WhatsApp API Data Privacy: GDPR, DPDP and Retention
A customer asks you to delete everything you hold about them. A security questionnaire asks where WhatsApp messages are stored. Legal asks whether Meta is your processor. Each is a WhatsApp API data privacy question, and the answers are scattered across Meta's docs, your provider's terms and two very different laws.
The useful surprise: Meta keeps message data briefly. The long-lived copies sit with your provider and in your own systems, so most of the work is yours.
This is a practical overview of how data flows on the WhatsApp Business Platform, with the basics of the EU's GDPR and India's Digital Personal Data Protection (DPDP) Act. It is not legal advice. Laws and Meta's terms change, so confirm the specifics with a qualified lawyer for your situation.
Key takeaways
- On Cloud API, Meta says it acts as your processor and keeps messages for at most 30 days.
- Your provider, CRM, logs and warehouse usually keep far more, for longer.
- You need a lawful basis, a privacy notice, processor agreements, retention rules and deletion that reaches every copy.
Who is responsible for what
Under both GDPR and the DPDP Act, the business that decides why and how customer data is used carries the main duties. For WhatsApp, that is you.
| Party | Typical role | What it holds |
|---|---|---|
| Your business | Controller (GDPR) or Data Fiduciary (DPDP) | Everything you store: CRM records, logs, exports |
| Meta, providing Cloud API | Processor or service provider acting for you, in Meta's words | Messages for up to 30 days, plus identifiers |
| Meta, for safety and integrity | Independent controller for those purposes, per its platform terms | Data needed to enforce its terms and policies |
| Your BSP or Solution Provider | Usually your processor | Whatever its terms say, often full history |
| Other tools (helpdesk, CRM, AI vendor) | Your processors | Whatever you sync to them |
Meta's data privacy and security page states that, where privacy law recognises the concepts, Meta acts as a data processor or service provider for the business when providing Cloud API, using messages only on your behalf and at your instruction. It also says Cloud API won't automatically use messages to inform the ads a person sees. Meta's platform terms add that Meta may act as a controller for safety, security and integrity.
What Meta stores, and for how long
As of October 2026, from Meta's own documentation:
| Data | Retention on Cloud API |
|---|---|
| Message content | Maximum 30 days, for features such as retransmission; encrypted at rest |
| User identifiers used to route messages | Deleted within 30 days of the message's last status update, unless directed otherwise |
| Media you upload | Persists for 30 days unless you delete it earlier |
| Media IDs in webhooks | Expire after 7 days; download URLs expire after 5 minutes |
| Contact book (phone number and BSUID) | Kept until you disable the feature, which deletes it, or deactivate your account |
| Business details | Kept in Meta Business Suite under Meta's terms |
Where it's processed. In Meta data centres by default. Meta's local storage option keeps message content at rest in a chosen country, with in-use processing elsewhere for up to 60 minutes on Cloud API. Regions include India, the EU (Germany), the UK, Singapore, Brazil and others. It's set per phone number, only while the number is unregistered.
Certifications and transfers. Meta says it holds SOC 2 Type II and ISO 27001 reports, and relies on GDPR-compliant mechanisms for EU and UK transfers, with a WhatsApp Business Data Transfer Addendum for European and UK customers.
Also note: Meta offers no API to fetch historical webhook data. If you want history, you store it, which makes you or your provider the long-term holder.
What your provider and your own stack keep
Usually far more than Meta. Inbox tools keep full history, webhook pipelines log payloads, analytics jobs copy messages to warehouses and staff export chats to spreadsheets. Each copy needs a purpose, a retention period and a way to delete it.
Questions to put to any WhatsApp provider before you sign:
- Where is our data hosted, and can we choose the region?
- How long do you keep messages, media and logs, and can we set our own retention?
- Will you sign a data processing agreement, and where is your sub-processor list?
- Do you use our customers' messages to train AI models? Meta's platform terms restrict using WhatsApp Business Platform data for training, as our guide to the WhatsApp AI chatbot policy explains.
- Can you delete one contact's data on request, including from backups, and how fast?
- How and how quickly will you tell us about a breach?
Weighing a provider against going direct? See WhatsApp Cloud API vs a BSP.
GDPR basics for WhatsApp data
If you message people in the EU or UK, these are the usual starting points:
- A lawful basis per purpose. Order and delivery updates usually rest on performing a contract; marketing usually needs consent, and national e-marketing rules can add requirements. Our guide to the WhatsApp Business API opt-in policy covers Meta's side of consent.
- Transparency. Your privacy notice should say you use WhatsApp and who processes the data. Meta's Business Messaging Policy separately requires you to maintain a published privacy policy.
- Processor contracts. GDPR requires a contract with each processor. Meta's processor terms are linked from its privacy page; your BSP and other tools need their own.
- Data subject rights. People can ask for access, correction and erasure, and you generally have one month to respond.
- Breaches. Notifiable breaches go to your supervisory authority within 72 hours of becoming aware.
