When you send a WhatsApp message to a customer, three parties touch personal data: you, whatever tool you send from, and Meta. Knowing which one holds what is the difference between an Article 30 record you can defend and a paragraph you invented.
Short version: between the user’s device and WhatsApp the content is protected by Signal-protocol encryption — but on the Cloud API, Meta hosts the endpoint and keeps messages encrypted at rest for up to 30 days. And the phone number, the template, the parameters you filled in and the delivery status all pass through Meta’s systems, including in the United States. Which legal mechanism covers that US leg is something Meta’s platform terms leave unnamed.
Now the detail, because the detail is what goes in the paperwork.
The three layers
Your system. Whatever you keep: the contact record, the consent proof, the tags, the conversation history you display in your inbox. This is entirely yours. You are the controller, and it is also the layer where a data subject request is actually fulfilled.
Your messaging platform. The software between you and Meta — Nybero, or a competitor. It stores your contacts, your consent records, your automations and the message history. It is your processor and owes you an Article 28 agreement — and it is the only one of the three you actually sign something with, which we unpack in do you need a DPA with Meta.
Meta. The WhatsApp Business Platform itself. This is the layer people guess about, so it is worth being precise.
What Meta actually processes
When your platform calls the Cloud API to send a message, it passes:
- the recipient’s phone number
- your business phone number ID, which since Meta’s account-model change (rolled out from 23 September 2026) sits in a “Messaging account”, the successor to the WhatsApp Business Account
- the template name and language, or the free-form message body
- the parameters that fill the template’s variables
- any media you attach
Meta returns a message ID and, subsequently, delivery status webhooks: sent, delivered, read, failed. Inbound messages from the user arrive the same way.
Here the common summary — “end-to-end encrypted, nothing stored” — describes consumer WhatsApp rather than the platform you are using. Between the user’s device and WhatsApp, content is protected by Signal-protocol encryption. But with the Cloud API, Meta hosts the endpoint: the message is decrypted in Meta’s infrastructure, re-encrypted for delivery, and stored encrypted at rest. Meta’s Cloud API data privacy documentation (retrieved 1 November 2026) states a maximum retention period of 30 days, needed for retransmission and the base service, and that recipient identifiers are deleted within 30 days of a message’s last status update. The leg between your platform and the Cloud API runs over HTTPS/TLS, and Meta manages the Signal keys on your behalf. Those 30 days apply while you use the service; under the Cloud API Terms, Meta deletes any remaining personal data within 90 days once you stop.
Two further things sit outside the encryption story and are easy to overlook.
The first is the metadata. Who messaged whom, when, from which business account, with what result. That is processing, and it is enough to be personal data.
The second is the parameters you chose to send. If your appointment reminder template says “Hello {{1}}, your appointment for {{2}} is on {{3}}”, and you fill it with a name, a medical procedure and a date, you have passed all three through the API. End-to-end encryption is not a reason to be careless about what you put in the variables. Put the sensitive part behind a link into your own system, not in the message body.
Where it goes
Two Meta entities sit behind the platform, and both belong in your notes. The documents changed on 23 September 2026: the old WhatsApp Business Terms were split into separate terms for the Business App and for the Business Platform, and a Meta-side document was added. WhatsApp Ireland Limited is your contracting party under the WhatsApp Terms for WhatsApp Business Platform (effective 23 September 2026). Meta Platforms Ireland Limited is your counterparty under the Meta Terms for WhatsApp Business Platform and the processor under both those terms and the Cloud API Terms (all last updated 23 September 2026), each of which incorporates the Meta Global Processor Terms; the Cloud API Terms are what applies when you send through the Cloud API.
You are the controller of your messaging, but not of everything Meta does with the data: section 7.7 of the Meta Terms and section 2.7 of the Cloud API Terms let Meta use personal data “as a Controller” for the safety, security and integrity of the platform. Processing also involves Meta infrastructure outside the EEA, including in the United States. If your Article 30 record still cites “WhatsApp Business Terms”, update the document names.
There is one lever most businesses do not know they have. Meta offers Cloud API Local Storage, an opt-in set per business phone number that keeps message data at rest in a chosen region — Germany, the UK and Switzerland are among the options — rather than the default. Content is still processed outside the region for a data-in-use period of up to 60 minutes (90 minutes for the Marketing Messages API), after which it is held only in the selected region, according to Meta’s local storage documentation (retrieved 1 November 2026); Exhibit B of the Cloud API Terms lists the sub-processors, mostly US entities plus Denmark, Sweden and Ireland, with AWS added for Local Storage customers. It does not remove US processing altogether, but if data residency is the question your legal team asks, that is the setting to ask Meta or your provider about.
The transfer basis is less explicit than most summaries suggest. The European Region terms of the Meta Global Processor Terms say that sending data to Meta Platforms Ireland needs no Standard Contractual Clauses, and that for onward transfers to Meta Platforms, Inc. and other sub-processors Meta Ireland “shall rely on appropriate GDPR-compliant transfer mechanisms” — without naming one, as of 1 November 2026. The obvious candidate is the EU-US Data Privacy Framework: the European Commission adopted the adequacy decision on 10 July 2023, it is still in force on 1 November 2026, and Meta’s DPF disclosure states that Meta Platforms, Inc. and its US subsidiaries are certified. But “Meta relies on the DPF for Cloud API data” is an inference, not something the platform documents say.
