VURAL
ESCAENContact
← All articles

WhatsApp and GDPR: how to comply without losing bookings

19 October 2026

A hairdresser checks a message with appointment details on her phone

Yes, you can use WhatsApp with your customers. What you can't do is use it carelessly. If your business handles appointments through this channel, the GDPR and Spain's LOPDGDD require three basic things: a legal basis for processing the data, informing the customer from the very first message, and controlling who accesses that data and under what contract.

In this guide we explain it step by step, with examples from hair salons, beauty centres, physiotherapy and dental clinics. No jargon, and with the official sources alongside.

Vural
Manage WhatsApp appointments more easily
Vural uses artificial intelligence to book appointments and answer basic questions, even outside working hours, sticking to your terms and prices.
Discover Vural

TL;DR

  • Businesses can use WhatsApp as long as their data processing complies with the GDPR and the LOPDGDD. INCIBE explains this in its guide for businesses.
  • To manage an appointment, contact details and the customer relationship itself are enough. Sending advertising follows different rules.
  • Tell customers what data you process, who processes it and why, from the first message.
  • If you use an assistant or third-party software, sign a data processing agreement. Accepting generic terms is not enough.
  • Health data, medical records and photos of ailments: keep them off WhatsApp.

Table of contents

Why WhatsApp falls squarely under the GDPR

A name and a phone number are already personal data. When a customer messages you to book, you are processing that data. You also process it when you keep the conversation, note which service they want or send them a reminder.

The GDPR makes no distinction between an informal channel and a professional one. If you use it for your business, you are the data controller. That applies to a salon with two chairs just as much as to a centre with ten professionals.

There is one nuance that should reassure you. Article 19 of Spain's LOPDGDD regulates the processing of contact details of sole traders and self-employed professionals. But most of your customers are private individuals, so it makes sense to apply the general rules.

The most common mistake in small businesses

According to INCIBE, the problem is not usually using WhatsApp. It is treating it as an internal system without applying security measures. A shared personal phone with no screen lock and uncontrolled backups is a real risk.

The AEPD has even sanctioned the use of personal WhatsApp accounts to process customer data. It is a very widespread practice, which is why it pays to keep the business number separate from your personal one.

First of all, the processing must be lawful. That means it rests on one of the legal bases in Article 6 of the GDPR. In an appointment-based business, the most common are these:

Situation Usual basis Example Handling an appointment the customer requests Performance of a contractual or pre-contractual relationship Confirming Thursday's haircut at 17:00 Reminding about or changing a booked appointment The same relationship with the customer Reminder 24 hours before Sending offers or news Prior relationship involving similar services, or other consent Promoting a facial treatment Using photos or testimonials Consent Publishing a before and after

The table is practical guidance. Every business should review its own case, and if in doubt, consult a data protection officer or a specialist adviser.

Consent: what the AEPD requires

Where you need consent, it must be freely given, specific, informed and unambiguous. The AEPD states that tacit consent and pre-ticked boxes are not valid. You must also be able to prove you obtained it.

Requirements and proof of informed consent

In practice: if a customer messages you once about an appointment, that does not mean they have agreed to receive your promotions. Keep proof when someone says yes, for example a clear yes in reply to a clear question.

Commercial messages on WhatsApp

The AEPD explains on its unwanted advertising page that advertising may be sent via WhatsApp if there is a prior contractual relationship and it concerns similar products or services. The data must have been obtained lawfully.

There is one condition that is often forgotten: in every message, the customer must have a simple, free way to opt out. A “reply STOP to receive no more messages” solves it. Leaving that option out is a frequent cause of complaints.

An appointment reminder is not advertising. A seasonal offer is. Don't mix the two in the same message. If you'd like examples of properly separated texts, there are WhatsApp templates for businesses ready to adapt.

Commercial messages on WhatsApp: overview diagram

The duty to inform from the first message

Customers have the right to know what you do with their data. INCIBE notes that, in automated booking services, it is essential to fulfil the duty to inform: what data is processed, who processes it and why.

You don't need a huge legal paragraph in the chat. The usual approach is a short message with a link to your full privacy policy. For example:

Hi, I'm the assistant for [business name]. I only use your name and phone number to manage your appointment. You can see how we handle your data here: [link]. What day suits you?

That way you inform them from the start without slowing the conversation down. And the message itself is a record that you did.

What your information should include

  • Who the controller is (your business name and a contact).
  • What you use the data for: managing the appointment, sending reminders, answering questions.
  • Who you share it with, for example the software provider.
  • How long you keep it.
  • How to exercise their rights: access, rectification, erasure, objection.

If you use an assistant or third-party software

When you take on a tool that handles conversations for you, that provider becomes a data processor. The AEPD's guide for controllers notes that Article 28 of the GDPR requires a formal contract. That contract must set out the subject matter, duration, purpose and security measures.

Accepting generic terms is not enough. You need a document that binds the provider to your instructions.

Before signing up for any tool, ask the following:

  1. Will you provide a data processing agreement?
  2. Where is the data stored and who has access to it?
  3. What happens to my data if I cancel the service?
  4. Do you use my business's conversations for other purposes?
  5. What security measures do you apply?

In Vural's case, you can read our service privacy policy and the terms of service, which explain the fee, cancellation and data processing.

