WhatsApp at work: fast – and done right.

WhatsApp is fast, costs nothing extra and everyone knows how to use it. That’s why trade businesses, field service teams, cleaning companies, property managers and home care services all rely on it. But as soon as the messenger is used for work, the General Data Protection Regulation (GDPR) applies whenever personal data of people in the EU is involved – and it applies to the business, not to the individual employee. The good news: with a clear separation, a few settings and written rules for your team, you can significantly reduce the biggest risks.

Why the GDPR applies at all

The GDPR protects personal data – anything that can be linked to a person: name, phone number, address, but also a photo of a doorbell nameplate or a voice message with a recognizable voice. Between friends, this hardly matters. But if you use WhatsApp for your business, your company is the “controller” and must be able to explain which data you process, for what purpose, on what legal basis and how you protect it. That’s true even if employees use their own phones.

The real problem: contact syncing

The most sensitive point usually isn’t the chat itself, but the address book. If WhatsApp has access to your contacts, the phone numbers in your address book are shared with the provider – including those of people who don’t use WhatsApp and never agreed to it. In a business context, that’s hard to justify. Typical solutions:

• —Deny WhatsApp access to contacts in your phone settings and start chats via the number.
• —Only save contacts on the company phone who have agreed to communicate via WhatsApp.
• —Keep business contacts in a separate space, for example a work profile, which many smartphones offer – ask your IT provider if in doubt.

WhatsApp or WhatsApp Business?

For customer contact, WhatsApp Business is usually the better choice. You get a business profile with address and opening hours, can set up away messages and quick replies, and sort chats with labels. Most importantly, it cleanly separates your business from your personal WhatsApp. The business app alone doesn’t solve the underlying data protection issue, though: you should still check contact access and set clear rules. For larger teams with lots of inquiries, there’s also the WhatsApp Business Platform, usually connected via specialized service providers.

Company phone or personal phone?

The cleanest solution is a company phone used only for work. Then contacts and chats belong to the business, you can set the settings, and when someone leaves, the device stays. If your team uses personal phones (“bring your own device”), it gets harder: you can hardly control which data ends up where, and personal and business contacts get mixed up. If personal devices are unavoidable, at least put in writing which data doesn’t belong there and what happens when someone leaves.

Consent and transparency

If a customer messages you on WhatsApp first, that’s a clear sign they want to communicate that way. Still, be transparent: mention WhatsApp in your privacy policy, always offer an alternative like phone or email, and don’t message anyone on WhatsApp out of the blue just because their number is in your system. For marketing messages, you need explicit consent. As for employees: nobody should be forced to install WhatsApp on their personal phone to be reachable for work.

What never belongs in a WhatsApp chat

Some data is so sensitive that it should never be sent through a consumer messenger. This includes:

• —Health data – diagnoses, sick notes with reasons, medications, test results, photos of injuries
• —Bank details, credit card numbers and account login credentials
• —Copies of ID cards and passports
• —HR documents such as salaries, written warnings or job applications
• —Customers’ passwords, alarm codes and key hiding spots

The GDPR is especially strict about health data (Art. 9 GDPR). If you work in home care or a medical practice, use the channels intended for patient and client communication – such as the certified secure messaging of your national health system.

Team rules that work in real life

Most data protection slip-ups don’t happen out of bad intent, but out of convenience: the photo of the damage goes into the big team group, the door code ends up in the chat because it’s urgent. Short, clear rules help more than a twenty-page document nobody reads. These have proven themselves:

1. 01One company number for customers, separate from personal use.
2. 02Groups only as big as necessary – one per job site, route or property instead of one group for everyone.
3. 03Move photos and documents to the job file promptly and delete them from the chat.
4. 04No sensitive data in the chat – call instead or use a secure channel.
5. 05Check automatic cloud backups of chats and decide deliberately whether they should be on.
6. 06Screen lock and, where possible, remote wipe on all company phones.
7. 07When someone leaves: exit groups, hand over business chats, return the company phone.

Data minimization: less is safer

A core principle of the GDPR is data minimization: only process what you really need for the purpose, and delete what you no longer need. For WhatsApp, that means in practice: not every voice message has to sit in the chat for months. Important information belongs in your actual system – job file, customer database, business software – and the chat can be cleaned up afterwards. If you clear out chats regularly, you also have less to lose if a phone goes missing.

Services around WhatsApp: don’t forget the DPA

If you use additional services that process content from your chats – for transcription, ticketing systems or customer service platforms, for example – these providers process personal data on your behalf. For that, you usually need a data processing agreement (DPA) under Art. 28 GDPR. Also check where the data is processed, whether it’s stored and for how long. A trustworthy provider answers these questions without beating around the bush.

One example is Summarize.One: voice messages and summaries are only processed and deleted right afterwards, whatever the service needs runs on servers in the EU, and the Business plan comes with a DPA. Important: a data-minimizing add-on doesn’t automatically make your WhatsApp use GDPR compliant. You still need the rules above.

At a glance

Template: messaging policy for your team

Copy this template, adapt it to your business and have your team sign it. It’s deliberately short so people actually read it. If in doubt, have your data protection officer review it.

Messaging policy for [company name]
As of: [date]

1. Devices
For work, we communicate via [company phones / WhatsApp Business on the company number]. Customer contact via personal numbers is not intended.

2. Contacts
On company phones, WhatsApp has [no access to the address book / access only to contacts who have consented].

3. Groups
Groups exist only per [job / route / property]. Anyone no longer involved leaves the group.

4. What doesn’t belong in the chat
Health data, bank and login details, ID copies, HR documents, door codes and key hiding spots. For this kind of information, we call or use [secure channel].

5. Filing and deleting
Photos, measurements and agreements are transferred to [system / job file] within [X days] and then deleted from the chat.

6. Security
All devices have a screen lock. Loss or theft is reported to [contact person] immediately.

7. Add-on services
New apps or bots that process chat content are only used after approval by [contact person].

8. Leaving the company
When leaving, business chats are handed over, groups are exited and company devices are returned.

Questions to: [name, contact]

Read and understood: ____________________

What this means for your industry

• —Trades: bundle customer requests in WhatsApp Business, move photos of the damage to the job file promptly.
• —Field service and sales: don’t leave visit reports sitting in the chat – transfer them to your CRM.
• —Commercial cleaning and property management: no key hiding spots or alarm codes by message, groups per property.
• —Home care and medical practices: organization without personal data is the limit. Client and patient data belongs in the certified secure messaging of your national health system or other systems designed for it.