Is the WhatsApp Business API secure? Encryption, what Meta stores, and what DPDP asks of you

Daniel Fernandes runs three dental clinics in Margao with fourteen staff. The clinic number sits on the WhatsApp Business Platform through a provider, and it carries appointment reminders, X-ray reports as PDFs and the occasional payment link. Last month a patient asked whether Meta could read her reports. The same week his accountant asked whether the clinics were “DPDP compliant”. Both are fair questions, and Meta’s own documentation answers the first one more candidly than most provider sales pages.

This article is about data on the WhatsApp Business Platform (the API), which is what you use once a provider’s inbox replaces the phone app. It is general information, not legal advice; for your own notices and contracts, talk to a lawyer.

Is the WhatsApp Business API end-to-end encrypted?

Not in the way a chat between two people is. Meta’s data privacy page describes the flow in one paragraph: “When a user sends a message to a business that uses Cloud API, the message travels encrypted via WhatsApp between the user and Cloud API. Once Cloud API receives the message, Cloud API decrypts the message and forwards it to the business.” Outbound, the reverse applies. Cloud API, “acting on behalf of the business”, negotiates the encryption keys with the customer’s phone, and the page’s FAQ states that “Cloud API manages the encryption/decryption keys on behalf of the business”.

So the message is encrypted between the patient’s phone and Meta’s servers, decrypted there, and passed to your provider over the provider’s own connection. Meta also says Cloud API messages at rest are encrypted.

WhatsApp’s consumer help centre draws the line the customer sees. Chats with businesses that use the WhatsApp Business app are end-to-end encrypted by default. When a business chooses Meta to “securely store messages and respond to customers”, WhatsApp says it displays this clearly in the chat and does “not consider messages with these businesses to be end-to-end encrypted”. (The glossary covers Cloud API, provider and the other terms used here.)

Can Meta read WhatsApp Business messages?

Cloud API decrypts them, because delivering them is its job, so the content passes through Meta’s servers in readable form. What Meta says it does with them is the useful part.

Meta’s page states that, where a privacy law recognises the idea, Meta “acts as a data processor/service provider on behalf of the business”, and that “Cloud API will only use the messages it processes on behalf of and at the instruction of the business, unless otherwise directed”. It also says Cloud API “will not automatically use WhatsApp messages to inform the ads that a person sees”, while noting that businesses may use the chats they receive for their own marketing.

WhatsApp’s consumer help page, read on 15 October 2026, adds a line its September version didn’t have: when businesses use these services from Meta, “Meta uses automated systems to detect violations of relevant terms and policies”, and may report to authorities where the law requires or permits. So the summary for a patient is: Meta’s systems handle and scan the chat, Meta says it doesn’t use it for ads, and the clinic and its provider are the ones who keep it.

The free Business app is different on content and similar on everything else. Its chats stay end-to-end encrypted, but WhatsApp’s page on what it shares with other Meta companies lists, for Business app users, registration details, business profile and catalogue, transaction data, “information on how you interact with customers”, device information and IP address. The text is protected; the fact that you run a business on WhatsApp is not.

What Meta stores, and for how long

Meta’s page lists three kinds of data and one retention period that matters.

Data	What Meta’s page says
Message content	Maximum retention period of 30 days, to provide base functionality such as retransmissions; encrypted at rest
User identifiers (the numbers a message went to or came from)	Deleted within 30 days of the message’s last status update (sent, delivered or read), unless the business directs otherwise
Business data (your business numbers, address)	Kept by Meta and Meta Business Suite under their terms of service
Where	Meta data centres; with local storage, data at rest moves to a chosen country

Two options change the defaults; both are set per phone number by whoever registers it, usually your provider.

Local storage lets a business pick the country where message content sits at rest, which Meta pitches at regulated industries such as finance, government and healthcare. A message may still be processed on Meta’s international data centres for up to 60 minutes; after that it is kept only inside the chosen region. It covers text, media and template content, and can only be switched on while the number is unregistered. Meta’s older example on the page sets the region to India, but the current list of supported regions is on a registration page we did not read for this article, so ask your provider whether it offers local storage and whether India is on the list today.

No Storage goes further: content is held for up to one hour in transit and nothing is kept at rest. The price is reliability. Meta normally retries a webhook to your provider for up to seven days; with No Storage the window is one hour, after which an incoming message is “permanently lost”, and media a customer sends can be downloaded for an hour only. Meta says this puts “a small fraction of your total messaging volume at risk of non-delivery”.

For a clinic the default is usually fine; 30 days on Meta’s side is short next to the years a provider keeps the same chats.

What your provider sees, and what to ask it

Everything. Cloud API decrypts the message and forwards it to the webhook address your provider registered, and the provider stores it to give you an inbox, search, history and reports. It holds message text and media, phone numbers and names, delivery statuses, your staff’s notes and tags, and a log of who replied.

