LGPD and AI on WhatsApp: what your sales operation needs to watch out for

When a company uses WhatsApp for sales with conversational AI, it's collecting and processing personal data from leads and customers in real time. That puts the operation squarely within the scope of the Lei Geral de Proteção de Dados — the LGPD, Brazil's general data protection law.

Ignoring this isn't an option. Penalties exist, data subjects' rights are enforceable, and beyond the regulatory risk, there's a significant reputational risk for companies that expose customer data improperly.

This article lays out what your sales operation needs to understand and implement to be compliant.

What the LGPD says that's relevant to WhatsApp operations with AI

The LGPD regulates the processing of personal data. For context on how to integrate WhatsApp into the sales process securely, see how to integrate WhatsApp with a CRM: architecture, risks, and best practices.

The LGPD regulates the processing of personal data — any information that identifies or could identify a person. In a WhatsApp sales conversation, this includes:

• Name, phone number, email
• Job title and company (when they identify the individual)
• The content of the conversation
• Data collected during qualification: company size, need, budget
• Information about behavior and purchase intent

All of this data, once collected and stored, creates obligations for the company.

Legal basis: why you're collecting this data

The LGPD requires every instance of data processing to have a legal basis. For sales operations via WhatsApp, the most commonly used bases are:

Consent: the lead explicitly authorizes the collection and use of their data for the stated purposes. It's the best-known basis, but it requires consent to be freely given, informed, and unambiguous.

Performance of a contract: when processing is necessary to fulfill a contract with the data subject — for example, processing a purchase order.

Legitimate interest: when the company has a legitimate interest in the processing, as long as it doesn't override the data subject's rights. In B2B sales, contacting decision-makers at companies usually falls under this basis — but it requires case-by-case analysis.

The practical point is that the company needs to have documented which legal basis it uses for each type of processing — and be able to demonstrate it if questioned.

Meet CRPRO and see how Nexo structures WhatsApp operations with AI within LGPD compliance requirements.
Take the free assessment

Consent in practice: what works on WhatsApp

At the start of a WhatsApp sales conversation, you can inform the lead that their data will be processed — and for what purpose — briefly and naturally. It doesn't need to be a long legal text; it needs to be clear and recorded.

Practical examples:

• "Before we continue, please note that the data from this conversation will be stored for sales service purposes, in accordance with our Privacy Policy."
• A link to the company's privacy policy at the start of the interaction

What matters is that the record of consent — who consented, when, and to what text — is available in the system.

Data retention: how long to keep it and what to do afterward

The LGPD requires data to be kept only as long as necessary for the purpose for which it was collected. For sales lead data, this means defining:

• How long WhatsApp conversations stay stored in the CRM
• What happens to data from leads who never bought
• The protocol for data from customers who ended the relationship

The LGPD doesn't set a fixed retention period for sales data — but the company needs a defined policy that's applied consistently.

Data subjects' rights: what the company needs to be ready to respond to

The LGPD grants data subjects a set of rights that any lead or customer can exercise:

• Access: the right to know what data the company holds about them
• Correction: the right to correct inaccurate data
• Deletion: the right to request removal of their data
• Portability: the right to receive their data in a structured format
• Withdrawal of consent: the right to withdraw previously given consent

The company needs processes to respond to these requests within a reasonable time frame. That includes knowing where the data is (CRM, WhatsApp conversations, backup systems), how to access it, and how to delete it when necessary.

Specific precautions with conversational AI and automations

Using AI adds extra layers of attention:

Automated decision-making: the LGPD provides that data subjects have the right to request human review of decisions made solely by automated means that affect their interests. If the AI automatically discards a lead, that process needs to be documented.

Data used to train the AI: if real customer data is used to refine AI models, that constitutes data processing and needs a legal basis.

Transfer to third parties: if the AI or WhatsApp platform involves transferring data to third-party companies (including outside Brazil), the LGPD requires that transfer to be adequate.

Data security in WhatsApp conversations

The LGPD requires technical and administrative security measures to protect personal data. In the context of WhatsApp and AI, this includes:

• CRM access control (who can see which data)
• Encryption in transit and at rest for stored data
• Auditing of data access and changes
• An incident response protocol (what to do if there's a leak)

Storing lead conversations in systems without proper access control — like shared spreadsheets or internal WhatsApp groups — is a significant risk.

What to document to be compliant

Beyond implementing the right controls, the company needs to document:

• A record of data processing activities (what's collected, for what purpose, under which legal basis, for how long)
• An up-to-date, accessible privacy policy
• Records of data subjects' consent
• Procedures for handling data subjects' rights requests
• A data protection impact assessment (RIPD in Portuguese) when applicable — for high-risk processing

To integrate these requirements with the WhatsApp and CRM operation, planning needs to involve both the sales team and the company's legal team or data protection officer (DPO).

Talk to Nexo and learn how to structure your WhatsApp operation with AI so it's both commercially efficient and LGPD-compliant.
Take the free assessment

How to structure data governance in the sales operation

LGPD compliance isn't a project with a delivery date — it's an ongoing practice. That requires a governance structure that maintains standards over time, even with team turnover, tool changes, and an evolving sales process.

The basic elements of data governance for WhatsApp operations with AI:

An up-to-date, accessible privacy policy. Available on the company's website and referenced in the first interactions with leads. It should cover what data is collected, for what purpose, under which legal basis, and how long it's retained.

A record of processing activities. The LGPD recommends that controllers keep an inventory of data processing operations — what's collected, where, how, by whom, and for what purpose. This record is the first step to answering regulatory inquiries.

A process for handling data subjects' rights. When a lead or customer requests access to, correction of, or deletion of their data, the company needs to know how to respond — where the data is, how to access it, and how to fulfill the request within the appropriate time frame.

Periodic review of controls. Tools change, processes evolve, new types of data are collected. Periodic compliance reviews ensure that no new data collection or processing is operating outside the company's commitments to data subjects.

Training for the sales team. Sales reps who collect data in WhatsApp conversations need to understand the basics — what they can and can't ask for, how to communicate how data is used, and where to route requests to exercise rights. This is especially relevant in operations that combine AI and human service.

Conclusion

The right AI CRM for WhatsApp has built-in access controls and data retention. The LGPD doesn't prevent the use of AI and WhatsApp in sales — it defines how to do it properly. Documented consent, defined retention, structured data subject rights, and implemented technical security are the pillars. See also how AI sales automation fits into the context of a compliant sales operation. Companies that treat this as part of the process — not as extra bureaucracy — build a more solid operation with less risk.