Data protection for a WhatsApp bot: who holds what, and for how long

Most guidance on this subject is a checklist of things to add to a privacy notice. That is the least interesting part, and it is not where anybody actually gets into trouble.

The problems that bite are structural: not knowing what you are holding, not knowing who else holds a copy, using the wrong lawful basis for the messages you are sending, and having no way to answer when somebody asks for everything you have about them. All four are decided by how the thing is built, which makes this a design question rather than a documentation one.

What we'll cover

• What a messaging bot actually processes
• Who is controller and who is processor
• Lawful basis, and the service-versus-marketing line
• Consent that would stand up
• Building it with CodeWords
• Answering a subject access request
• Retention, which nobody chooses
• Special category data arrives uninvited
• Telling people, in a way they will read
• Making it survive
• Limits worth knowing about
• What to do first
• Frequently asked questions

What a messaging bot actually processes

More than people assume, and the extras are the ones that get forgotten.

The phone number, which is personal data on its own and is also an identifier that persists across every system it touches.

The message content, including everything the customer volunteered that you never asked for.

Media. Photographs of a house, a passport, a rash, a bank statement. People send these unprompted and they sit wherever media lands.

Metadata. When they messaged, how often, whether they read yours.

Anything the model inferred. A conversation summary or a derived score is personal data too, and it is the category most often left out of a data map.

The profile name the account carries, which is frequently a real name.

Write that list for your own bot before doing anything else. Most people find two or three categories they had not considered, and the media one is usually the surprise.

Who is controller and who is processor

This determines who answers for what, and it needs settling in writing.

For the messages you decide to send and the purposes you use them for, you are almost certainly the controller. Your automation platform processes on your instructions and is a processor for that activity. Meta operates the messaging platform and has its own role in respect of the service it provides.

Two practical consequences. You need a contract with any processor that lets you get information back from them, because controllers are responsible for complying with subject access requests and a processor must help you meet that obligation (ICO). And you need to know where the data physically goes, because a processor operating outside the UK brings transfer requirements with it.

Ask your vendors directly: where is it stored, who can access it, what happens on termination, and how would you get it back.

Lawful basis, and the service-versus-marketing line

The distinction that catches most businesses.

Messages about work you are doing for somebody sit comfortably. A booking confirmation, a delay, an invoice, a request for the information you need are all part of providing the service.

Messages promoting something are different, and for electronic marketing the rules are stricter than general data protection. Under PECR, limited companies and limited liability partnerships are corporate subscribers, while individuals, sole traders and ordinary partnerships are individual subscribers who need consent or the soft opt-in (ICO).

The grey area is the reminder that is genuinely useful and also generates business. An MOT reminder, a recall, a check-up prompt. Where the contact relates to a service the customer has had, that is usually defensible; where it is an offer of something new, treat it as marketing and apply the rules. If you find yourself constructing an argument for why an offer is really a service message, you have answered the question.

Consent that would stand up

Where you do rely on consent, it has to be worth something.

Freely given. Not a condition of getting the thing they came for.

Specific. Consent to appointment reminders is not consent to a monthly newsletter.

Unbundled. Separate from terms and conditions.

Recorded. What they agreed to, when, and how. Consent you cannot evidence is consent you do not have.

Withdrawable as easily as it was given. If one message opted them in, one message opts them out.

The recording is the part that gets skipped. A note that somebody ticked something on a form in 2024 is not a record; the wording they saw, the date, and the mechanism are.

Building it with CodeWords

CodeWords connects to more than 3,000 integrations, and the connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: what is collected, where it is written, what triggers each message, and what an opt-out does.
3. Authorize the connections to whatever holds your customer records and your WhatsApp Business Platform account, keeping the number of places data lands as small as you can.
4. Describe the exceptions: somebody who has opted out, somebody who has asked what you hold, somebody who has sent something you never asked for.
5. Before switching it on, list every place a message or an image can end up, because the copies you forget are the ones that cause problems later.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Answering a subject access request

Somebody asks what you hold about them. You have one month, extendable by up to two further months where the request is complex or where you have received several (ICO).

A request does not have to use any particular words or be sent to a particular address. It can arrive as a message in the chat itself, which is the scenario nobody plans for.

To answer, you need to find everything keyed to that person across every system a conversation touched: the messaging platform, your automation, your CRM, your ticketing, your backups. That is difficult in a setup nobody mapped, which is the argument for mapping it while it is small.

