Why WhatsApp and the GDPR come up together
A customer's name, phone number, messages, photos and voice notes are personal data. As soon as you use WhatsApp for your business, you process that data and you are responsible for it under the GDPR, the EU's General Data Protection Regulation. That is true for a one-person business as well as for a company with staff. This page explains the common points in plain language. It is not legal advice: guidance differs per country and per sector, so check with your data protection authority, your trade association or an adviser when you are unsure.
What the GDPR asks of you, in practice
Using WhatsApp for business under GDPR: privacy settings to check
Most of the privacy work on WhatsApp for business is in a few settings on the business phone. They take ten minutes and are worth checking again when a phone changes hands:
- Two-step verification: Settings, Account, Two-step verification. A PIN stops someone from registering your business number on another phone.
- Linked devices: Settings, Linked devices. Log out every computer or tablet you do not recognise or no longer use.
- Contact access: in the phone's own settings, decide whether WhatsApp may read the address book (see below).
- Chat backup: backups to Google Drive or iCloud are not end-to-end encrypted unless you turn on the encrypted backup option in Settings, Chats, Chat backup.
- Disappearing messages: you can set a default timer for new chats, which helps with retention. Keep in mind that customers can still save or screenshot messages.
- Profile and last seen: under Settings, Privacy, choose who sees your profile photo, info and last seen. For a business profile, the business details are meant to be public.
The address book question
A point that data protection authorities and advisers often raise is contact syncing. When you give WhatsApp access to your phone's contacts, it reads the numbers in your address book, including people who never agreed to that. On a business phone the usual advice is to keep only business contacts on it, or not to give WhatsApp access to your contacts at all. You can still chat with customers who message you first; you see their number instead of a saved name.
Forwarding customer messages to a coworker
Sharing a customer's message with the coworker who does the job is normal: they need it to help the customer. The GDPR question is how much they get. The usual shortcuts give away more than needed:
- Handing over the business phone or WhatsApp Web shows every chat, contact and group on that account. See WhatsApp Web for a coworker.
- Screenshots or manual forwarding to a private phone leave copies of customer data on personal devices that you cannot clean up later.
- Forwarding to someone outside your company, such as a freelancer or subcontractor, means sharing data with another party. Agree in writing how they handle it.
A more careful setup gives the coworker only the messages they need, without the customer's phone number, and keeps the conversation on the business number.
How InBetween handles this
InBetween connects to your existing WhatsApp or WhatsApp Business number by QR code or pairing code, as a linked device like WhatsApp Web. It is not the official Meta Business API. Each customer message is forwarded automatically to one coworker, who replies in their own WhatsApp; the customer gets the answer from your business number.
- Customer numbers hidden by default: the coworker sees Customer 1, Customer 2.
- Only new customer messages: the coworker does not get your chat list, history, groups or contacts.
- EU hosting: servers at Hetzner in Germany. Session data is encrypted with AES-256-GCM, and an optional memory-only mode writes nothing to disk.
- Pause: stop forwarding when the coworker is off, for example in the evening.
To be clear about what this means: like WhatsApp Web, InBetween is one of your account's devices, so it processes the messages it forwards and shows them in your dashboard. List it as a service provider in your privacy notice and your records. For the details you need, email in.between.techsolutions@gmail.com. The app dashboard is currently in Dutch. More on the privacy and security page.
Forward customer messages automatically. Replies go back from your number.
Try free for 30 daysA short checklist
- Use a business number, with only business contacts on that phone.
- Add WhatsApp and any connected tools to your privacy notice.
- Turn on two-step verification and review linked devices regularly.
- Give coworkers only the conversations they need.
- Agree with staff not to keep customer photos on private phones longer than needed.
- Delete old chats and media on a fixed schedule.
- Keep sensitive topics, such as health details or ID documents, out of WhatsApp where you can.
When WhatsApp is not the right channel
Being honest: if your sector has strict confidentiality rules, or customers regularly send sensitive data, a channel built for that, such as a client portal or secure email, may fit better than any WhatsApp setup. WhatsApp works well for quick, practical contact: appointments, photos and questions about a job.
| Topic | What it means | Practical step |
|---|---|---|
| Reason to process | You need a lawful basis, such as answering a question or handling an order the customer asked for. | Use WhatsApp for contact the customer started or agreed to, not for unsolicited marketing. |
| Transparency | Customers should know how you use their data. | Mention WhatsApp, and any tools that handle the messages, in your privacy notice. |
| Data minimisation | Collect and share only what you need. | Do not ask for ID copies or health details by WhatsApp unless you really need them. |
| Access | Only people who need the data should see it. | Give each coworker the conversations for their job, not the whole phone. |
| Retention | Do not keep data longer than needed. | Delete old chats and media on a fixed schedule. |
| Security | Protect the data against loss and misuse. | Lock the phone, turn on two-step verification, check linked devices. |
| Service providers | Anyone who processes data for you needs clear agreements. | Check what each provider processes, where, and on which terms. |
Frequently asked questions
Is WhatsApp Business GDPR compliant?
The GDPR applies to how your business uses WhatsApp, not to the app alone. Many small businesses use it with customers by having a clear reason, mentioning it in their privacy notice, limiting access and deleting old chats. Check your sector rules; this is not legal advice.
Can I forward customer WhatsApp messages to an employee?
Sharing a message with the coworker who needs it to help the customer is usually part of normal business. Give them only what they need: the message, not your whole WhatsApp, and preferably not the customer's phone number.
Do I need to mention WhatsApp in my privacy notice?
If you use WhatsApp with customers, it is good practice to say so, including which tools or providers handle the messages for you. Your data protection authority or an adviser can help with the exact wording.
Can my coworker see customer phone numbers?
Not by default. Your coworker sees "Customer 1", "Customer 2" and so on. You can choose to show numbers in the dashboard.