Blog

LGPD in WhatsApp service: what your business needs to do

Published on October 04, 2026

Answering customers on WhatsApp means handling personal data, and Brazil’s LGPD applies just as it does to any internal system.

Whoever serves the customer is the data controller.

You need to know why you keep the data, for how long, who you share it with and how to delete it when the customer asks.

The minimum the law asks for

  • Purpose: know what the data is for, and don’t use it for anything else.
  • Legal basis: service and contract performance cover most cases. Offers and notices need consent, which the customer can withdraw.
  • Transparency: a written policy, easy to find, in plain Portuguese.
  • Security: access only for those who need it, with a log of who got in.
  • Rights: respond to requests for access, correction and deletion.

What changes on WhatsApp

  • The chat lives in the business WhatsApp, which is the main source, and it is not only yours: Meta processes that data.
  • Your internal records should sit in your own database, with controlled access.
  • Anyone who processes data for you, like a cloud or language model provider, must be listed in the policy.
  • In our service, those records are stored in our system, with a full export if you leave.
  • Sending data outside Brazil needs a legal basis, and the policy must explain how it is handled.

Sensitive health data

Clinic chats include health data, which is sensitive.

That calls for extra care: record only what you need, limit access and avoid keeping clinical details in a channel that doesn’t need them.

What to do in practice

  1. Write the policy and publish it at a fixed address.
  2. List everyone who processes data on your behalf.
  3. Limit internal access and log who got in.
  4. Set a retention period, and stick to it.
  5. Have a way to handle deletion requests.

How we handle it

The chat stays in your business WhatsApp, and the records are stored in our system, with a full export if you leave.

The site’s privacy policy explains what we do, and anyone can check it before signing up.

Sources