Two things to work out before you need them. How to search by phone number across every store. And how to redact other people, since a thread mentioning a third party cannot simply be exported wholesale.

Retention, which nobody chooses

The default with messaging is to keep everything forever because no one decided otherwise, and that is its own problem: personal data should not be kept longer than necessary for the purpose.

Set a period per category rather than one for everything. Conversations, media, derived summaries, and the customer record proper have genuinely different useful lives. Media is usually the one to be strictest about.

Then actually apply it. An undeleted archive is the same risk whether or not a policy document says otherwise, and the policy makes it worse rather than better.

Note the tension with commercial records. An invoice may need keeping for years while the conversation that produced it does not. Separating the record from the chat is what lets you keep one and delete the other.

Special category data arrives uninvited

You do not have to ask for health information to end up holding it.

A customer explaining that they cannot make an appointment because of a hospital admission has just sent health data. Someone sending a photograph of an injury, a prescription, a child. None of it was requested and all of it is now in your systems.

Three habits deal with most of it. Do not ask for it in automated flows, ever. Where it arrives anyway, get it out of the conversation and into whatever properly controlled record you keep, or delete it. And tighten retention on media specifically, since that is where the sensitive material concentrates.

Where your business handles this routinely, the automation should route it to a person rather than processing it, which is both safer and usually better service.

Telling people, in a way they will read

Two moments matter more than the privacy notice.

The first message. Say who you are, that it is an automated assistant, what you do with what they send, and how to reach a person. Four short lines, and it does more real work than a linked policy.

The opt-out. Say how, in the message, every time you send something they could reasonably want to stop.

Keep a proper notice as well, and link it. The point is that the notice is where somebody looks for detail, while the first message is where almost everybody actually forms their understanding.

Making it survive

Map every place data lands, and update it when you add an integration.

Keep the consent record, including the wording people saw.

Test a subject access request on yourself before a real one arrives.

Apply retention automatically, since a policy nobody executes is worse than none.

Review annually, or whenever you add a system.

Limits worth knowing about

The platform's own processing is not yours to control, and your obligations sit alongside it.

Consent does not fix a purpose you should not be pursuing.

Deleting from your systems does not delete the customer's copy of the conversation.

Rules differ by jurisdiction, and a business messaging across borders has more than one regime to satisfy.

Compliance is not a feature. Saying you take privacy seriously in a first message is worth nothing unless the retention actually runs.

What to do first

The data map. One page listing every category you process, every system it lands in, and how you would find it all by phone number. It takes an afternoon and it is the prerequisite for everything else here, including answering the first request that arrives.

Two habits make the difference. Choose a retention period per category and make something apply it, because keeping everything forever is a decision made by not deciding. And put the honest four lines in the first message, since what people understand about your data handling is formed there rather than in a policy nobody opens.

Frequently asked questions

What personal data does a WhatsApp bot process?

The phone number, message content including whatever people volunteer, media, metadata about when and how often they message, anything inferred such as a summary or score, and the profile name.

Am I the controller or the processor?

For the messages you decide to send and why, you are almost certainly the controller. Your automation platform is a processor acting on your instructions, and the messaging platform has its own role for the service it provides.

Which lawful basis applies?

Messages about work you are doing for somebody sit with the service you are providing. Promotional messages are marketing, and electronic marketing to individuals, sole traders and ordinary partnerships needs consent or the soft opt-in under PECR.

What makes consent valid?

Freely given, specific, unbundled from terms, recorded including the wording people saw, and as easy to withdraw as to give.

How long do I have to answer a subject access request?

One month, extendable by up to two further months where the request is complex or where you have had several. It can arrive as a message in the chat and does not have to use particular words.

How long should conversations be kept?

Set a period per category rather than one for everything, be strictest with media, and make something apply it automatically. Keeping everything indefinitely is a decision made by not deciding.

What if someone sends health information I never asked for?

Get it out of the conversation into a properly controlled record or delete it, never solicit it in automated flows, and where it happens routinely route those messages to a person.

Do I need a privacy notice?

Yes, and the first message does more practical work: who you are, that it is automated, what happens to what they send, and how to reach a person.

What should I ask a vendor?

Where data is stored, who can access it, what happens on termination, how you would get it back, and whether the contract lets you obtain what you need to answer a subject access request.

Does deleting my copy delete theirs?

No. The customer keeps their side of the conversation on their own device, which is worth remembering before assuming a deletion has removed something entirely.

Related reading

• Payments inside a conversation
• What a bot should remember
• Putting conversations into a CRM