Engrana
    |
    ⚖️ Legal & Privacy

    GDPR WhatsApp Business for appointment-based businesses: what you can send (and what you can't)

    "Is WhatsApp even OK under GDPR?" If you run a salon, clinic, massage studio, or any appointment-based business, you've probably heard that question (or felt it yourself).

    ✍️ Alejandro📅 Jan 8, 2026⏱️ 12 min read
    Book a 15-min demo →

    This guide keeps it simple: how GDPR fits into WhatsApp Business, the difference between service messages and marketing, when you need consent, and what to put in your messages so you stay on the safe side.

    Quick note: This article is practical guidance, not legal advice. If your case is sensitive (health data, minors, disputes), get professional help.

    Quick version (if you're busy)

    • Service messages (confirm, remind, reschedule): keep them strictly about the appointment and use minimal data.
    • Marketing messages (offers, campaigns, reactivation): usually require opt-in consent and an easy opt-out.
    • Don't mix reminders with promotions in the same message.
    • Store proof: what people agreed to, when, and via which channel.
    • Make unsubscribing easy: "Reply STOP and we'll stop messaging you." Then actually stop.
    • If you automate, start with reminders + confirmations: big impact, lower risk.

    GDPR + WhatsApp: what actually applies

    Think of compliance as two layers:

    • GDPR covers personal data processing (phone number, name, appointment history, message content). You need a lawful basis, transparency, data minimization, and basic security.
    • Local e-marketing rules (varies by country) can restrict unsolicited promotional messages. In many places, you need explicit permission for marketing messages.
    • WhatsApp/Meta policies also require user approval (opt-in) and expect businesses to handle opt-outs properly.

    Practical translation: Having a phone number in your contacts does not automatically mean you can send promotions. But you can usually use WhatsApp for appointments and customer support, as long as you keep it clean and expected.

    Service vs marketing: the line that matters

    1) Service (transactional) messages

    These are necessary to deliver the service: booking confirmation, reminders, rescheduling, location info, "we're running 10 minutes late", pre-visit instructions, or a short follow-up.

    In appointment businesses, service messages are usually the safest and most valuable use of WhatsApp. If you want to operationalize it properly, start with WhatsApp appointment reminders.

    2) Marketing messages

    Offers, launches, "we have last-minute slots", bundles, seasonal promotions, reactivation campaigns… that's marketing. If you want to do it right, collect a clear opt-in and always include an opt-out.

    The common trap: mixing

    Example: "Reminder: tomorrow at 5pm. By the way, 2-for-1 this week." The reminder is service; the "by the way" is marketing. Mixing is what triggers complaints, blocks, and "this feels spammy".

    Best practices that prevent complaints

    1) Keep messages short and purpose-driven

    WhatsApp is intimate. The more "newsletter-like" you sound, the more likely you get muted or blocked. One clear message beats three follow-ups.

    2) Send at reasonable hours

    Avoid late nights and odd times. If you schedule automations, set a safe sending window.

    3) Opt-out must be easy and honored

    Add "Reply STOP to unsubscribe" to marketing messages (and ideally to review requests too). Then suppress those numbers everywhere.

    4) Avoid sensitive details

    In health-adjacent businesses, don't mention conditions or treatments in chat notifications. "Your appointment is confirmed" is safer than "Your treatment for…".

    If your main pain is last-minute cancellations and no-shows, combining confirmations with reminders usually helps. Here's the approach we use to reduce no-shows without making clients feel pressured.

    And if you're rolling out automation, start with WhatsApp automatic messages to respond fast, confirm appointments, and keep the conversation tidy.

    Copy-paste templates

    Adapt the tone to your brand. The structure is what matters: clarity + purpose + an easy exit.

    1) Consent request (marketing) inside WhatsApp

    Hi [Name]! 👋 This is [Business]. Is it OK if we send you 1-2 WhatsApp messages per month with occasional updates and offers? Reply: - YES = opt in - NO = service messages only (appointments/support) You can reply STOP anytime to unsubscribe.

    2) Appointment confirmation (service)

    Perfect, [Name] ✅ Your appointment is confirmed for [date] at [time]. If you need to change it, reply here and we'll suggest alternatives.

    3) Reminder + quick confirmation (service)

    Hi [Name] 😊 Quick reminder: your appointment is tomorrow at [time]. Are you still coming? Reply: 1 = Yes 2 = I need to reschedule

    Want more reminder examples (different tones, different businesses)? See WhatsApp appointment reminder examples.

    4) Promotional message (only with opt-in)

    Hi [Name]! 👋 This week we have: [short, clear offer] (valid until [date]). If you want a slot, reply "BOOK" and we'll share times. To stop promos, reply STOP.

    5) Review request (keep it light)

    Thanks for coming today, [Name] 🙌 If you enjoyed it, would you mind leaving a quick Google review? It helps us a lot. Link: [link] (If you prefer not to receive these messages, reply STOP.)

    If you want to systemize reviews (without annoying people), this is helpful: how to request Google reviews.

    Common mistakes

    1. Assuming "they gave me their number" = marketing permission. Service and marketing are not the same.
    2. Putting a promo inside a reminder. Separate flows and only market to opt-ins.
    3. No opt-out language. People block fast when they can't exit easily.
    4. Over-messaging. WhatsApp punishes frequency more than email.
    5. Saving screenshots with personal data everywhere. Keep data minimal and access controlled.
    6. Automating without rules. Automation should reduce noise, not create more.

    Frequently Asked Questions

    Preguntas frecuentes

    For appointment/service messages, you can often rely on service necessity and customer expectations. For marketing, collect explicit opt-in.

    Reminders are typically service messages. Still: be transparent, keep them minimal, and let people opt out of WhatsApp messaging.

    Service = managing the appointment and support. Marketing = promotions and sales campaigns. Don't mix them.

    Sometimes local rules allow limited "existing customer" marketing, but it's not a free pass. Opt-in is the cleaner route, especially on WhatsApp.

    Keep the consent text, date/time, collection method, and the opt-out method offered. Make it retrievable.

    Be careful: groups expose phone numbers. Only do it with a clear purpose and explicit consent (and offer an alternative).

    Simple and universal: "Reply STOP to unsubscribe." Then make sure it actually works.

    Yes. Keep it short, ask after a good experience, don't nag, and include an opt-out.

    They started a support conversation. For marketing, ask permission: "Do you want us to message you offers on WhatsApp?"

    Wrapping up

    WhatsApp isn't "illegal by default." The trouble starts when you treat it like a promo megaphone or ignore consent. If you separate service from marketing, store evidence, and make opting out easy, you're playing it right.

    Want to set it up properly from day one?

    We help you configure reminders, confirmations, and review requests that respect GDPR and sound like your business.

    Book a 15-min demo →