On 31 July 2026 the European Data Protection Board asked the Commission to assess whether the US Supreme Court’s ruling in Trump v. Slaughter, on the independence of the Federal Trade Commission, affects the adequacy finding; no decision has followed. Meta’s own entries on the Data Privacy Framework list are also worth a yearly check: on 1 November 2026 WhatsApp LLC is listed as active (re-certification due 23 January 2027), Meta Platforms, Inc. as “Active - Re-certification under Review” (due 23 July 2027).
Two developments belong in your notes rather than in a panic. The General Court dismissed the first annulment action on 3 September 2025 (Latombe, T-553/23); that judgment is under appeal at the Court of Justice (C-703/25 P), and we found no judgment in the appeal as of 1 November 2026. And the Framework’s two predecessors, Safe Harbour and Privacy Shield, were both declared invalid by the Court of Justice, as the Court’s press release on Latombe recalls. An adequacy decision can also be suspended, which is a policy risk you cannot mitigate contractually.
What you can do is make sure the transfer is documented rather than assumed. If the basis changes, you want a record that says which processing was affected, not a scramble to reconstruct it.
The four lines for your Article 30 record
Article 30 requires a record of processing activities. Here is the WhatsApp entry, in the shape most supervisory authorities expect.
| Field | What to write |
|---|---|
| Purpose | Customer communication and direct marketing over the WhatsApp Business Platform |
| Categories of data subjects | Customers and prospects who gave consent for WhatsApp messaging |
| Categories of personal data | Phone number, name, message content and metadata, consent record, delivery status, plus any variables used in templates |
| Recipients | WhatsApp Ireland Ltd (WhatsApp Terms for WhatsApp Business Platform) and Meta Platforms Ireland Ltd (Meta Terms for WhatsApp Business Platform, Cloud API Terms) — processor, and controller for platform safety and integrity; [your messaging platform] as processor |
| Third-country transfer | United States, as onward transfer by Meta Platforms Ireland to Meta Platforms, Inc. and US sub-processors (Exhibit B of the Cloud API Terms); terms cite “appropriate GDPR-compliant transfer mechanisms”; Meta Platforms, Inc. is DPF-certified (adequacy decision of 10 July 2023) |
| Retention | e.g. conversation history two years after the last interaction; consent records for the duration of the consent plus the limitation period. Meta retains Cloud API message data for up to 30 days |
| Technical and organisational measures | Encryption in transit, access control by role, automatic opt-out handling, deletion on request |
The retention line is the one usually left blank, and it is the one that fails an audit fastest. Pick a period. Write it down. Have something enforce it.
What a data subject request looks like in practice
Someone writes and asks for a copy of everything you hold (Article 15), or asks you to delete it (Article 17). Where do you go? The mechanics of the second case are their own topic — see handling a GDPR deletion request that involves WhatsApp chats.
Your own systems and your messaging platform. This is where the answer comes from — contact record, consent proof, tags, and the message history as your platform stored it. You should be able to produce it for one contact in one action, and delete the same.
Meta. Meta is not where you fulfil the request. It holds Cloud API message data for up to 30 days plus the associated metadata, processed on your instructions as controller. The deletable, exportable record lives in your own systems and your messaging platform.
That is why the fifth question to ask a vendor is always the same: can you export and delete everything about one contact, including the conversation, in a single operation? If the answer involves a support ticket and three working days, the Article 12 one-month deadline is going to be uncomfortable.
What this means for you
Two jobs, both an afternoon’s work. Write the WhatsApp entry into your Article 30 record using the table above, filling in your real retention period rather than a placeholder. Then look at your templates and move anything sensitive out of the variables and behind a link into your own system.
Nybero hosts in Germany (Hetzner, Falkenstein), signs a DPA on request, and puts per-contact deletion of the contact record, tags and consent history in the interface. Message rows — including received photos, voice notes, files and form answers — are detached rather than erased by that step today, so a request that covers the conversation history still goes through support. The GDPR and WhatsApp overview covers how the rest of the picture fits together.
Updated 1 November 2026: an earlier version stated that transfers to the United States rely on the EU-US Data Privacy Framework. Meta’s platform terms name no mechanism for that leg; the DPF is the likely candidate but not stated, and the article now says so. We also added Meta’s controller role for platform safety and integrity, the account-model change, the Marketing Messages API data-in-use period and current DPF list entries, removed an unverified remark about an intervention in C-703/25 P, and corrected what Nybero’s per-contact delete covers. Re-checked against Meta’s terms and documentation on 1 November 2026.
Updated 1 October 2026 for the new terms structure of 23 September 2026 (document names, 90-day post-termination deletion, Local Storage details) and the EDPB’s review request. An earlier version stated that Meta does not retain message content after delivery and named only Meta Platforms Ireland as the counterparty; both were wrong for the Cloud API and have been corrected against Meta’s documentation and legal terms, last re-checked 1 October 2026. Adequacy decisions and Meta’s infrastructure both change; re-check the transfer basis when you review the record. Not legal advice.
