No, and you cannot. There is no DPA with Meta to sign for the WhatsApp Business Platform, because the contract is already in place: the processor terms are incorporated by reference into the terms you accepted when you connected a number.
What surprises people is how many documents that sentence hides, and that the set changed on 23 September 2026.
What changed on 23 September 2026
Until that date, the WhatsApp Business Terms covered both the free Business app and the Business Platform, and they incorporated the WhatsApp Business Data Processing Terms, which named WhatsApp Ireland Limited as your processor. On 23 September 2026 Meta split the document in two — WhatsApp Terms for WhatsApp Business App and WhatsApp Terms for WhatsApp Business Platform — and added a third, the Meta Terms for WhatsApp Business Platform.
The consequence is easy to miss. Only the Business App terms still incorporate the Data Processing Terms. The Platform terms incorporate “the WhatsApp Business Messaging Policy and the Meta Terms for WhatsApp Business Platform” — and nothing about processors or controllers. The processor clause now lives in the Meta document: “To the extent Meta acts as a Processor of Personal Data for which you are a Controller, the parties shall comply with the terms available at” the Meta Global Processor Terms.
So if your file says “WhatsApp Ireland is our processor under the Data Processing Terms”, it describes the Business app, not the platform you are using.
The one you accepted without noticing
The WhatsApp Terms for WhatsApp Business Platform name WhatsApp Ireland Limited as your contracting entity if you are in the EEA. They pull in the Meta Terms for WhatsApp Business Platform, which name Meta Platforms Ireland Limited as the contracting Meta entity outside the US and Canada, and those in turn pull in the Meta Global Processor Terms: you are the controller, Meta is the processor, and it processes personal data on your instructions.
There is no signature ceremony because Article 28(9) GDPR does not require one. It requires the contract to be “in writing, including in electronic form”. Incorporation by reference into terms you accepted electronically meets that.
So there is nothing to chase. What you do have is a set of documents Meta can change unilaterally, which is why the version date matters.
The second one, for Cloud API hosting
When Meta hosts your messages rather than you running your own client, a second agreement applies: the WhatsApp Business Platform Cloud API Terms, which you accept by using Cloud API. They name Meta Platforms Ireland Limited as the processor of what they call Company Personal Data — phone numbers, message content, personal identifiers and message details such as type and time — and Meta Platforms, Inc. instead if you are in the US, Canada or Brazil.
Exhibit A of the Cloud API Terms is a set of data processing terms that again incorporate the Meta Global Processor Terms; Exhibit B lists the approved sub-processors, mostly US data-centre entities plus Denmark, Sweden and Ireland, with AWS added for customers using Local Storage.
Almost everyone reading this is on Cloud API, so both chains apply at once, ending at the same processor and the same processor terms.
| Platform relationship | Cloud API hosting | |
|---|---|---|
| Contracting entity (EEA) | WhatsApp Ireland Limited (WhatsApp Terms for WhatsApp Business Platform) and Meta Platforms Ireland Limited (Meta Terms for WhatsApp Business Platform) | Meta Platforms Ireland Limited |
| Processor | Meta Platforms Ireland Limited | Meta Platforms Ireland Limited |
| Governing processor document | Meta Global Processor Terms, via the Meta Terms for WhatsApp Business Platform | Cloud API Terms, Exhibit A, incorporating the Meta Global Processor Terms |
| How it binds you | incorporated by reference into terms accepted when you connected a number | accepted by using Cloud API |
| Covers | personal data Meta processes for you in connection with the platform | phone numbers, message content, identifiers, message details |
| Last updated | WhatsApp and Meta platform terms: 23 September 2026; Global Processor Terms: 20 March 2026 | Cloud API Terms: 23 September 2026 |
Dates as retrieved on 1 November 2026, unchanged since 1 October. Check them before you file anything, because they move. Mind the old links, too: the former Cloud API terms address on developers.facebook.com now redirects to the general Meta Platform Terms, a different document.
Does it actually cover Article 28(3)?
Article 28(3) lists eight things a processor contract has to stipulate. Read against the Meta Global Processor Terms and their European Region terms, most have a clear counterpart:
- Documented instructions. Meta processes personal data only on your documented instructions.
- Confidentiality and security. Appropriate technical and organisational measures are committed to, with the specifics in Meta’s Data Security Terms incorporated by reference, plus notice of a confirmed personal data breach without undue delay.
- Sub-processors. Meta affiliates, including Meta Platforms, Inc., are authorised in any case. For other new sub-processors the European Region terms promise notice; you may object in writing within 30 days, and silence counts as consent.
- Assistance with data subject rights and with Articles 32–36. Committed to, qualified as usual by the nature of the processing and the information available to the processor.
- Return or deletion on termination. You may request return of the data within 30 days of termination; otherwise it is deleted under Meta’s retention policies. The Cloud API Terms add a deadline: remaining Company Personal Data is deleted within 90 days of you ceasing to use Cloud API, or returned on request. During use, Meta’s documentation gives messages “a maximum retention period of 30 days”.
