Blog / Guide

GDPR and WhatsApp Business: 2026 compliance guide

GDPR compliance for WhatsApp Business is the topic many companies put off until a complaint arrives or, worse, a dispute. Yet the rules are clear and manageable: if you collect phone numbers and send commercial communications, you are processing personal data, and you must do it with valid consent, a transparent privacy notice and proper handling of users' rights. This guide explains in practical terms what you need to use WhatsApp compliantly in 2026, without alarmism and without replacing a lawyer's advice.

WhatsApp and personal data

A phone number is personal data in every respect. The moment you save it in a company address book and use it to send messages, you are a data controller with specific obligations. This doesn't mean WhatsApp is off-limits for businesses: it means it must be used with the same care you'd apply to an email list or a customer database. The difference is that WhatsApp is more personal, so the sensitivity should be raised too.

Marketing consent

The heart of compliance is consent. To send promotional communications on WhatsApp you must have consent that is freely given, specific, informed and unambiguous. 'Freely given' means not forced; 'specific' means referring precisely to that type of communication; 'informed' means the user knows what they'll receive; 'unambiguous' means a clear positive action, not a pre-ticked box. A customer who spontaneously messages you for information has not, by that fact alone, given consent to receive promotions.

How to collect consent the right way

• Widget or form: a dedicated (not pre-ticked) box for consent to WhatsApp communications.
• At checkout: an option separate from accepting the purchase terms.
• In chat or via QR: a message explaining what you'll send and asking for explicit confirmation.
• Always: keep a record of when and how consent was given (documentable proof).

The privacy notice

Before collecting the number you must inform the user: who you are (controller), why you process the data (purpose), on which legal basis, how long you keep it and what rights they have. The notice must be accessible and understandable, not a wall of legal text hidden away. If you use WhatsApp for different purposes - support and marketing, for example - explain both clearly.

Data retention and users' rights

You can't keep data forever: it must be held for the time necessary for the stated purposes. And you must be ready to respond to the rights of data subjects: access to their data, rectification, erasure (right to be forgotten) and, above all, objection and withdrawal of consent. In practice, a user must be able to say 'I no longer want to receive your messages' as easily as they gave consent, and you must stop immediately.

Make unsubscribing simple and visible. A practical way is to invite the user to reply with a keyword (for example STOP) and use that signal to apply an opt-out tag that excludes the contact from future campaigns.

Marketing and support: two different bases

It's important to distinguish. Replying to a customer who messages you for support generally rests on different grounds than sending unsolicited promotions: the first is a conversation the customer started, the second is active marketing that requires consent. Keeping these two worlds separate - even with different tags in the address book - helps you avoid sending promotions to those who only wanted support, which is both good practice and legal protection.

How to do it with SendApp

SendApp gives you the tools to handle compliance operationally: you collect contacts from the widget, checkout or via QR by attaching a consent tag, you distinguish in the CRM who has given marketing opt-out and who hasn't, and you use tags to exclude users who objected from broadcast campaigns. Promotional communications on official WhatsApp API go through Meta-approved templates, which add a further layer of control. Remember that SendApp is a tool and does not replace the advice of a legal consultant on your specific situation. Plans start at 19 euros per month.