GDPR and WhatsApp Business: A Practical Compliance Guide

If you use WhatsApp to communicate with customers in the UK or EU, GDPR applies to those conversations. WhatsApp messages contain personal data — names, phone numbers, conversation content — and the way you collect, store, and process that data must comply with the General Data Protection Regulation.

The good news: GDPR compliance for WhatsApp Business is achievable without hiring a lawyer for every conversation. This guide covers the practical obligations and how to meet them.

Does GDPR apply to WhatsApp Business?

Yes. Under GDPR, your business is the data controllerwhen you communicate with EU/UK customers via WhatsApp. Meta (as WhatsApp’s operator) is a data processor. This means:

• You are responsible for having a lawful basis to process personal data in those conversations
• You must be able to respond to data subject requests (access, erasure, portability)
• You must not retain personal data longer than necessary
• You must have a Data Processing Agreement (DPA) with Meta — Meta’s standard Business Terms include this

Lawful basis: do you need consent to message customers on WhatsApp?

GDPR requires a lawful basis for processing personal data. For customer support conversations, the two most commonly used bases are:

• Contractual necessity: if a customer contacts you about an order, service, or issue — replying via WhatsApp is necessary to perform the contract. No separate consent is needed for the conversation itself.
• Consent: if you initiate outbound WhatsApp messages (e.g. marketing campaigns, promotional broadcasts), you need documented opt-in consent. This means the customer must have actively agreed to receive messages from you on WhatsApp — not a buried pre-ticked box.

Note: WhatsApp’s own Business Policy also requires opt-in consent before you send marketing or promotional messages to customers, which aligns with GDPR’s requirements.

What to include in your privacy notice

Under GDPR Article 13, when you collect personal data directly from an individual, you must provide certain information at the time of collection. For WhatsApp customer support, this means your privacy notice should cover:

• Who you are (business name, contact details, and DPO contact if applicable)
• What personal data you collect from WhatsApp conversations (name, phone number, message content)
• Why you collect it and your lawful basis
• How long you retain WhatsApp conversation data
• Whether data is shared with third parties (e.g. your helpdesk platform, cloud storage)
• How customers can exercise their rights (access, erasure, portability, objection)

If you use a website chat widget to receive WhatsApp-style messages, displaying this notice and an opt-in checkbox before the conversation starts (like Resolvenyx’s built-in widget privacy notice) satisfies Article 13 at the point of data collection.

Data Subject Requests (DSRs): what you have to do

Any customer can submit a request to exercise their rights under GDPR. The most common ones you will receive:

Data retention: how long can you keep WhatsApp messages?

GDPR’s storage limitation principle says you may not keep personal data longer than necessary for its original purpose. There is no fixed number, but you need a defined, documented retention schedule.

Typical retention schedules for customer support data:

• Active customer conversations: retain for the duration of the customer relationship
• Resolved support tickets: commonly 1–3 years for after-sales warranty and dispute evidence
• Marketing campaign data (opt-ins, sends): retain for as long as the consent is valid or 2 years from last interaction
• Data of inactive or churned customers: typically 12–24 months, then purge or anonymise

Document your retention schedule in your privacy policy and enforce it automatically if your platform supports scheduled data purges (Resolvenyx’s retention cron runs nightly and purges data past its configured retention period).

Common GDPR mistakes with WhatsApp Business

• Storing messages only on a phone. If your WhatsApp Business app is on a personal or shared phone, data can be lost, accessed by others, or not backed up. Use the API with a proper platform that has access controls.
• No retention schedule. Without a schedule, you will hold personal data indefinitely by default. Define one and enforce it.
• No process for DSRs. If a customer requests erasure and you have no way to find and delete their data across your helpdesk, CRM, and WhatsApp archive, you are exposed. Test the process before you need it.
• Sending marketing messages without consent. The “the customer messaged us once” argument does not constitute GDPR consent for outbound marketing. If you run campaigns, document the opt-in.
• Not having a DPA with your helpdesk platform. Any third party that processes your customers’ WhatsApp messages on your behalf (the platform that connects to your API) must have a signed DPA with you.

The practical checklist

GDPR compliance is not a one-time project — it’s an ongoing practice. The good news is that the operational overhead is low once you have the right platform and processes in place.