Can a company monitor corporate WhatsApp? What Brazil's LGPD says and how to do it right

Yes: a company can record and review corporate WhatsApp conversations with customers, as long as it has a legitimate purpose, a legal basis under data protection law, transparency with staff and customers, restricted access and a defined retention period. What it can't justify is digging through employees' personal chats. This article explains the logic. It isn't legal advice.

The question comes up in almost every WhatsApp project for sales teams. The sales director wants visibility into customer conversations. Reps hear "they're going to spy on my WhatsApp." Legal asks what the law says. Everyone is partly right, and the answer depends on separating two situations.

We focus on Brazil, where WhatsApp is the main sales channel and the rules come from the LGPD (Lei Geral de Proteção de Dados, Law 13,709/2018). If you know the GDPR, most of the logic will feel familiar: purpose, legal basis, minimization, transparency, retention and data subject rights.

Note: this content is informational and is not legal advice. Every operation has its own contracts, policies and context. Before rolling anything out, validate the design with your legal team and your data protection officer (DPO).

Two different questions: the company channel and personal chats

Most of the confusion comes from mixing two scenarios that the law and common sense treat very differently.

The first is governance of a sales and service channel, like a corporate inbox or a call center line. The second is the employee's private life. A good policy separates them and says so plainly.

Brazilian labor courts offer a useful reference. In 2005, the Superior Labor Court (TST) treated corporate email as a work tool and allowed moderate employer oversight to prevent abuse. Many lawyers apply that reasoning by analogy to corporate channels, but WhatsApp isn't email, and each case depends on contracts, policy and proportionality.

What the LGPD asks of corporate WhatsApp

The LGPD doesn't mention WhatsApp. It covers the processing of personal data, and a customer conversation is exactly that: name, phone, interests, sometimes financial or health data. These are the provisions that matter most.

Principles (art. 6)

Processing must follow good faith and principles such as purpose (legitimate, specific purposes disclosed to the data subject), necessity (the minimum required), transparency, security, and accountability. In practice: know why you record conversations, record only what serves that purpose, and be able to prove it.

Legal basis (art. 7)

Every processing activity needs a legal basis. For sales on WhatsApp, the most discussed are:

• Performance of a contract or pre-contractual steps (art. 7, V), when the chat is used to negotiate or fulfill a contract the customer asked about.
• Legitimate interest (art. 7, IX), for example to log the conversation in the CRM, keep account history and assess service quality.
• Legal or regulatory obligation (art. 7, II), in sectors that must keep records.

Legitimate interest has its own rules in art. 10: only strictly necessary data may be processed, and the controller must ensure transparency. In February 2024, Brazil's data protection authority (ANPD) published guidance on legitimate interest that recommends a balancing test before relying on it. Do it in writing, much like a GDPR legitimate interest assessment.

Consent is possible but tends to be a weak basis for a work channel, because it can be withdrawn at any time. That's a call for your legal team.

Retention and deletion (arts. 15 and 16)

Processing ends when the purpose is achieved or the period expires, and data must then be deleted, with exceptions such as legal obligations. Keeping every chat forever "just in case" doesn't fit the law. Set a period and enforce it.

Data subject rights (art. 18)

Customers can ask for confirmation of processing, access, correction, deletion of unnecessary data and more. If conversations are scattered across 80 phones, answering one of these requests is close to impossible. A governed, central channel helps you comply, not just sell.

Records, security and DPO (arts. 37, 41 and 46)

Companies must keep records of processing, especially under legitimate interest, adopt technical and administrative security measures, and appoint a DPO. Sanctions under art. 52 range from a warning to fines of up to 2% of Brazilian revenue, capped at R$50 million per violation.

Reps are data subjects too

When a company records a sales channel, it also processes the rep's data: what they wrote, when, and how fast they replied. That doesn't block governance, but it calls for the same care:

• Inform first, in writing. A channel usage policy, signed or with acknowledgment on record.
• Say what it's for. Customer history, account continuity, quality and coaching. Not hidden spot checks to punish people.
• Proportionality. Operational metrics (response time, overdue follow-ups) are different from reading chat after chat for no reason.
• Who sees what. Reps see their accounts, managers see their team, legal gets access during an incident.

