Can WhatsApp Business be used in a POPIA-aligned workflow?

WhatsApp’s policy requires a supplied phone number and opt-in permission for subsequent contact, and requires businesses to respect requests to stop. That platform requirement is distinct from choosing a lawful basis under South African law.

For unsolicited electronic direct marketing, the Regulator explains consent and the limited existing-customer route. That exception requires more than an existing contact record: collection during a sale, the sender’s own similar offerings, and suitable opportunities to object are material conditions. Have the actual scenario assessed.

Draw the route from the customer to Meta, any provider, the shared inbox, automation service and destination system. A direct integration and a provider-managed service can have different responsibilities; do not assume every setup uses the same three-party structure.

For an illustrative order-status workflow, list the customer number, order reference, message text and status fields actually required. Check who can export the conversation and which systems retain copies.

Ask the responsible reviewer to check supplier roles, permitted use, security arrangements and cross-border conditions. Obtain evidence for the actual service rather than assuming all provider infrastructure is in South Africa.

Keep access limited to the team who needs it. Decide where attachments belong and how long each category is retained. A five-year retention period for one business record does not automatically apply to every chat message.

First, opt out a test contact and verify that queued promotional messages, campaigns and imported lists respect the change. Second, send a request requiring a person: the handover should be visible to a named team member.

Third, find and correct a synthetic customer’s records across the connected systems. Record the request-handling procedure and applicable response requirements; there is no assumed universal 21-working-day rule. Avoid claiming a sample clause or three checkboxes alone completes POPIA compliance.

Preserve a useful record of message status and actions without collecting unnecessary content. Plan for failed delivery, incorrect numbers and unavailable providers. Keep customer communication and internal business approval as separate steps.

Aitsa can scope the communication workflow, access, review and follow-up controls after a free initial conversation. Supplier selection and legal assessment depend on the intended use.