Here in Spain, WhatsApp is not just another channel. It is the channel. People will ignore an email for three days and leave a voicemail unheard forever, then reply to a WhatsApp message in ninety seconds. If you run a local business on the Costa del Sol, that is where your customers already are.
Which is exactly why so many businesses drift into using their own personal WhatsApp for work. It feels harmless. It is also the part that carries real legal risk, so let us start there before the practical setup.
The part most businesses get wrong: your personal WhatsApp
Using your personal WhatsApp account to talk to customers is not just untidy. It can put you on the wrong side of data protection law, and that is not theoretical.
Why it matters. The GDPR has what is known as the household exemption: if you are processing personal data purely for personal or family reasons, the regulation does not apply to you. The moment those conversations become commercial, that exemption falls away. You are now a data controller handling customer data, with all the duties that brings.
The specific problem. WhatsApp syncs your address book to Meta's servers in order to work out which of your contacts are on the app. On a personal phone, that address book is a mix of family, friends and now customers. In practice you are handing third parties' phone numbers to another company without a clear legal basis for doing so, and without those people ever agreeing to it.
The second problem is security. A personal phone used for business usually means shared access, uncontrolled backups to a personal cloud account, no policy for deleting data, and no record of what customer information is sitting in which chat. The GDPR expects security measures appropriate to the risk, and a mixed personal handset rarely meets that bar.
And yes, there are fines. Spain's data protection authority, the AEPD, has already penalised this. In a case resolved on 30 April 2025 (resolution PS-00505-2023), a firm was fined 5,000 euros in total, made up of 2,500 euros for processing personal data with no valid legal basis and 2,500 euros for failing to apply adequate security measures, after client documents were sent through a personal WhatsApp account. The AEPD was blunt that a long-standing habit is no defence. For context, GDPR penalties can in theory reach 20 million euros or 4 percent of worldwide annual turnover, though nobody is suggesting a small local business faces that for one chat.
The takeaway is simple. Keep business conversations out of your personal account, use a proper business setup, and you remove most of this risk in an afternoon.
This is general information, not legal advice. If you handle a lot of sensitive customer data, take proper advice on your specific situation.
The three versions of WhatsApp, in plain terms
- Normal WhatsApp. Designed for personal use. Not intended for running a business, and the source of the issues above.
- The WhatsApp Business app. Free, takes ten minutes, and gives you a proper business profile plus automation basics like greeting messages and quick replies. This is where the vast majority of small businesses should be. Worth knowing it still syncs contacts, so keep it on a separate business number rather than the phone with your family's numbers in it.
- The WhatsApp Business Platform (the API). For businesses that need several people answering, a proper contract with a provider covering data processing, integration with a CRM, and automated or AI-powered replies. More setup and it usually has a per-conversation cost, but it is the strongest footing if messaging is central to how you sell.
Set your business profile up properly
Once you are on the Business app, fill everything in. It is the difference between looking like a professional outfit and looking like a stranger texting from an unknown number.
- Business name exactly as it appears on your website and your Google profile.
- Opening hours, kept accurate.
- Address or service area, so people know you cover Malaga, Marbella, Fuengirola or wherever you work.
- Website link, which sends people somewhere you control.
- A short description and a catalogue of your main services, so someone can see what you do without asking.
The free tools that save the most time
These four take minutes to set up and quietly do a lot of work:
- Greeting message. Auto-sends the first time someone messages you, so nobody is met with silence.
- Away message. Fires outside your hours. Something honest like "Thanks for your message, I am on jobs until 6pm and will reply this evening" sets expectations and stops people ringing a competitor.
- Quick replies. Saved answers to the questions you type out fifty times a month: your prices, your coverage area, how soon you can come out.
- Labels. Tag chats as new enquiry, quoted, booked, paid. It turns a messy inbox into something close to a simple pipeline.
Make it one tap to start a chat
Do not ask people to save your number. Use a click-to-chat link (a wa.me link with your number) and put it everywhere: the button on your website, your Google Business Profile, your email signature, your invoices, and a QR code on the van or the counter. Every extra step between "I need a plumber" and a message landing on your phone loses someone.
Keep it professional
Two habits make the biggest difference. First, a separate business number, so work stays out of your personal life and vice versa. Second, boundaries: say when you reply, and stick to it. WhatsApp feels instant, so an unanswered message is felt more sharply than an unanswered email. If you cannot get to messages during the day, the away message is doing that job for you. Missed messages cost the same as missed calls, which is to say a lot.
Use it to collect Google reviews
This is the highest-value habit on this whole list. When a job goes well, drop your Google review link straight into the chat while the customer is still pleased. They are already in the app, it is two taps, and reviews are one of the strongest signals for local ranking. There is a full playbook in our guide to getting more Google reviews.
When to automate
The free tools cover you until the volume gets real. The tell-tale signs: the same questions arriving daily, enquiries landing at 10pm, or leads going cold because you were up a ladder. At that point an AI assistant can answer properly 24/7, qualify the enquiry and hand you a warm lead, and automation can log it, chase the quote and request the review without you touching it. We set this up for local businesses, so if that sounds like your week, it is a solved problem.
Staying on the right side of the rules
- Message people who contacted you or who agreed to be contacted. Do not buy lists.
- Never add customers to a group or broadcast list without asking. In a group, everyone sees everyone's number.
- Mention WhatsApp in your privacy notice, including that Meta processes the data.
- Keep sensitive documents out of chat. Contracts, ID and invoices belong in email or a secure portal.
- Delete what you no longer need, and remember a customer can ask you for a copy of their data or to erase it.
Frequently asked questions
Is WhatsApp Business free?
The WhatsApp Business app is free, including the business profile, greeting and away messages, quick replies, labels and the catalogue. The Business Platform (API) is the paid route and is normally charged per conversation through a provider.
What is the difference between WhatsApp Business and the API?
The app is one phone, one person, set up in minutes. The API is for teams and systems: multiple agents, CRM integration, automated or AI replies, and a formal data processing agreement with your provider. Most small businesses only need the app.
Can I use my normal number?
Technically yes, but it is a poor idea. One number cannot be on both normal WhatsApp and WhatsApp Business, and mixing personal and business defeats the point. Get a second number, keep the two apart, and your data protection position is far cleaner.
Can I automate WhatsApp replies?
Partly, for free: greeting messages, away messages and quick replies are built into the Business app. Genuine conversational automation, such as an AI assistant that answers questions and books jobs at midnight, needs the Business Platform connected to an automation tool.
Is it GDPR compliant to message customers on WhatsApp?
It can be, if you do it deliberately. Use a business account on a business number, have a legal basis (they contacted you, or they consented), say so in your privacy notice, do not spam broadcast lists, and keep sensitive files out of chat. What is hard to defend is running customer conversations through your personal account, which is precisely what the AEPD penalised above.
WhatsApp is probably the cheapest sales channel your business already owns. Set it up properly once and it repays the afternoon many times over. If you would rather it was wired into your website, your Google profile and an assistant that answers when you cannot, get a free consultation and we will tell you honestly what is worth doing for a business your size.