Data protection for a WhatsApp bot: who holds what, and for how long

To keep a WhatsApp bot compliant with UK GDPR (the UK General Data Protection Regulation), map what the bot processes, settle who is controller and processor, use the right lawful basis for each message, set retention per data category, and make sure you can find everything you hold about one person. A privacy notice is the least important part of this list.

The problems that cause trouble are structural: not knowing what you hold, not knowing who else holds a copy, using the wrong lawful basis for messages, and having no way to answer when somebody asks for everything you have about them. How the bot is built decides all four, so this is a design question, not a documentation one.

What we'll cover

• What a messaging bot processes
• Who is controller and who is processor
• Lawful basis: service messages versus marketing
• Consent that stands up
• Building it with CodeWords
• Answering a subject access request
• Retention
• Special category data
• Telling people what happens to their data
• How to keep compliance working
• Limits of compliance
• What to do first
• Frequently asked questions

Key takeaways

• A WhatsApp bot processes more personal data than most teams list, including media and anything the model infers.
• You are almost certainly the controller for the messages you send, and your automation platform is your processor.
• Promotional messages are marketing and follow stricter electronic marketing rules than service messages.
• Set a retention period per data category and make something apply it automatically.
• Write a one-page data map first, because every other step and every subject access request depends on it.

What a messaging bot processes

A messaging bot processes six categories of personal data, and the extras are the ones teams forget.

The phone number. It is personal data on its own and an identifier that persists across every system it touches.

The message content, including everything the customer volunteered that you never asked for.

Media. Customers send photographs of a house, a passport, a rash or a bank statement unprompted, and the files sit wherever media lands.

Metadata: when they messaged, how often, and whether they read your messages.

Anything the model inferred. A conversation summary or a derived score is personal data too. Teams most often leave this category out of a data map.

The profile name, which is frequently a real name.

Write this list for your own bot before doing anything else. Most teams find two or three categories they had not considered, and media is usually the surprise.

Who is controller and who is processor

The controller decides why and how personal data is processed, and the processor acts on the controller's instructions. Settle the roles in writing, because they decide who answers for what.

For the messages you decide to send and the purposes you use them for, you are almost certainly the controller. Your automation platform processes on your instructions and is a processor for that activity. Meta operates the messaging platform and has its own role for the service it provides.

Two practical consequences follow. First, you need a contract with any processor that lets you get information back from them. Controllers are responsible for complying with subject access requests, and a processor must help you meet that obligation (ICO guidance on subject access, 2026). Second, you need to know where the data physically goes, because a processor outside the UK brings transfer requirements.

Ask each vendor four questions: where is the data stored, who can access it, what happens on termination, and how would you get it back.

Lawful basis: service messages versus marketing

Service messages and marketing messages follow different rules, and this line catches most businesses.

Message type	Examples	Rule
Service	Booking confirmation, delay notice, invoice, request for information you need	Part of providing the service
Marketing	Offers, promotions, newsletters	Stricter electronic marketing rules apply

Electronic marketing falls under the Privacy and Electronic Communications Regulations (PECR). Limited companies and limited liability partnerships are corporate subscribers. Individuals, sole traders and ordinary partnerships are individual subscribers, who need consent or the soft opt-in (the PECR exception for existing customers) (ICO business-to-business marketing guidance, 2026).

The grey area is a reminder that is useful and also generates business, such as an MOT reminder, a recall or a check-up prompt. Where the contact relates to a service the customer has had, the reminder is usually defensible. An offer of something new is marketing, so apply the marketing rules. If you are constructing an argument for why an offer is really a service message, you have answered the question.

Consent that stands up

Where you rely on consent, the consent must meet five conditions.

Freely given. It is not a condition of getting the thing the customer came for.

Specific. Consent to appointment reminders is not consent to a monthly newsletter.

Unbundled. It is separate from terms and conditions.

Recorded. Keep what they agreed to, when, and how. Consent you cannot evidence is consent you do not have.

Withdrawable as easily as it was given. If one message opted them in, one message opts them out.

Teams skip the recording most often. A note that somebody ticked a box on a form in 2024 is not a record. The record is the wording they saw, the date and the mechanism.

Building it with CodeWords

CodeWords connects to 3,000+ integrations (CodeWords integrations page, 2026), and each connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: what is collected, where it is written, what triggers each message, and what an opt-out does.
3. Authorize the connections to whatever holds your customer records and your WhatsApp Business Platform account, keeping the number of places data lands as small as you can.
4. Describe the exceptions: somebody who has opted out, somebody who has asked what you hold, somebody who has sent something you never asked for.
5. Before switching it on, list every place a message or an image can end up, because the copies you forget are the ones that cause problems later.

You describe the outcome; Cody builds it, connects it, and deploys it. The Free plan costs $0, Pro costs $39 per month and Business costs $100 per month (CodeWords pricing page, 2026). Details are on the pricing page.

Answering a subject access request

To answer a subject access request, find everything keyed to that person across every system a conversation touched, within one month. You can extend the deadline by up to two further months where the request is complex or where you have received several (ICO guidance on responding to requests, 2026).

A request does not have to use particular words or go to a particular address. It can arrive as a message in the chat itself, which is the scenario nobody plans for.

