No public evidenceWhatsApp and GDPR
CertReports found no public GDPR evidence for WhatsApp as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 24 Jan 2022
- Expires or valid through
- 23 Jan 2027
- Scope
- WhatsApp LLC (“WhatsApp”) is certified to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (collectively, the "DPF") with the U.S. Department of Commerce. WhatsApp processes personal information received from the European Economic Area or Switzerland under the DPF in connection with the services offered by WhatsApp Ireland Ltd. (including WhatsApp Services, Channels and WhatsApp Business Services) as described in our EU-U.S. and Swiss-U.S. Data Privacy Frameworks Disclosure. For further information about WhatsApp's privacy practices, including additional information about what, why, and how WhatsApp processes personal information, please review our EU-U.S. and Swiss-U.S. Data Privacy Frameworks Disclosure at the link below. Here is our link https://www.whatsapp.com/legal/data-privacy-framework
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | WhatsApp LLC: Active: SW-US Certification, EU-US Certification | Live pagesha256 a0e7b543ce |
- Kind
- listing
- Scope
- WhatsApp Inc. has certified to the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework with the U.S. Department of Commerce regarding the collection and processing of personal data from our business partners in the European Union and Switzerland (Partners) in connection with the products and services described in our Privacy Shield Notice (Partner Services) although WhatsApp does not rely on the EU-U.S. Privacy Shield Framework for transfers of personal data in light of the judgment of the Court of Justice of the EU in Case C-311/18. WhatsApp processes the personal data provided by our Partners to provide Partner Services in accordance with the terms applicable to the relevant Partner Service and otherwise with the Partners' instructions.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | WhatsApp Inc.: Inactive | Live pagesha256 86bff50a85 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is WhatsApp GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Communications and CPaaS category) whose GDPR row is verified or vendor-stated, ranked by similarity.
