in three places: Delivery: 25% never reach the inbox. They land in spam or promotions. Open: Of what does arrive, 15% open within 48 hours. Action: 40% of opens do not lead to payment within the same day. WhatsApp invoices reverse this: Delivery: 99% arrive. It is a messaging app, not email. It works. Open: 80% open within 2 hours. The notification is a prompt. Action: 65% trigger payment within 4 hours. The math: if you send 100 invoices via email, expect 10–12 payments within 48 hours. WhatsApp: 50–55. On a ₹50L ACV business, that is the difference between 45-day and 15-day DSO. But regulators do not care about your DSO. They care about consent. PDPA (Malaysia Personal Data Protection Act), Law No. 27/2022 (Indonesia's privacy law), and PDPA Singapore all require prior explicit opt-in before you send marketing or transactional messages on WhatsApp. The regulator will ask: where is the log? Can you show me the date they consented? Which template did they opt into? If you cannot answer, the fine is ₹500K+, the message campaign shuts down, and your payment method goes dark. The three-part setup: Consent, templates, and audit trails This is not theoretical. Here is the practical sequence: 1. Capture and log consent at the point of sale Consent must be: Explicit: Not a pre-ticked checkbox or buried in terms. The customer must actively choose to receive WhatsApp invoices. Documented: You log the date, the customer identifier (phone number, email), and what they opted into (e.g., 'transactional invoices via WhatsApp'). Granular: PDPA requires consent per purpose. 'Marketing messages' is different from 'invoice notifications.' Treat them as separate consents. In practice: At checkout or account creation, add a checkbox: "Send me invoice reminders and payment links via WhatsApp." Default: unchecked. When they tick it, log the timestamp, their phone number, their email, the consent type, and your app version or form version (for audit trail). Store this in a consent registry (a simple table: phone, email, consent date, consent type, status). This is your regulatory proof. If you use a CRM, the contact record should flag consent status so that no invoice ships without that flag being true. 2. Use WhatsApp Business API with template enforcement Meta's WhatsApp Business API (the only way to send at scale) requires all messages to use pre-approved templates. This is a feature, not a limitation. Templates protect you: Pre-approval by Meta: Your invoice template goes into Meta's queue. Meta reviews it for compliance (no phishing, no fake urgency, no re-engagement tricks). You do not send it until it is approved. That approval is your second audit trail. Immutable content: Once approved, the template wording cannot change. Regulators can see exactly what you sent, when, and that it was pre-approved. No guesswork, no 'we modified it slightly on Tuesday.' Variable fields only: You can inject invoice number, amount, and due date, but you cannot rewrite the body. This prevents drift into marketing language. Set up your template like this: Template name: invoice_payment_reminder Content: "Your invoice {{invoice_number}} for {{amount}} is due on {{due_date}}. Tap the link below to pay: {{payment_link}}. For support, reply HELP." Meta will review this within 24 hours. Once approved, every WhatsApp invoice sent through your unified messaging inbox uses this exact template. No exceptions. That immutability is gold in an audit. 3. Audit trail: Log every send When the invoice goes out, your system must log: Timestamp (date and time to the second). Customer phone number (the WhatsApp identifier). Invoice ID and amount. Template name and version. Delivery status (sent, delivered, read, failed). Consent flag (yes/no—was this customer marked as opted in at send time?). This log is read-only. You cannot edit it retroactively. If your database is auditable (which any modern accounting system should be), pull this log monthly and store it immutably (hash it, sign it, or export it to external storage). When a regulator asks