Ask these in writing before you sign:

1. In which country are your servers, and will you state that in the contract?
2. How long do you keep messages and contacts after I cancel, and can I ask for deletion?
3. Who at your company can open a customer’s chat, and is that access logged?
4. Who are your sub-processors (hosting, email, analytics)? Meta publishes its own list in its Data Processing Terms and Hosting Terms for Cloud API; ask for the provider’s equivalent.
5. Do you verify Meta’s signature on every webhook? Meta signs each delivery with an X-Hub-Signature-256 header and tells integrators to reject payloads whose hash doesn’t match; a provider that skips this can be fed fake messages.
6. Who holds the two-step verification PIN for the number, and who is told when it changes? Meta’s security webhook reports when someone changes, enables or resets the PIN through WhatsApp Manager.
7. Can each staff member have their own login with limited rights, removed the day they leave? Customers stuck in staff phones is about what happens when the answer is no.
8. Can I take contacts, notes and opt-in records with me when I go? The WhatsApp CRM guide explains why those records are yours.

The wider list is in how to choose a WhatsApp API provider in India.

What the customer sees and controls

WhatsApp tells the customer, in the chat, that the business uses a service from Meta to manage messages, and the “About Business Features” page says the chat is labelled so “it’s up to you whether or not you message them”. If the business uses AI from Meta to reply, WhatsApp shows “uses AI from Meta” under the business name.

Customers also get controls that feed back into your account. They can tap Stop to end your offers and announcements while still receiving order updates and one-time passwords, and Resume later. They can block or report you with a reason; WhatsApp says the feedback is anonymous to the business and may be used “to take action on an account or limit the messages they can send”. A customer with a username may keep their phone number hidden from businesses they haven’t messaged before. Treat a Stop as an opt-out and record it, as our opt-in guide describes.

What India’s DPDP Act asks of you, and when

Most of the duties that touch a WhatsApp inbox apply from around May 2027. The Digital Personal Data Protection Act, 2023 is the law; the Rules under it were published in the Gazette dated 13 November 2025 (G.S.R. 846(E)) and come into force in three steps.

When	What comes into force
Mid-November 2025	Definitions and the rules setting up the Data Protection Board (rules 1, 2 and 17 to 21)
Mid-November 2026	Rule 4: registration and duties of consent managers, which must be Indian companies
Around May 2027	Rules 3, 5 to 16, 22 and 23: the notice to customers, security safeguards, breach intimation including a detailed report to the Board within 72 hours, erasure after a set period with 48 hours’ notice to the person, verifiable consent for children, and the cross-border provisions

The penalties, as the Press Information Bureau states them, run up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for breach-notification or child-data failures, and up to ₹50 crore for other violations. Businesses must answer a person’s rights request within 90 days.

On a plain reading, the clinic decides why a patient’s number and report are collected, which makes it the data fiduciary in the Act’s language, with Meta and the provider processing data on its behalf. Meta’s page says as much from its side: “Cloud API customers must meet their own obligations under data protection laws.” No provider’s software makes you compliant, because the duties are about your notice, your records, how long you keep things and what you do when something goes wrong.

None of the May 2027 rules is in force today, so the months until then are for preparing. For a WhatsApp number, that means:

• a record for every opt-in, with the wording shown and the date;
• a notice that says what you collect over WhatsApp and why (next section);
• a written retention rule, such as “chats and reports deleted 24 months after the last visit”, and someone who runs it;
• access by role, so the receptionist sees appointments and not every X-ray in the system;
• a breach plan naming who would report to the Board within 72 hours;
• a list of who processes the data: Meta, the provider, and the provider’s hosts.

What to put in your own privacy notice

Write the WhatsApp section in the order a patient would ask the questions. It should say:

• that you message customers on WhatsApp through the WhatsApp Business Platform, using a named provider;
• that Meta processes those messages as a service provider and keeps them for up to 30 days, with a link to Meta’s page;
• where the provider stores the data, as the provider has confirmed to you;
• what you collect in those chats (phone number, name, appointment details, reports you send, payment references) and the purpose of each;
• how long you keep it, and how deletion is requested;
• how to stop messages: reply STOP, tap WhatsApp’s own Stop button, or tell any staff member;
• who to contact with a request or a complaint.

The customer’s side of security

WhatsApp has also tightened the account itself this year, which matters because a compromised customer account can message you and read what you reply. Meta’s August 2026 post upgraded two-step verification from a six-digit PIN to a full password, added context on unknown callers on Android, and said more than a billion people now use passkeys. Its June 2026 spyware update repeats the advice to keep the app updated and report suspicious activity. If your number is also on the Business app, set two-step verification and a passkey on that phone; on the Platform, guard the two-step PIN and your Meta Business Manager logins.

This week, write the two-line answer you’d give a patient who asks where her X-ray went: which companies hold it, and for how long. If you can’t write it from memory, you’ve found the first gap.