LGPD in service by phone and WhatsApp: a practical guide for small businesses

Every service interaction deals with personal data: the name of the person who called, the phone number, the delivery address, sometimes a CPF. The General Data Protection Law (Law No. 13,709/2018, the LGPD) applies to companies of all sizes, including the small business that serves customers via WhatsApp on a mobile phone.

This guide covers the practical points of the LGPD for service by phone, WhatsApp and AI attendants. It does not replace the guidance of a lawyer, but it helps to organize the basics, which is where most small companies still have gaps.

The principles that matter most in service

The LGPD has several principles. In day-to-day service, four of them make the most difference:

• Purpose: you collect a piece of data for a specific reason, and use it for that reason. The phone number requested to return a quote does not become a mailing list just like that.
• Necessity: collect only what you need. To book a car service, a CPF is not required.
• Transparency: the person needs to know what you do with their data.
• Security: protect the data against unauthorized access, leaks and loss.

Legal basis: why you may use the data

Every collection needs a legal basis. In service, the most common are:

• Performance of a contract or preliminary procedures: the person requests a quote, an appointment, a delivery. You need the name, phone number and address to fulfill their request.
• Legitimate interest: in some cases, such as sending a reminder about a service that was contracted, respecting the customer's expectations.
• Consent: for uses that go beyond the request, such as sending promotions. Consent must be freely given, informed and easy to revoke.

If you are unsure which legal basis to use in each situation, consult a professional. The important thing is not to collect data "just because".

Sensitive data: extra care

The LGPD gives special protection to sensitive data, such as health data, racial or ethnic origin, religion, political opinion, sexual life, genetic and biometric data. In customer service, this mainly appears in:

• Clinics and medical offices: symptoms, diagnoses, test results.
• Law firms: details of cases that may involve health or other sensitive data.

Rule of thumb: during triage (whether with a person or with AI), ask as little as possible. "Which specialty?" instead of "describe your symptoms". The details are left to the professional, on the appropriate channel. See how to apply this in telephone service for a law firm.

Transparency in practice

Some simple ways to inform the customer:

• Privacy policy on the website, in clear language: what data you collect, why, who you share it with, how long you keep it and how the data subject can exercise their rights.
• Notice at the start of automated service, short. For example: "This service is provided by a virtual assistant. Your data is used to respond to your request."
• Link to the policy in the WhatsApp profile and in automated messages, when it makes sense.

If the call is recorded or transcribed, disclose that as well. Transparency builds trust and avoids surprises.

AI agents: what changes

When the person providing service is an AI (on the phone or on WhatsApp), the precautions are the same, with a few extra points:

• Configure the AI not to ask for unnecessary data. The script should list exactly what to collect.
• Restrict sensitive actions. A concrete example: in Combot's AI Phone integrated with SGP, the second copy of the invoice goes only to the WhatsApp of the number that is calling, and not to any number the person provides. This prevents someone from requesting another person's invoice.
• Confirm before acting. Actions with an effect (such as releasing a connection) should require explicit confirmation.
• Know where the records are stored. Conversation summaries and histories are also personal data. Control who has access to them in the dashboard.

How long to keep data

The LGPD does not set a single time limit. Keep data for as long as necessary for the purpose and to comply with legal obligations (tax obligations, for example). In practice:

• Set a retention period for conversations with people who did not become customers.
• Delete or anonymize data that no longer has a reason to exist.
• Document these rules, even if in a simple way.

Data subject rights

A person can ask to know what data you hold about them, have it corrected, request the deletion of data processed based on consent, among other rights. Have a channel for this (an email address or WhatsApp itself) and someone responsible for responding.

Regarding the data protection officer: the ANPD (Brazilian National Data Protection Authority) has published specific rules for small-scale agents, which relax some obligations, such as the formal appointment of a data protection officer, but require a communication channel with the data subject. Check the ANPD regulations to see whether your company qualifies.

Everyday security

Most data problems in customer service are simple to avoid:

• Company WhatsApp on the company phone, with screen lock.
• Strong, individual passwords in the service dashboard; no shared password for everyone.
• Remove access from anyone who has left the company on the same day.
• Do not send data through random channels, such as personal groups.
• Be careful with conversation screenshots circulating among the team.

Quick checklist

1. List which data each channel collects (phone, WhatsApp, website).
2. For each one, note the purpose and the legal basis.
3. Cut what is not necessary.
4. Publish or update the privacy policy.
5. Include a short notice in automated service.
6. Review who has access to the records.
7. Define how long to keep data.
8. Create a channel for data subject requests.

Summary

LGPD in customer service is, above all, organized common sense: ask only for what is necessary, explain what it is for, protect it and delete it when it is no longer needed. Automation tools help when they are configured with these limits from the start. If you use or intend to use AI on WhatsApp, it is worth reading AI bot vs. menu bot.