Running a WhatsApp chatbot in the EU means handling personal data — names, phone numbers, conversation history. The GDPR (General Data Protection Regulation) sets strict rules about how this data must be collected, stored and processed. The good news: compliance is achievable and doesn't require a lawyer on retainer.
This guide covers everything European businesses need to know.
What Data Does a WhatsApp Chatbot Collect?
A typical WhatsApp AI chatbot processes:
- Phone numbers — visible to you as a WhatsApp Business API user
- Display names — the name the user has set in WhatsApp
- Message content — the full text of conversations
- Metadata — timestamps, message IDs, delivery status
- Any information volunteered — email, address, order details collected during conversation
All of this is personal data under GDPR, regardless of whether it seems sensitive. This means you need a lawful basis to process it.
Lawful Basis for Processing WhatsApp Conversations
Under GDPR Article 6, you need at least one of six lawful bases to process personal data. For WhatsApp chatbot conversations, two are most commonly applicable:
Legitimate Interest (Article 6(1)(f))
When a customer contacts your business via WhatsApp asking about your services, you have a legitimate interest in responding and keeping a record of that conversation. This covers most routine customer service interactions.
Contract Performance (Article 6(1)(b))
If the conversation leads to a booking, order or service agreement, processing the data is necessary to fulfil that contract. This applies to booking confirmations, order management, appointment reminders.
Important: You do NOT need explicit opt-in consent for every single WhatsApp conversation. Consent (Article 6(1)(a)) is required when you want to use data for marketing purposes beyond the original transaction — for example, adding them to a broadcast list.
What You Must Tell Customers
Transparency is a core GDPR principle. Before or at the start of a chatbot conversation, customers should be able to access:
- Who is processing their data (your business name and contact)
- What data is being collected and why
- How long the data is retained
- Their rights (access, deletion, portability, objection)
- Whether data is shared with third parties (e.g., the AI provider)
This doesn't mean reading a legal notice aloud in every chat. A short message at the start — "This conversation is handled by an AI assistant. Your messages are stored for 12 months to improve our service. See our Privacy Policy at [link]" — combined with a full privacy policy on your website is sufficient for most businesses.
Data Retention: How Long Can You Keep Conversations?
GDPR's storage limitation principle (Article 5(1)(e)) requires that data be kept for no longer than necessary for the purpose for which it was collected.
Practical guidelines:
- Customer service conversations: 12 months is a defensible retention period for most businesses
- Transaction-related data: 5–7 years may be required for tax/accounting purposes
- Marketing consent data: Keep for as long as the marketing relationship exists, then delete promptly
Ensure your chatbot platform lets you set and enforce retention periods — and that data is automatically purged when it expires.
Third-Party Processors: Your AI Provider
If your chatbot is powered by an AI provider (e.g., Claude by Anthropic, GPT-4 by OpenAI), that provider is a data processor under GDPR. You are the data controller. This means you need:
- A Data Processing Agreement (DPA) with the AI provider
- Clarity on where data is processed (EU servers preferred; US processors are permitted under Standard Contractual Clauses)
- Confidence that the provider won't use your customers' data to train its models
WhatIBot uses Anthropic's Claude API, which provides a DPA. Conversation content is not used for model training. All customer data is stored in Supabase EU-region infrastructure.
Broadcast Messages and GDPR
This is where many businesses slip up. Sending a promotional WhatsApp message to a list of past customers requires prior opt-in consent under GDPR, plus:
- The ability for recipients to opt out easily (one reply = removed from list)
- A record that consent was given (with timestamp)
- Relevance to what they consented to receive
Never add contacts to a broadcast list without explicit consent. The fines for unlawful direct marketing under GDPR can reach €20 million or 4% of annual turnover.
Your Compliance Checklist
- ☑ Privacy policy updated to mention WhatsApp data processing
- ☑ DPA signed with all third-party processors (AI provider, database host)
- ☑ Retention period defined and enforced in your chatbot platform
- ☑ Customers can request data deletion (respond within 30 days)
- ☑ Broadcast lists only contain opted-in contacts
- ☑ No sensitive data (health, financial) collected unless specifically required and consented
- ☑ Data breach notification procedure in place (72-hour deadline to report to your DPA)
Bottom Line
GDPR compliance for a WhatsApp chatbot is not complicated for most SMBs. The core requirements are: be transparent about what you collect, have a valid reason to process it, keep it only as long as needed, and get explicit consent before marketing. Follow those principles and you're in good shape.
WhatIBot is built to be GDPR-compliant by default — data in EU infrastructure, configurable retention, opt-out support built in. Start your free trial or read our Privacy Policy for full details.