The tricky part: the rep's own number

With WhatsApp coexistence, the number a rep already uses can be connected to the official API without changing phones. That protects the customer relationship but raises a question: what if the rep uses the same number for personal chats?

Meta allows syncing the last 6 months of 1:1 chats when a number is connected. If that number mixes customers and family, the company may receive data it has no reason to process. Three decisions handle most of it:

1. A work-only number. The connected number is for customers. Personal chats live on another number.
2. Agree before connecting. The rep knows what will be synced and decides whether to share history, which is an explicit step in Meta's flow.
3. A rule for non-customers. The policy states what happens to contacts and chats with no business relationship.

We explain the mechanics in our guide to WhatsApp coexistence.

Official API vs. unofficial tools

For compliance, the channel matters as much as the policy.

Unofficial tools are cheaper and faster to start, and that's real. The bill comes later: a blocked number, lost history and no proof of how data was handled.

Checklist: doing it right

1. Define the purpose of recording: history, continuity, quality, CRM.
2. Choose and document the legal basis with legal. For legitimate interest, run the balancing test.
3. Write the channel policy and collect staff acknowledgment.
4. Update the customer privacy notice to say conversations are recorded and why.
5. Use a work-only number, separate from personal use.
6. Minimize: record what serves the purpose and avoid asking for sensitive data in chat without need.
7. Control access by role, with individual logins, ideally through SSO.
8. Keep an audit trail of who accessed what and did what.
9. Set retention and enforce deletion.
10. Prepare for data subject requests: access, correction and deletion from one place.
11. Sign a DPA with your vendor and check subprocessors and encryption.
12. Use the official API through a Meta-accredited Tech Provider.

How Sailer AI supports this governance

Sailer AI is a CRM and AI agent platform for selling on WhatsApp: it connects the brand's numbers and every rep's number to the official API, puts AI agents and people in the same shared inbox, fills the CRM on its own and measures every conversation.

On governance, Sailer is an official Meta Tech Provider, states compliance with the LGPD and GDPR, offers a DPA for signature, encrypts data in transit and at rest, and provides role-based access, SSO with SAML and SCIM, and an audit trail of conversations and agent actions. Details are in the security center.

In Sailer Fleet, every number has an owner and permissions, accounts change hands with history intact, and metrics show the operation without screenshots. The policy is still yours. The tool helps you follow it and prove you do. For the management side, see our guide to managing your sales team's WhatsApp.

Frequently asked questions

Can a company see its reps' corporate WhatsApp chats?

Yes, when the number is a company sales channel with customers and there is a defined purpose, a legal basis, a written policy the team knows, restricted access and set retention. Employees' personal chats stay out. Each case has its own details, so validate the design with legal and your DPO.

Do I need customer consent to record a WhatsApp conversation?

Not always. Brazil's LGPD, like the GDPR, offers other legal bases, such as contract performance and legitimate interest, which tend to be more stable for a sales channel. Either way, customers must be clearly informed, for example in your privacy notice. Your legal team should document the chosen basis.

What is a corporate WhatsApp shared inbox?

It's a company number operated by several people, or several reps' numbers connected to one platform, with individual permissions, central history and metrics. On the official API, every user has their own login and the company knows who replied what, which also makes data protection compliance easier to demonstrate.

Are unofficial WhatsApp tools illegal under the LGPD?

The LGPD doesn't ban specific tools. The issue is elsewhere: tools that connect WhatsApp through a QR code outside the official API break WhatsApp's terms, can get the number banned and rarely offer access control, audit trails or a data processing agreement, which makes compliance hard to demonstrate.

How long can I keep customer conversations?

The LGPD sets no single period. Data must be deleted once the purpose is achieved, except for cases such as legal or regulatory obligations. Set the period with legal, considering contracts, industry and limitation periods, record the decision in your policy and configure retention in your tool.