WhatsApp has more than 3 billion users worldwide, with penetration of 75 to 85% in most European countries. For companies, it is an unavoidable channel. But it is also a channel governed by strict legal obligations on data protection (GDPR, the revised Swiss FADP, DSA).
Here is what you need to know before deploying a WhatsApp Business strategy in Europe.
Understanding roles and responsibilities
When you use WhatsApp Business through Sandra, the roles are clear:
- Your company (data controller): you decide the purposes (why, when and to whom messages are sent). You remain the owner of the customer relationship.
- Sandra (data processor): we operate on your behalf, ensuring technical compliance, data security and user privacy.
- Meta / WhatsApp (sub-processor): provides the technical messaging infrastructure.
In short: you are responsible for the legal basis, the "why". We handle security, confidentiality and technical compliance, the "how".
Your main obligations
Obtain consent
You cannot send messages without permission. Under the GDPR and the revised Swiss FADP, marketing messages require explicit consent:
- An unticked checkbox
- Clear language
- Easy opt-out
- Recorded proof of consent
Service or support messages are allowed if the customer initiates contact or if they are necessary to fulfil an order.
Be transparent
Tell your customers what data is collected (number, content, metadata), why it is processed, how long it is kept and what their rights are (access, deletion, objection). A clear privacy notice in your first message or on your website is enough.
Collect only what is necessary
Only ask for information that serves the purpose of the contact. Delete data when it is no longer needed.
Protect the data
WhatsApp encrypts exchanges, but that isn't enough. You must secure your team's access, train your staff, limit access rights, have an incident procedure in place and report any breach within 72 hours if it poses a risk to customers.
Respect user rights
European and Swiss customers can request access to or deletion of their data, correction of errors, portability of their exchanges, or object to certain processing. Requests must be handled within 30 days.
What Sandra puts in place for you
- Enterprise-grade encryption and secure hosting in Switzerland
- Infrastructure compliant with the GDPR and the revised Swiss FADP
- Built-in privacy controls
- A clear, transparent data processing agreement
- Continuous monitoring and updates as the law evolves
We process only the data that is necessary, and never on our own account.
What about the Digital Services Act?
Since February 2024, the DSA has governed large platforms in the European Union. WhatsApp, classified as a "very large online platform" since 2025, is subject to enhanced transparency and moderation rules.
For your company, that changes nothing directly: the DSA applies to Meta, not to you. Your framework remains the GDPR and the revised Swiss FADP for managing customer data.
Pre-launch checklist
Before you start
- Write a clear privacy notice
- Set up consent collection
- Sign the data processing agreement
- Define your retention periods
- Limit internal access
On an ongoing basis
- Document the legal basis for each message type
- Train your teams
- Answer customer rights requests within 30 days
- Review your practices regularly
At every interaction
- Include a link to your privacy policy
- Offer a simple opt-out
- Keep exchanges only as long as necessary
The essentials
WhatsApp Business compliance rests on four simple principles: get permission before making contact, be transparent about how data is used, protect what you collect, and respect users' rights.
This article provides general information and is not a substitute for legal advice. For any specific case, consult a data protection specialist.
Read next
Conversations that convert
A 30-minute demo is enough to see what your WhatsApp channel can produce. In Geneva or by video call.