- Storage limitation. Keep data only as long as the purpose needs it.
India's DPDP Act basics
The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. The DPDP Rules, 2025 were notified on November 13, 2025, and the government's press release describes an 18-month phased compliance timeline, which puts most core duties around May 2027. MeitY has consulted on shortening that timeline, so check the current position.
The points that matter for WhatsApp data, per the government's summary:
- Roles. You are the Data Fiduciary; Meta and your provider act as Data Processors; your customer is the Data Principal.
- Notice and consent. Consent notices must be standalone, clear and simple, and explain the specific purpose. Consent Managers, if used, must be Indian companies.
- Rights. Individuals can access, correct, update and erase their data and nominate someone to act for them. Requests must be answered within a maximum of 90 days.
- Breaches. You must promptly inform affected individuals in plain language, explaining what happened, its likely consequences, what you've done and who to contact. The Data Protection Board must be told too.
- Penalties. The Act's schedule allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify a breach.
Meta's local storage option includes India (IN) for message content at rest.
A retention and deletion plan that works
- Map every copy. List each place WhatsApp data lands: Meta, provider, CRM, helpdesk, logs, queues, warehouse, backups, exports.
- Set retention per data type. For example: support chats kept 24 months unless a dispute is open, raw webhook logs 14 days, media 90 days. Pick periods you can justify.
- Minimise at the source. Don't log message bodies or phone numbers in application logs; log message IDs instead.
- Build one erasure job. It should delete the contact in your CRM and warehouse, ask your provider to delete, remove the user's entry from Meta's contact book and delete uploaded media you still hold.
- Keep a minimal suppression record. A hashed identifier and the opt-out date let you prove you stopped messaging someone without keeping their conversations.
- Write it down. Add WhatsApp to your records of processing, and run an impact assessment where the data or volume makes it high risk.
def erase_whatsapp_contact(contact_id: str) -> dict:
c = crm.get(contact_id)
results = {
"crm": crm.delete(contact_id),
"warehouse": warehouse.delete_rows("wa_messages", contact_id=contact_id),
"provider": provider.request_deletion(c.bsuid or c.phone),
"meta_contact_book": meta.delete_contact_book_entry(c.phone_number_id, c.bsuid),
"media": [meta.delete_media(m) for m in media_index.ids_for(contact_id)],
}
suppression.add(hash_identifier(c.bsuid or c.phone), reason="erasure")
audit.log("whatsapp_erasure", contact_id=contact_id, results=results)
return results
For the controls that protect all this, see WhatsApp API security; for the wider platform, the complete guide to the WhatsApp API.
Where Tenashi fits
Tenashi isn't Meta's Cloud API, so Meta's 30-day retention doesn't describe it. Tenashi links the WhatsApp number your team already uses as a linked device and keeps conversations in a shared workspace: DMs and groups, a CRM under every chat, notes and assignments. It also keeps messages that a customer later deletes, tagged "Deleted on WhatsApp", which helps with disputes and record-keeping but means your workspace holds copies your customers can no longer see.
Treat it the way this guide treats any provider: add it to your records of processing, decide your retention periods, use roles and permissions to limit who sees which chats, and ask for the terms your compliance team needs before go-live. WhatsApp can still ban numbers that spam, whatever tool you use. Plans start from $18/mo.
See every feature · Get started
FAQ
Is the WhatsApp Business API GDPR compliant?
Meta says it complies with applicable data protection law for Cloud API and acts as your processor, but compliance is shared. You still need a lawful basis, a privacy notice, processor contracts with your provider and other tools, a retention policy and a way to handle access and erasure requests. This is general information, not legal advice.
How long does Meta keep WhatsApp API messages?
On Cloud API, Meta says message content has a maximum retention of 30 days, for features such as retransmission, and is encrypted at rest. Identifiers used to route a message are deleted within 30 days of its last status update. Uploaded media persists for 30 days unless you delete it sooner.
Is Meta a data processor for the WhatsApp API?
For Cloud API, Meta states that it acts as a data processor or service provider on behalf of the business, where the law recognises those roles. Meta's platform terms also say it may use personal data as a controller for safety, security and integrity purposes, such as enforcing its policies against spam and abuse.
Can WhatsApp API data be stored in India?
Yes, for message content at rest. Meta's local storage option supports India among other regions, set per business phone number while it's unregistered. Messages may still be processed in other Meta data centres for up to 60 minutes while in use. Your provider's and your own copies need their own hosting decisions.
Does India's DPDP Act apply to WhatsApp messages?
It applies to digital personal data, which includes customer names, numbers and message content, when processed in India or in connection with offering goods or services to people in India. The DPDP Rules were notified in November 2025 with an 18-month phased timeline. Confirm current deadlines and your obligations with a lawyer.
Most WhatsApp privacy risk lives in the copies you keep, not the ones Meta holds for 30 days. Map them, set retention and make deletion reach all of them. This guide is not legal advice. When you're ready to bring your team's WhatsApp into one governed workspace, see how Tenashi works.