WhatsApp Compliance and Record-Keeping: A Practical Guide for Businesses

Most businesses treat WhatsApp as casual. Regulators don't. If customers order, complain, agree prices and share personal data over your WhatsApp number, those conversations are business records carrying the same obligations as email — and usually far worse controls.

This is a practical guide, not legal advice. Rules vary by jurisdiction and industry; take advice for yours. But the structure below applies broadly.

The gap most businesses have

The typical setup is a phone in a drawer or an employee's pocket, running the WhatsApp Business app. Assessed as a records system, it fails almost everything:

The deletion row is the one people find most surprising. A customer using "delete for everyone" removes your copy, because the only copy is on a device their instruction reaches. Your record develops a hole at the other party's discretion — see what to do when a customer deletes a message.

Step 1: decide what you're keeping and why

Every retained record needs a reason. Under GDPR-style regimes you need a lawful basis; under most commercial regimes you need a business justification and a statutory floor.

Typical bases for WhatsApp business conversations:

• Contract — the conversation is how you took and fulfilled the order
• Legal obligation — tax, consumer protection or sector rules requiring transaction records
• Legitimate interests — resolving disputes, fraud prevention, service quality

Write down which applies to which category. If you can't name a basis, you shouldn't be keeping it.

Step 2: set retention periods

Indefinite retention is the default and it's the wrong answer. Set periods deliberately:

• Transactional conversations — the statutory record-keeping period for your industry, commonly six to seven years for tax purposes
• Prospects that never converted — a short defined window, then delete
• Support conversations — long enough for warranty and dispute windows
• Anything containing payment card or identity data — the shortest viable period, with a documented justification, and ideally redacted rather than retained
• Under active dispute — preserved, with routine deletion suspended

That last point is important and frequently missed. Once litigation is reasonably foreseeable, normal deletion of relevant records must stop, and someone needs to own that call.

Step 3: tell people

A privacy notice that doesn't mention WhatsApp while your business runs on WhatsApp is a gap.

Cover, in plain language:

• That messages to your business number are retained as business records
• Roughly how long, by category
• Who internally can see them
• How to request access or deletion
• That messages are retained once delivered, including where the sender later deletes their copy

That last line is the honest one, and it matters. A customer deleting a message on their phone doesn't retract it from your records any more than deleting an email from their Sent folder retracts it from your inbox — but people don't always realise that, so say it.

Step 4: control who can see what

"Everyone with the phone can read everything" is not an access control model.

You want:

• Individual logins per agent, so access is attributable and revocable
• Role-based permissions, so a junior agent isn't browsing every historical conversation — see inbox roles and permissions
• Immediate revocation when someone leaves, without changing a device
• Internal notes separated from customer-facing messages, so commentary never reaches the customer — internal notes

Step 5: be able to answer a subject access request

Someone asks for everything you hold about them. On a phone: scroll and screenshot, hope you find it all, hope the right employee still works there.

You need search across all conversations, retrieval by contact, and export in a readable form. This is a search problem, and phones are bad at it.

Where deleted messages fit

Two questions get conflated.

"Can we keep a message the customer deleted?" Generally yes — it was sent to your business and received. Retaining it is the same act as retaining an email. Your obligations (basis, retention, disclosure, deletion on valid request) apply to it like any other record.

"Can we read messages we weren't sent?" No. Intercepting conversations your business isn't a party to is unlawful in most places and no legitimate platform offers it.

The line is participation. You may keep your own conversations; you may not reach into other people's.

Practically, when a number is connected to a platform that stores messages on arrival, a later deletion is recorded rather than executed. In Tenashi the message stays in the thread tagged "Deleted on WhatsApp" — which is also the honest way to present it, since it shows both the content and the sender's attempt to withdraw it.

Honouring deletion requests

Retention and erasure rights coexist. If a customer makes a valid deletion request, having server-side records is an advantage, not an obstacle: you can find everything about them and remove it. On a phone, you genuinely cannot be sure what you still hold or where.

Note that erasure rights aren't absolute — records you must keep for tax or legal-defence purposes are typically exempt. Document which exemption you're relying on rather than simply declining.

A minimum viable compliance setup

1. Connect the business number to a platform storing messages server-side
2. Individual agent logins with role-based access
3. Written retention periods per category, actually applied
4. Privacy notice covering WhatsApp explicitly, including retention of delivered messages
5. A documented process for access and deletion requests
6. A litigation hold process that suspends deletion

Tenashi covers the infrastructure side — server-side storage including deleted messages, per-agent attribution, permissions, search and export — while running your day-to-day shared inbox and CRM on the same number.

Pricing is flat, from $18/mo.

Get started → · See every feature

FAQ

Are WhatsApp messages business records?

If they're how your business takes orders, handles complaints or agrees terms, then generally yes — they carry the same obligations as equivalent emails. The channel's informality doesn't change the regulatory character of the content.

Can we legally keep a message a customer deleted?

Generally yes. The message was sent to your business and received before deletion, so retaining it is like retaining an email the sender later deleted from their Sent folder. Your normal obligations apply: a lawful basis, a retention period, disclosure, and honouring valid erasure requests.

Do we need to tell customers we keep WhatsApp messages?

Yes, in most privacy regimes, and it's good practice everywhere. Your privacy notice should cover WhatsApp explicitly — what you retain, for how long, who can see it, and how to request access or deletion. Say clearly that delivered messages are retained even if the sender deletes their copy.

How long should WhatsApp business messages be kept?

Long enough to meet statutory requirements for your industry and to resolve realistic disputes, and no longer. Many businesses align transactional conversations with their tax record-keeping period and use a much shorter window for unconverted prospects.

What happens to WhatsApp records when an employee leaves?

On a phone-based setup, the records typically leave with them — which is a compliance failure as much as a commercial one. With server-side storage and individual logins, you revoke their access and the conversation history stays with the business.

Can we monitor employees' personal WhatsApp for compliance?

No. Monitoring conversations your business isn't a party to is unlawful in most jurisdictions. Compliance monitoring applies to your own business channels — conversations conducted on company numbers — not to personal accounts.

---

Compliance on WhatsApp isn't about doing more; it's about the records existing at all. Put the conversations somewhere you can actually govern them. Get started.