Your Customer Group Is a Database: LGPD and GDPR Engineering Notes for Business WhatsApp Groups

An unregistered data store

Ask a data protection team for the list of systems that process customer phone numbers and you will get the CRM, the ticketing tool and the email platform. You will rarely get the WhatsApp groups that sales, support and partner teams created on their own phones. Yet each of those groups is a replicated data store: every member's device keeps a copy of the conversation and of the member list, with no central administration and no deletion API.

Ivan Schroll's report analyses these groups under Brazil's LGPD and the EU GDPR. Its starting point is scope. The LGPD excludes processing by a natural person for exclusively private, non-economic purposes, and the GDPR excludes purely personal or household activity. Neither covers a legal entity acting for its business. A customer community, a reseller group or a support group is in scope, even when the number behind it is an employee's phone.

Role assignment

The organisation that decides to create the group, who joins and what it is for is, as a rule, the controller.
WhatsApp's data processing terms for WhatsApp Business apply to the services described in the Business Terms. For groups created from ordinary accounts, the organisation cannot assume a processor agreement exists.
When a manufacturer and its distributors jointly decide a group's purpose, the EDPB criteria for joint controllership may be met. The paper recommends a written split of who answers member requests and who manages admins.

Lawful basis by use case

Use of the group	Basis to assess	Note
Post-sale support for customers who asked to join	Contract or pre-contractual steps	Limited to what support requires
Optional customer or brand community	Consent or legitimate interest	Legitimate interest needs necessity, transparency and balancing (LGPD art. 10)
Reseller or partner groups	Contract or legitimate interest	Partner contact persons are data subjects
Internal team groups	Employment, legitimate interest	Business app terms say it is not intended for intra-company use
Marketing and promotions	Consent is the common route	Platform opt-in rules also apply

Lateral exposure as a design flaw

The defining property of a group is that members see one another. A customer community of several hundred people is therefore a list of several hundred customer numbers readable by every member, including competitors, former staff still inside and anyone who joined through a leaked link. LGPD principles of necessity, security and prevention (art. 6), the security duty in art. 46, and GDPR data minimisation, integrity and confidentiality (art. 5) with privacy by design (art. 25) all point the same way.

The Business Messaging Policy also says a business may not share information from one customer chat with another customer. Individual cases raised in front of other customers sit badly with that rule.

Retention in a distributed system

Deletion duties (LGPD arts. 15 and 16, GDPR storage limitation) are hard when copies live on member devices. What the organisation can do: enable disappearing messages and restrict changes to admins, remove members whose purpose has ended, and decide whether exports are needed. An export is a text file that cannot be re-imported, and it becomes a new record with its own retention rule.

Engineering conclusion: access control is a compliance control

Inventory first. Register each group with purpose, legal basis, data involved, admins and retention. The paper sees little risk in exotic legal questions and a lot in missing basic documentation.
Minimise visibility. If members do not need to see each other, use announcement-only groups, Communities with an announcement group, or one-to-one conversations.
Control admin access. The creator cannot be removed, admin rights attach to accounts, and ordinary groups have no organisation-wide admin log. You have to build that record yourself.
Include your tools. Automation processes data too, so it belongs in the record of processing. The page on WhatsApp group data collection and privacy compliance lists what an admin can collect and on what basis.
Assign accountability. Admins are people with duties, as discussed in this piece on WhatsApp group admin legal responsibility.

The author notes the paper is not legal advice.

Source: Ivan Schroll (2026), Personal Data Protection in Business-Operated WhatsApp Groups: Controller Duties, Lawful Basis, Phone-Number Exposure, Retention and Incident Response under the LGPD and the GDPR. DOI 10.17605/OSF.IO/ZG9U7

Author: Ivan Schroll (ORCID 0009-0007-0680-5570)