{"id":8244,"date":"2021-03-02T17:25:42","date_gmt":"2021-03-02T17:25:42","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/04\/02\/post_id-2793\/"},"modified":"2026-07-04T12:25:53","modified_gmt":"2026-07-04T12:25:53","slug":"how-do-whatsapps-new-regulations-align-with-data-protection-requirements","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2021\/03\/02\/how-do-whatsapps-new-regulations-align-with-data-protection-requirements\/","title":{"rendered":"How Do WhatsApp\u2019s New Regulations Align with Data Protection Requirements?"},"content":{"rendered":"

It\u2019s not just data protection officers who view WhatsApp and similar services with skepticism. Fortunately, European-based alternative messaging platforms can help alleviate these concerns.<\/strong><\/p>\n

The State Commissioner for Data Protection<\/a> (LfD) of Lower Saxony delivers a clear verdict: \u201cUsing WhatsApp for business communication violates the General Data Protection Regulation (GDPR).\u201d Similarly, the Federal Commissioner for Data Protection<\/a> has stated that \u201cusing WhatsApp is prohibited for federal authorities.\u201d<\/p>\n

Private users need not delete the popular app from their devices – but using it to communicate with colleagues may pose legal risks. Moreover, WhatsApp\u2019s privacy policy update, announced for May 2021, alarmed many users. However, Niamh Sweeney, WhatsApp\u2019s Director of Policy, has since confirmed that EU users will experience no changes as a result of the update. The revisions do not affect data sharing between WhatsApp and its parent company, Meta (formerly Facebook), within Europe. According to WhatsApp\u2019s official privacy guidelines<\/a>, nothing has changed for users in the EU.<\/p>\n

U.S.-Based Messengers Raise Concerns<\/h2>\n

While numerous messaging apps exist, most originate in the United States – and thus offer no real data protection advantages over WhatsApp. In July 2020, the Court of Justice of the European Union (CJEU) invalidated the Privacy Shield framework<\/a>, which had governed transatlantic data transfers. As a result, European companies\u2019 use of U.S.-based messaging services is generally problematic under GDPR.<\/p>\n

Two U.S.-based services – Telegram and Signal – market themselves as privacy-compliant. While Telegram has drawn criticism, Signal<\/a> is backed by a nonprofit foundation. It emphasizes privacy compliance and displays no advertising. Nevertheless, its U.S. headquarters remain a liability: Signal remains subject to U.S. laws and government oversight – and potentially opaque data practices by the provider.<\/p>\n

\u201cFor globally active companies, GDPR-level data protection isn\u2019t always the decisive factor when selecting a messaging service. What matters more is reach – i.e., the ability to connect with business partners. That means brand recognition and user base size. WhatsApp reaches approximately 2 billion users; WeChat, 1.3 billion; Telegram, 500 million; Signal, 50 million. Beyond that, adoption drops sharply.<\/p>\n

Notably, many companies are unfamiliar with the terms of service of the messengers they use – terms that often include obligations they simply cannot meet.<\/p>\n

While technical measures exist to secure messenger usage, they tend to be costly and cumbersome for end users. Companies operating exclusively within Europe should therefore prioritize European alternatives.\u201d<\/p><\/blockquote>\n

European Solutions Are in Demand<\/h2>\n

Fortunately, several GDPR-compliant alternatives are available in Europe:<\/p>\n