GDPR and WhatsApp: What Businesses Must Know

If you talk to customers on WhatsApp — booking appointments, taking orders, answering questions — you are processing personal data, whether or not you have ever thought about it that way. Names, phone numbers, addresses, even the personal details a customer volunteers in a message can fall within scope. That is why GDPR and WhatsApp is not a topic reserved for large companies. It matters just as much to the barber, the restaurant owner, the estate agent and the salon.

Let's be clear from the outset: this article is not legal advice. The goal is to explain, in plain language, which topics deserve your attention as a business owner who uses WhatsApp every day. For your own circumstances, speak to a solicitor or a qualified data protection adviser.

What Is GDPR, and Why Does It Apply to a Business on WhatsApp?

GDPR stands for the General Data Protection Regulation. In the UK, the equivalent framework is the UK GDPR alongside the Data Protection Act. Broadly, these rules govern how information about people — name, phone number, address and so on — may be collected, stored and used. "Personal data" here means any information that identifies a person directly or indirectly. If you operate outside the EU or UK, your country almost certainly has a comparable regime, and the principles below tend to rhyme across all of them.

The moment a customer messages you on WhatsApp, you hold at least a phone number and usually a name. Then comes a date of birth for a booking, an address for a delivery, sometimes a health detail. The contact list on your phone, the chat history, the promotional messages you send out — all of that is data processing.

So "I'm a small shop, this doesn't concern me" is a risky assumption. Some obligations do scale with the size and nature of a business, but anyone holding customer data carries baseline responsibilities. Whether extra duties apply to you — appointing anyone specific, keeping formal records, registering with your data protection authority — is worth putting directly to your adviser.

GDPR and WhatsApp: 3 Things to Get Right When Holding Customer Data

It boils down to three headings: transparency, consent and retention.

1. Transparency: your customer should know what their data is for

A privacy notice is simply the formal name for telling your customer, "I'm collecting this for X reason and using it in Y way." If you take a phone number for an appointment, the customer is entitled to understand what that number will be used for.

In practice this means keeping a privacy notice on your website, sending a short note in the first exchange, or displaying the information visibly at your premises. Which method is appropriate and sufficient for your business is a question for your adviser. The point behind all of it is transparency.

2. Consent: critical for anything promotional

Messaging a customer to confirm their appointment is not the same as sending them a discount announcement. The first is a natural part of the service they asked you for. The second is marketing, and as a rule it should not happen without permission obtained in advance.

Electronic marketing usually sits under its own rules too — in the UK, PECR; across the EU, the ePrivacy rules as implemented locally. So "I've got their number, I'll message whatever I like" can land you in trouble on two fronts at once: data protection and marketing rules. Get expert input on how to collect consent and how to keep a record of it.

3. Retention: keep what you need, don't hoard the rest

The basic logic is this: you keep data for as long as the purpose you collected it for still exists, and no longer. Stockpiling details of customers who came in once, years ago, and never returned is a risk both legally and practically.

Picture a salon receiving 40 messages a day — this is purely a hypothetical scenario. Within a few years you have thousands of numbers, chat threads and booking histories. If nobody reviews that pile periodically, answering "why are we still holding this?" becomes very hard. Asking yourself "do I still need this information?" at set intervals is a good habit.

Bulk Messaging: Mind the Spam Risk

Bulk messaging is where businesses trip up most often. There are two distinct risks here, and it helps to separate them.

First, the legal risk: an unsolicited promotional message can attract complaints under both data protection rules and electronic marketing rules.

Second, the practical risk: WhatsApp has its own terms of use. If enough recipients report you as spam, your number can be restricted or banned outright. Losing the business line you have used for years is not worth any campaign.

So what should you do? Split your messages in two:

Service messages: booking confirmations, appointment reminders, order updates — the messages your customer is expecting. These are a natural part of the conversation. For how to word them well, have a look at our appointment reminder message examples.
Promotional messages: campaigns, discounts, new product announcements. Prior consent is essential here, and you must give people a straightforward way to say "stop sending me these."

A Practical Checklist for Compliant WhatsApp Use

Treat the list below as a starting point, and work through the specifics of your business with your adviser:

Have a privacy notice. Give customers somewhere to find out what their data is used for.
Get consent for marketing, and record it. Being able to show who consented, when and how, matters.
Separate the business line from personal phones. Customer conversations scattered across staff mobiles are hard to control.
Don't ask for data you don't need. If a booking doesn't require an address, don't ask for one. Less data, less risk.
Review old data regularly. Don't accumulate information that no longer serves a purpose.
Keep the exit door open. When someone opts out, remove them and never send promotions again.
Limit access. Know who can see customer conversations, and revoke access when staff leave.

Using an AI Assistant or Automation? Here's What to Check

Handing your WhatsApp conversations to an automation tool or an AI assistant does not hand over your responsibility for the data. Whatever tool you use, the duty to your customer stays with your business. So when choosing one, get clear answers to these questions: who can see the conversations? Am I still in control — can I take over a chat whenever I want? Our guide to choosing WhatsApp automation covers the selection criteria in more depth.

The answers vary from tool to tool. With WpAsis, for example, the assistant connects to your existing WhatsApp line via a QR code, so no technical knowledge is needed to set it up. It draws its answers from your own knowledge base, you watch every conversation from the dashboard, and you can step in as a human at any moment. In other words, even with automation running, control of the conversation stays with you — and from a data protection standpoint that is the heart of it: being able to see what is happening and intervene.

One final reminder: everything above is general information. Drafting a privacy notice, building consent processes and setting retention periods all vary from business to business. For anything definitive, consult a legal professional.

Frequently Asked Questions

Does sending bulk promotional messages on WhatsApp breach GDPR?

Sending promotional messages to people who never consented creates risk under both data protection rules and electronic marketing rules such as PECR. On top of that, if you are reported, your WhatsApp number may be restricted. The safest route is to build your consent collection and record-keeping process with an expert.

Is saving a customer's number to my phone enough, or do I need to do more?

Saving the number is just the practical side. What matters from a data protection perspective is that the customer knows what their data is used for, that you have permission for additional uses like marketing, and that you don't keep the data longer than necessary. Work through these three headings with an adviser.

Is using WhatsApp Business alone enough for compliance?

No. WhatsApp Business is a communication tool. It gives you business features like catalogues and automated greetings, but it does not discharge your data protection obligations for you. Transparency, consent and retention processes are still yours to build. If you want to know what the app actually offers, we covered it in detail in a separate post.

If I use an AI assistant, who is responsible for the data?

The responsibility to your customer stays with your business — the assistant is a tool working on your behalf. That is exactly why it matters to pick a solution where you can monitor conversations, take over when you choose, and keep control. Clarify the contractual and liability details with your adviser.

If you want to use WhatsApp in your business both efficiently and under control, take a look at WpAsis. The assistant connects to your existing line via QR, answers messages around the clock, and you watch every conversation from the dashboard and take over whenever you like. For current pricing: wpasis.com