A privacy notice for your WhatsApp customers: what it must cover under the PDPA, where to put it, and a plain-language template
When a customer messages your business, you collect their phone number, their name and whatever they tell you. If an AI assistant or a platform processes those messages, that is a third party handling their data. The law in Malaysia and Singapore expects you to tell them, briefly and plainly. Here is what to say and where.
Quick answer
A WhatsApp privacy notice for a small business should say, in plain language: what you collect (number, name, messages, details given for bookings or orders), why (to answer, book, deliver, and keep records), who processes it (your team, your messaging and AI platform, named), how long you keep it, how customers can see, correct or delete it, and how to opt out of messages. Link it from your WhatsApp profile and website, and mention it in the greeting for new customers.
What it must cover
- What you collect. Phone number, name, the content of messages, and details given for bookings or orders.
- Why. To answer enquiries, make bookings, fulfil orders, send reminders about them, and keep business records.
- Who processes it. Your team, and named service providers: your messaging and AI platform, payment processor, delivery partner. ReplyKit's own privacy policy lists its sub-processors so you can refer to it.
- How long. A period you actually follow, for example as long as you are serving the customer plus a retention period for records.
- Rights. How to request access, correction or deletion, and how to opt out of messages (STOP).
- Contact. An email or number for privacy questions.
The template
Privacy notice for WhatsApp customers of [Business] When you message us on WhatsApp we collect your phone number, your name, the content of your messages, and any details you give us to book, order or pay. We use this to answer your questions, make and remind you of bookings, fulfil orders, and keep our business records. We do not sell your data. Your messages are processed by our team and by ReplyKit, the platform that runs our WhatsApp assistant and stores our conversations; ReplyKit's providers are listed at replykit.app/privacy. Payments are processed by [processor]. Deliveries are handled by [partner]. We keep your information while you are our customer and for [X] years afterwards for records, unless the law requires longer. You can ask us to show, correct or delete your information, and you can stop automated messages at any time by replying STOP. Contact [email] for any privacy question. This notice is under the Personal Data Protection Act [2010, Malaysia / 2012, Singapore].
Where to put it
- A page on your website, linked from the WhatsApp Business profile description.
- A link in the greeting for first-time customers: "How we handle your data: [link]".
- In the agent's knowledge, so it can answer "what do you do with my number?" accurately.
- On any form that collects details.
Consent for marketing is a separate matter from this notice; see opt-out and consent rules. Data safety questions to ask your vendor are in customer data safety.
Frequently asked questions
Do I need a privacy notice for WhatsApp customers?
If you collect their number and messages for business purposes, the PDPA in Malaysia and Singapore expects you to tell them what you collect and why. A short notice covers it.
Do I have to name my AI provider?
Naming the platforms that process customer data is the transparent approach and what the laws generally expect. ReplyKit publishes its providers so you can refer to them.
How long should I keep conversations?
As long as you serve the customer plus a records period you actually follow. State it and honour it.
Where should the notice go?
A web page linked from your WhatsApp profile, a link in the first greeting, and in the agent's knowledge.
Is this legal advice?
No. It is a general template. Regulated businesses should have a lawyer review it.
Named providers, honest notice
ReplyKit's privacy policy lists what processes your customers' data. Start free.
Sources and further reading
- Personal Data Protection Department, Malaysia (PDPA 2010)
- Personal Data Protection Commission, Singapore
- ReplyKit Privacy Policy · sub-processor list to reference
ReplyKit is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. This template is general guidance, not legal advice. Data protection obligations depend on your country, industry and the data you process.