WhatsApp groups: best avoided

Creating a group to coordinate appointments with several customers seems convenient. The problem is that every participant can see everyone else's phone number. That means giving third parties a piece of personal data they never agreed to share.

The solution is simple: individual conversations, one per customer. If you need to tell lots of people something, such as a change of opening hours for a bank holiday, use broadcast lists, which don't show the numbers to each other. And remember that recipients must have your number saved. If in doubt, treat that message as a commercial communication and apply the opt-out rules.

Health data: the red line for physios and dental clinics

If your business is a physiotherapy or dental clinic, the bar is higher. Health data is a special category. The AEPD points out that, under Article 9 of the GDPR, processing it is prohibited unless one of the specified circumstances applies.

For an appointment, the sensible thing is to keep to the minimum:

  • Yes: name, phone number, day and time, generic service type (“physiotherapy session”).
  • No: diagnoses, reports, test results, photos of injuries or medical records.

INCIBE warns that WhatsApp should not be the main channel for confidential information or medical documents, because you lose real control over that data. If a patient sends you a photo or a report by chat, don't ask for it again that way. Point them to a secure channel at your clinic.

For each specific case, consult your clinic's data protection officer or an adviser who specialises in healthcare. A well-configured booking chat should not ask about symptoms. If you'd like to see how this works in physiotherapy, read how to automate physiotherapy appointments with AI and WhatsApp.

What the fines tell us and why they matter to you

In 2021, WhatsApp Ireland received a fine of 225 million euros from the Irish regulator for a lack of transparency in how it handled data. That fine is for the platform, not for you. But it leaves a useful lesson: once data leaves your hands, your control fades. That is why what you share matters so much.

The AEPD has also acted against the platform itself before. In 2018 it fined WhatsApp and Facebook for transferring and processing personal data without consent.

For a small business, the risk lies elsewhere: careless internal use. Personal phones, groups with customers, screenshots sent to third parties and messages nobody deletes.

A practical checklist for your business

Use this list as a starting point. It will take you an afternoon.

  1. Separate the number. Use a business line, not your personal WhatsApp.
  2. Write your welcome message with the privacy notice and the link.
  3. Decide what data you ask for for an appointment. Only what is necessary.
  4. Ban groups with customers.
  5. Keep reminders and promotions separate, and always offer an easy way to unsubscribe.
  6. Sign the processing agreement with every provider that touches the data.
  7. Set retention periods and delete what you no longer need.
  8. Train your team. Anyone who answers messages must know these rules.
  9. Document everything. If the AEPD asks, you must be able to show what you did.

If your volume of data is not huge, INCIBE points out that the AEPD's Facilita tool can help you with the initial assessment. It is designed for small businesses with simple processing, according to its GDPR guide for SMEs.

Our view on WhatsApp and the GDPR

We believe that organising your diary and complying with the law go hand in hand. An assistant that talks to each customer in an individual conversation, stays within the terms and prices you set, and brings your diary and communication together on one platform reduces the points where data gets lost.

We are also clear about the limits. A booking assistant is there to manage appointments and answer basic questions. It is not there to collect diagnoses or medical records. If yours is a healthcare business, design the conversation so it asks for the minimum and redirects anything sensitive to a suitable channel.

And one last thought: compliance is not a one-off formality. Review your messages, your privacy notice and your contracts whenever you change tools or the way you work.

Automate appointments without losing control of the data

If you want WhatsApp to handle your bookings even outside opening hours, Vural does it for you. It replies to your customers and books, changes and cancels appointments, always on your terms and at your prices. On the Pro and Premium plans, it also offers cancelled slots to your waiting list. We charge no commission per booking and there is no minimum term.

There are four plans: Inicial (€79 a month), Esencial (€199 a month), Pro (€399 a month) and Premium (€999 a month), excluding VAT. We set it up for you with your details: the setup is a one-off fixed-price payment (€480 on Inicial, €900 on Esencial, €1,200 on Pro and from €1,800 on Premium), and the monthly fee only starts once it is up and running. You can see everything at vural.io.

If you'd like to know more before deciding, see how to receive and automate bookings on WhatsApp or how to personalise the replies so they sound like your business.

Frequently asked questions

Can I use WhatsApp Business for customer appointments?

Yes, as long as the data processing complies with the GDPR and the LOPDGDD. To manage an appointment, the service the customer requests is usually a sufficient basis. Tell them how their data is used from the first message and avoid asking for sensitive information.

Do I need the customer's consent to send them reminders?

A reminder for an appointment the customer has booked is part of managing that service. For promotions, the AEPD allows sending them if there is a prior contractual relationship and similar services, with an easy way to opt out in every message. Outside that case, you need consent. You can see how to approach these messages in our guide to WhatsApp appointment reminders.

What data should I not ask for or send on WhatsApp?

Avoid diagnoses, medical reports, photos of injuries, identity documents and any health data. INCIBE advises against using WhatsApp as the main channel for confidential information. Ask only for what you need to book the appointment.

What happens if I use an AI assistant to answer messages?

The provider becomes a data processor. You must sign with them the contract required by Article 28 of the GDPR, according to the AEPD guide. Also check what data it stores and what happens when you cancel.

Can I create a WhatsApp group with my customers?

Better not. Every member would see everyone else's phone number, and that means sharing third parties' personal data without their permission. Use individual conversations or broadcast lists.

Sources

Recommendations

More articles