Business messaging under a modern data protection regime
A phone number is personal data and so is what was said. The four things a messaging business has to be able to answer: why are you allowed to hold it, what did they agree to, how long are you keeping it, and where does it go.
Not legal advice, and the details differ by jurisdiction. This is the engineering shape of the obligations - what a system has to be able to do - rather than an interpretation of any particular statute.
Lawful basis, in practice
| Message | Usual basis | So |
|---|---|---|
| Order confirmed, shipped, delivered | Performance of a contract | No separate consent needed |
| Appointment reminder | Contract, usually | Same |
| Offer, newsletter, re-engagement | Consent | Needs a real opt-in, evidenced |
| Security or account notice | Legitimate interest or legal obligation | Keep it genuinely about the account |
The row that causes trouble is the third, and the specific failure is attaching an offer to a transactional message. A message that is half receipt and half advertisement is an advertisement, and the basis for the receipt does not carry it.
What the system has to be able to do
- Record consent with evidence. When, where, what wording, for what purpose - separately per purpose. See opt-in.
- Honour a withdrawal immediately, permanently, without a person in the loop - and keep the opt-out record forever, which is the row people delete.
- Produce everything about one person on request.
- Delete on request, everywhere it went.
- Show who accessed what, if asked.
Cross-border transfer
Most messaging infrastructure is not in your country. Meta processes the message, your provider may host outside, your object storage is somewhere with a region name. This is normal and generally permissible with the right arrangements - what is not acceptable is not knowing. Be able to say where customer data is stored and processed, because it is the first question any serious customer's procurement asks.
Appoint somebody, write it down
A named person responsible, a short document saying what you collect and why, and a record of the processing you do. For a small business this is a page, not a project - and the alternative is assembling it under a deadline while also answering the request that prompted it.
Questions people actually ask
Do I need consent to message a customer about their order?
Usually not consent specifically - performance of a contract is typically the basis for messages about something they bought. Marketing is different and normally needs consent.
Is a phone number personal data?
Yes, under essentially every modern regime, and so is the content of the conversation.
Njiwa
One inbox for WhatsApp, Facebook and Instagram, and an API that sends over either WhatsApp rail. 7 days free, no card.