- Information and audits. Under the European Region terms Meta has a SOC 2 Type II or other industry-standard audit carried out “where Meta EU Processor deems appropriate”, and provides a copy of the then-current report once a year on request.
That is coverage on most points, not all. Two gaps and one caveat are worth writing down before you file this.
Reports, not inspections. Article 28(3)(h) asks the processor to allow for and contribute to audits, including inspections. What you get is the audit report on request and the certifications Meta has obtained for Cloud API — SOC 2 Type II and ISO 27001, per Meta’s Cloud API data privacy and security documentation, retrieved 1 November 2026. There is no on-site inspection right.
The sub-processor caveat. Your objection right is not a veto. If you object within the 30 days, the terms allow Meta to terminate them without penalty — in practice, your real lever is to stop using the service.
The Business app is different. If you are still on the WhatsApp Business app, the older WhatsApp Business Data Processing Terms (22 August 2025) apply instead: WhatsApp as processor, deletion without a return option, an information duty without an inspection right, and Data Security Terms last updated 29 October 2020 that name no certification.
Where Meta is not your processor
The processor terms only cover data Meta processes on your behalf. The same clause of the Meta Terms for WhatsApp Business Platform that brings in the processor terms adds that, where you and Meta are independent controllers, the Meta Global Data Protection Addendum (20 March 2026) applies instead.
Both the Meta platform terms and the Cloud API Terms let Meta use personal data “as a Controller” for the safety, security and integrity of the service. The processor terms also let Meta de-identify and anonymise the data it receives. Your Article 30 record should therefore not describe Meta as a processor for everything.
Transfers are a separate document again
The European Region terms of the Meta Global Processor Terms handle transfers in two steps. Sending data to Meta Platforms Ireland needs no Standard Contractual Clauses, because it sits in the EU; for onward transfers to Meta Platforms, Inc. and other sub-processors, Meta Ireland “shall rely on appropriate GDPR-compliant transfer mechanisms”. Module Two of the clauses under Commission Implementing Decision 2021/914 applies only if your processor is a Meta entity outside the EU in a country without adequacy.
Which mechanism Meta uses for the US leg is not named in the platform documents, as of 1 November 2026; Meta’s data privacy documentation repeats the same general wording. The EU-US Data Privacy Framework appears only in the older WhatsApp Business Data Transfer Addendum (16 February 2024), which is tied to the Data Processing Terms and therefore, after the split, to the Business app. Whether it still has any role for platform users is not something the documents make clear, and we treat it as unconfirmed.
We wrote the detail up separately in where WhatsApp Business data actually goes, including the four lines this produces in an Article 30 record.
The DPA you do sign
Between you and Meta sits your messaging platform, a conventional processor relationship. It holds what Meta never sees in usable form: contact records, consent proof, tags, automations, the message history in your inbox. That is where a deletion request is actually executed.
So the signed Article 28 agreement in your compliance file is with your provider, not with Meta. Ask for it before you import a single contact. At Nybero we are the processor for that layer and provide a data processing agreement on request; the hosting sits with Hetzner in Germany, itself under a DPA. Our GDPR page sets out the rest.
What this means for you
Four things, none of which take long:
- Stop looking for a signature. Note in your file that the terms are incorporated by reference and were accepted electronically, with the date you connected the number.
- Save the current documents as PDFs, with the retrieval date on them. They are unilaterally amendable, and the September 2026 restructuring is the proof. A dated copy is what makes your record defensible eighteen months later.
- Name the right entities and roles in your Article 30 record. Meta Platforms Ireland Limited as processor under the Meta Global Processor Terms, for both the platform and Cloud API, and as independent controller for its own safety and integrity purposes; WhatsApp Ireland Limited as your contracting party; the US transfer as Meta describes it, without naming a mechanism the documents do not name.
- Get the real DPA from your provider. That is the contract that carries the obligations you will actually rely on when a customer asks to be deleted.
Whether this arrangement is adequate for your processing is not something a blog post can settle; for regulated sectors, have counsel look at it. If you are still choosing a platform, ask for the provider DPA before the first campaign — it is a reasonable thing to ask for.
Updated 1 October 2026. An earlier version described two processor chains with two entities — WhatsApp Ireland Limited as processor under the WhatsApp Business Data Processing Terms, incorporated into the Business Terms, and Meta Platforms Ireland Limited under the Cloud API Terms. Since Meta’s restructuring of 23 September 2026 the platform terms no longer incorporate the Data Processing Terms; the processor relationship for platform users now runs through the Meta Terms for WhatsApp Business Platform and the Meta Global Processor Terms, and the article has been rewritten accordingly against the documents named above, all retrieved 1 October 2026. Not legal advice.
Updated 1 November 2026. An earlier version stated that the European Region terms rely on the EU-US Data Privacy Framework and that Meta procures an annual SOC 2 Type II audit. The European Region terms name no transfer framework for the US leg, and they commit Meta to an audit only “where Meta EU Processor deems appropriate”, with the current report available once a year on request. We also added Meta’s independent-controller role. Documents re-checked 1 November 2026. Not legal advice.