The search covers the messaging platform, your automation, your CRM, your ticketing and your backups. That search is difficult in a setup nobody mapped, which is the argument for mapping it while the setup is small.

Prepare two things before you need them:

• A way to search by phone number across every store.
• A way to redact other people, because a thread mentioning a third party cannot be exported wholesale.

Retention

Set a retention period per data category, because personal data should not be kept longer than necessary for its purpose. Messaging defaults to keeping everything forever because nobody decided otherwise.

Conversations, media, derived summaries and the customer record have different useful lives. Be strictest with media.

Then apply the periods automatically. An undeleted archive carries the same risk whether or not a policy document exists, and an unenforced policy makes the position worse.

Separate the commercial record from the chat. An invoice may need keeping for years while the conversation that produced it does not. Separation lets you keep one and delete the other.

Special category data

Special category data, such as health information, arrives in a bot without you asking for it. A customer who cannot make an appointment because of a hospital admission has just sent health data. A photograph of an injury, a prescription or a child counts too.

Three habits handle most of it:

• Never ask for special category data in automated flows.
• Where it arrives anyway, move it out of the conversation into a controlled record, or delete it.
• Tighten retention on media specifically, since sensitive material concentrates there.

Where your business handles this data routinely, route the conversation to a person instead of processing it automatically. Routing to a person is safer and usually better service.

Telling people what happens to their data

Two moments matter more than the privacy notice: the first message and the opt-out.

The first message says who you are, that the assistant is automated, what you do with what they send, and how to reach a person. Four short lines do more work than a linked policy.

The opt-out is stated in the message, every time you send something the customer could reasonably want to stop.

Keep a full privacy notice as well, and link it. The notice is where people look for detail, while the first message is where almost everybody forms their understanding.

How to keep compliance working

Compliance keeps working through five recurring actions.

Map every place data lands, and update the map when you add an integration.

Keep the consent record, including the wording people saw.

Test a subject access request on yourself before a real one arrives.

Apply retention automatically. A policy nobody executes is worse than none.

Review annually, or whenever you add a system.

Limits of compliance

Five limits apply to anything you build.

The platform's own processing is outside your control, and your obligations sit alongside it.

Consent does not fix a purpose you should not pursue.

Deleting from your systems does not delete the customer's copy of the conversation.

Rules differ by jurisdiction, and a business messaging across borders has more than one regime to satisfy.

Compliance is not a feature. Saying you take privacy seriously in a first message is worth nothing unless the retention actually runs.

This article describes common practice and is not legal advice.

What to do first

Write the data map first: one page listing every category you process, every system it lands in, and how you would find it all by phone number. The map takes an afternoon and is the prerequisite for everything else here, including answering the first request that arrives.

Two habits make the difference. Choose a retention period per category and make something apply it, because keeping everything forever is a decision made by not deciding. And put the honest four lines in the first message, because what people understand about your data handling forms there, not in a policy nobody opens.

Frequently asked questions

What personal data does a WhatsApp bot process?

A WhatsApp bot processes the phone number, the message content including whatever people volunteer, media, metadata about when and how often they message, anything inferred such as a summary or score, and the profile name. Include all six categories in your data map.

Am I the controller or the processor?

For the messages you decide to send and why, you are almost certainly the controller. Your automation platform is a processor acting on your instructions, and the messaging platform has its own role for the service it provides. Put the roles in a written contract.

Which lawful basis applies?

Messages about work you are doing for somebody belong to the service you provide. Promotional messages are marketing, and electronic marketing to individuals, sole traders and ordinary partnerships needs consent or the soft opt-in under PECR. Treat any new offer as marketing.

What makes consent valid?

Valid consent is freely given, specific, separate from terms and conditions, and recorded, including the wording people saw. It must also be as easy to withdraw as to give. If you cannot evidence the consent with a date and a mechanism, you do not have it.

How long do I have to answer a subject access request?

You have one month, extendable by up to two further months where the request is complex or where you have received several. A request can arrive as a message in the chat and does not have to use particular words, so make sure your team recognises one.

How long should conversations be kept?

Set a retention period per data category instead of one for everything, be strictest with media, and make something apply the periods automatically. Keeping everything indefinitely is a decision made by not deciding, and it carries the same risk as having no policy.

What if someone sends health information I never asked for?

Move it out of the conversation into a properly controlled record, or delete it. Never ask for health data in automated flows. Where it arrives routinely, route those messages to a person instead of processing them automatically, which is safer and usually better service.

Do I need a privacy notice?

Yes, keep a full notice for detail. The first message does more practical work, because it tells people who you are, that the assistant is automated, what happens to what they send, and how to reach a person. Most people form their understanding from that message.

What should I ask a vendor?

Ask where the data is stored, who can access it, what happens on termination, and how you would get it back. Also confirm that the contract lets you obtain what you need to answer a subject access request. Get the answers in writing before connecting the vendor.

Does deleting my copy delete the customer's copy?

No. The customer keeps their side of the conversation on their own device. Remember this before assuming a deletion has removed a conversation entirely, and do not promise customers complete erasure of messages that exist on their phone. Tell customers plainly what deletion covers, so nobody assumes it reaches their own device.

Related reading

• Payments inside a conversation
• What a bot should remember
• Putting conversations into a CRM