GDPR and Deleted WhatsApp Messages: Can You Keep Them?

Tenashi Team·September 16, 2026·6 min read

"A customer deleted their message — are we allowed to keep our copy?"

Short answer: usually yes, and it's the same analysis as an email the sender later deleted from their Sent folder. Deleting their copy isn't a legal instruction to you.

But "usually yes" comes with conditions that most businesses running WhatsApp haven't met. This isn't legal advice — take advice for your jurisdiction — but here's the structure.

Deleting a message is not an erasure request

These get confused constantly.

Deleting a message is a WhatsApp feature. It removes the message from devices in the chat. It's an action inside a product, not a communication to you as a data controller.

An erasure request is a formal exercise of a data subject right. It has to be made to you, it triggers obligations, and it has exceptions.

A customer tapping "delete for everyone" hasn't asked you to erase anything. They may not even realise you hold a copy — which is why disclosure matters, covered below.

What you need to retain lawfully

1. A lawful basis. For business conversations, usually one of:

Contract — the conversation is how the order was taken and fulfilled
Legal obligation — tax, consumer protection or sector rules requiring records
Legitimate interests — dispute resolution, fraud prevention, service quality, with a balancing assessment written down

2. A retention period. Defined, documented, and actually applied. "We keep everything forever" is the weak position that turns a routine question into a finding.

3. Data minimisation. Don't retain more than you need. Payment card details and identity documents sent into a chat should be removed or redacted rather than retained indefinitely — and ideally shouldn't be requested in chat at all.

4. Security. Appropriate technical and organisational measures: access control, individual logins, revocation on departure. A shared phone in a drawer satisfies none of this.

5. Transparency. Your privacy notice must cover WhatsApp, including that messages delivered to your business are retained even where the sender deletes their copy.

That last point is the one nearly everyone misses, and it's the one that makes retaining deleted messages clearly fair rather than arguably covert.

Handling an actual erasure request

When someone genuinely asks you to delete their data:

Find everything. This is where phone-based WhatsApp fails hardest — you can't reliably enumerate what you hold, or on which handset. Server-side storage with search is what makes a complete response possible.

Assess exemptions. Erasure isn't absolute. Common grounds to retain:

Compliance with a legal obligation (tax records, for example)
Establishment, exercise or defence of legal claims — relevant during a dispute
Where the data is still necessary for the purpose it was collected for

Respond within the deadline, explaining what you deleted and what you retained, with the exemption you're relying on. Partial refusal with a stated reason is a legitimate outcome; silence isn't.

Document the decision. Being able to show your reasoning later matters more than the outcome.

Special-category data

If chats contain health information, biometric data or anything else in the special categories, the bar rises: you need an Article 9 condition on top of your lawful basis, and retention should be tighter. See clinics and WhatsApp records.

What's clearly not allowed

Monitoring conversations you aren't a party to. Employees' personal accounts, customers' other chats. No lawful basis exists.
Retention with no basis and no disclosure. Keeping everything indefinitely because nobody decided otherwise.
Ignoring erasure requests because retrieving the data is inconvenient.
Transferring chat data to an unknown processor — which is exactly what an employee installing a notification-reader app on a work phone does. See are these apps safe.

The practical position

Retaining messages sent to your business — including ones the sender later deleted — is ordinary record-keeping. What makes it compliant is the surrounding governance, not the retention itself.

When your number is connected to a platform storing messages server-side, that governance becomes possible: you can search what you hold, apply a retention period, control access per person, and respond to a request completely. In Tenashi, deleted messages stay tagged "Deleted on WhatsApp" rather than silently disappearing, which is also the more transparent arrangement.

Scope: chats with your own connected business number only.

A minimum viable setup is in WhatsApp compliance and record-keeping.

Pricing is flat, from $18/mo.

Get started → · See every feature

FAQ

Not in itself. The message was sent to your business and received, so retaining it is like retaining an email the sender later deleted. It becomes a problem if you have no lawful basis, no retention period, no disclosure, or no way to honour an erasure request.

No. Deleting a message is a product feature, not a formal request to you as a data controller. An erasure request must be made to you and triggers a specific process, with exceptions for records you're required or entitled to keep.

Do we have to delete WhatsApp messages if a customer asks?

Usually, unless an exemption applies — a legal obligation to retain the record, or the need to establish or defend a legal claim. Respond within the deadline stating what you deleted, what you kept, and why.

What should our privacy notice say about WhatsApp?

That messages sent to your business numbers are retained as business records, roughly how long by category, who can access them, how to make access or erasure requests, and that delivered messages are retained even where the sender deletes their copy.

Can we monitor staff WhatsApp under legitimate interests?

Not personal accounts — no basis supports monitoring conversations your business isn't a party to. Conversations on company numbers are a different matter and can be retained under a stated policy that staff are told about.

How does server-side storage help with compliance rather than hurt it?

Because it makes governance possible. You can enumerate what you hold, apply retention consistently, control access per person, and respond to a request completely — none of which is achievable when the records are scattered across staff phones.

The question isn't whether you may keep it. It's whether you can show why, for how long, and who can see it. Get started.

Related guides