Personal Data Protection in Business-Operated WhatsApp Groups: Controller Duties, Lawful Basis, Phone-Number Exposure, Retention and Incident Response under the LGPD and the GDPR

Companies increasingly run WhatsApp groups and Communities as part of their operations: customer communities, groups for resellers and distributors, pre-sales and support groups, and internal team groups. Each of these groups is also a processing operation involving personal data, starting with the phone numbers and profile information of every member. This narrative review examines how the Brazilian General Data Protection Law (LGPD) and the European Union General Data Protection Regulation (GDPR) frame the obligations of an organisation that operates such groups. It draws on the consolidated text of both laws, guidance from the Brazilian national authority (ANPD) and the European Data Protection Board (EDPB), ANPD Resolution 15/2024 on security incidents, the WhatsApp Business terms, data processing terms and messaging policy, WhatsApp Help Center documentation and peer-reviewed research on group exposure and workplace messaging. All sources were accessed and verified on 30 October 2026. The review finds that the household exemption that may cover a private individual does not cover an organisation acting for its business purposes; that the organisation is the most likely controller of the processing it decides to carry out through a group, while WhatsApp acts as processor only for the specific services and data described in its business terms; that the main exposure inside a group is lateral, because every member can see the phone numbers of the others; and that retention, administrator access and incident response are the areas where organisations most need written rules, because the platform does not provide a central record. The paper proposes a minimum compliance file for business groups. It reports no original data and is not legal advice. Competing interests: The author is the founder of 9bot, a WhatsApp group management tool discussed in this paper.