LGPD on WhatsApp: What Businesses Can and Cannot Do

Opt-out: how to record it and why it is definitive

The data subject can revoke consent at any time, and revocation must be as easy as acceptance. On WhatsApp, it rarely arrives with the exact words: it comes as “I don’t want to receive anymore,” “stop sending,” “remove me,” or simply a block.

Three operational requirements:

1. Record it in the contact record, not in the agent’s memory. The refusal must become a field in the contact, visible to everyone. If it lives on a post-it or in the mind of the agent, the next blast will include that person — and then it is no longer negligence, it is documented recurrence.

2. Block future sends, not just the next one. The refusal applies to subsequent campaigns, to other agents, and to next year. A good tool blocks sending automatically; without it, someone will make a mistake.

3. Separate campaign refusal from total refusal. Those who asked not to receive promotions still have the right to operational contract messages — invoice, scheduling, delivery. Treating everything as an absolute block harms the client.

And the point that makes a difference in a possible audit: keep the date and content of the request. Demonstrating that the refusal was recorded and respected is what separates a punctual failure from an irregular practice.

How long to keep conversations

LGPD does not specify a deadline in days. It provides a criterion: data is kept as long as necessary for the purpose that justified the collection, and then deleted — unless another regulation requires retention.

Translating to the operation of those who sell via WhatsApp:

• Sales conversation that did not close — keep while there is a real commercial expectation. Twelve to twenty-four months is a common and defensible policy, provided it is documented.
• Active customer conversation — while the relationship lasts, plus the legal term applicable to documents and contract obligations.
• Audio, photo, and document sent in chat — the most neglected point. This is where personal documents, receipts, and in some sectors health information appear, which is sensitive data and has enhanced protection. If your business receives this type of material via WhatsApp, it needs special handling, not just a media folder accumulating for years.

The essential is to have a written policy, even if short. An indefinite term is the same as keeping forever — and keeping forever increases the damage of any future incident.

Who on the team can see what

Much of the real risk is not in the law, but in the device. While service happens on personal phones, your company has a customer base spread across devices it does not control, with backups on personal clouds and, when someone leaves, a conversation that remains in a former employee’s pocket.

Three measures solve most of this:

Service on company number, with individual access per agent. Each person logs in with their own credentials, and the history stays with the company.

Access proportional to role. Those serving need to see their conversations; they do not need to export the entire database.

Offboarding routine. Revoking access on the same day should be as automatic as collecting the office key — and almost never is.

What to require from the CRM provider

Under the law’s structure, the controller — your company — decides the purposes of processing. The tool provider is the operator: processing data on its behalf. This does not transfer responsibility, but defines what must be in the contract:

• Data processing clause describing purpose, scope, and obligations of each party.
• Where data is stored and which subprocessors are involved.
• Term and method of deletion when the contract ends — and guarantee of exporting history before that.
• Incident notification commitment, with defined deadline. If there is a leak, notifying ANPD and data subjects is the controller’s obligation: you need to know quickly.
• Access control and activity logging, to demonstrate who accessed what.

A provider who does not answer these five questions in writing is a risk you assume together — and it is a conversation worth having before signing, not after an incident.

The three most common requests and how to respond

“What data do you have about me?” The data subject has the right to confirmation and access. LGPD provides for immediate response in simplified format and, when the declaration is complete, up to fifteen days. Having conversations centralized turns this into a two-minute search; with history scattered across phones, it becomes a week of work.

“Delete my data.” There is a right to deletion, with exceptions: data the company must keep by legal obligation or to exercise rights in proceedings may be preserved. The correct response is almost never “we deleted everything” nor “we cannot delete anything” — it is explaining what was deleted, what was kept, and why.

“I don’t want to receive messages anymore.” Revocation of consent. Record it, block promotional sends, and confirm to the person that it was done. Confirmation closes the matter and prevents the next complaint.

It is worth knowing the consequence on the other side: sanctions under the law range from warning to a fine of up to 2% of the company’s revenue in Brazil, limited to R$ 50 million per infraction. For small and medium companies, however, the most likely damage is not the fine — it is public complaint, number blocking by WhatsApp itself, and loss of an entire sales channel.

Mistakes that create real risk

• Buying a list and blasting. There is no legal basis, and the number is usually blocked even before any legal discussion.
• Not recording the contact’s origin. Without this, there is no way to demonstrate compliance.
• Treating opt-out as the agent’s preference. Refusal is data in the record, not an informal agreement.
• Keeping media forever. Documents and receipts accumulated for years increase the damage of any incident.
• Service on personal phone. Customer base outside company control, and no offboarding routine.
• Supplier contract without data clause. Responsibility remains yours, but with no obligation on the other side.

Where to start this week

Add an origin field in the record and start filling it for every new contact. Write, on one page, the retention policy: how long you keep conversations of leads that did not close, active customers, and received media. Centralize service on a company number with individual access, and create a routine to revoke access on offboarding.

Finally, review the current database: separate those who came via form, who are customers, who initiated contact, and those from origins you cannot explain. That last group is where the risk lives — and cleaning it costs much less than discovering its size in a complaint.

Frequently Asked Questions