Customer data on an employee’s personal WhatsApp
Photo: Avila Ops Tecnologia
Serving customers through an employee’s personal WhatsApp means processing data without controlling it. Under Brazil’s LGPD (Law 13.709/2018), the business is the controller and responsible for what happens to that data: a stolen phone, an employee leaving with the list, messages outside agreed boundaries. There is one solution: a business number on a business SIM, with access that can be revoked when someone leaves.
This is common in small businesses. Salespeople use their own phones “because it is easier,” customer portfolios grow on their devices, and when they resign, the business loses history, the number customers saved, and sometimes the customers. The LGPD merely gave a legal name to an existing commercial problem.
What are the practical risks?
The risks differ in nature:
- Security. Personal phones have no rules: no screen lock, backups to personal accounts, dubious apps. Customer data is exposed, and the business cannot demonstrate care, as LGPD article 46 requires.
- Continuity. The number belongs to the employee. When they leave, customers keep messaging them. The business cannot recover conversations or contacts, and should not request the device: it is personal.
- Conduct. After-hours messages, unauthorized promotions, document photos stored in the gallery. All in your business’s name, without your visibility.
In all three cases, the business answers to customers and ANPD. Requiring personal phones for work may also become a labor issue, depending on the agreement.
How do you migrate to a business number without losing customers?
In four stages over one month:
| Stage | What to do |
|---|---|
| 1. Number | A SIM registered under the CNPJ, one per staff member or one API number with multiple agents |
| 2. Notice | Each agent messages active customers: “from this date, I will serve you through this business number” |
| 3. Redirect | For 30 days, the personal number replies only with the new contact and no longer provides service |
| 4. Records | Conversations move into CRM, with history the business can see and agents access through individual logins |
Stage 2 prevents lost customers. The notice comes from their usual agent, in the usual voice, explaining the same service continues. Stage 4 addresses the root: history moves from the device to the business. How to choose between WhatsApp Business on a SIM and the multi-agent API is in avilaops.com/guias/whatsapp-comum-ou-business-api.
What if the employee already left with the list?
First, do not ask for their phone; it is personal. Ask in writing that they delete business customer data and confirm, because confidentiality obligations continue. Then notify active customers through the official channel that service has moved to another number. Record dates and actions: if customers complain about improper contact, you can show you acted.
Example: a small real estate agency with two agents saw one leave and continue receiving property owners’ messages for six months. The business had no number, conversations, or negotiation history. All it could do was notify people individually. With a business-owned number, changing agents would take one message. The number-change walkthrough is in avilaops.com/guias/como-trocar-o-numero-do-whatsapp-business-da-empresa.
What to do now
Count customers currently talking through phones the business does not own. If the answer is “I don’t know,” that is the problem. Buy SIMs, set a migration date, and move conversations into CRM to know how many messages become sales while history stays in the right place: avilaops.com/crm-para-pequenas-empresas. For an assessment of what is exposed, it takes a conversation: avilaops.com/contato or contact us on WhatsApp: wa.me/5517997811471.
Frequently asked questions
Can I require employees to use personal phones for business?
The safe approach is not to require it. If unavoidable, agree in writing on usage rules and some compensation, and the number should still belong to the business. For the LGPD, what matters is who controls the data.
Is WhatsApp Business on a business SIM enough?
It solves number ownership, and history stays on the business device. The app supports up to four linked devices in addition to the phone, but no per-agent login or visibility into who replied. That requires the API with CRM.
Can former employees use the customer list at a new job?
No. Contacts were collected for your business, and using them for another purpose without a legal basis violates the LGPD and confidentiality obligations. Notify them in writing and keep a record.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.