As far as I can understand, if I install WhatsApp, the app sends my contact list to the server.

Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my contacts (some of which might not use WhatsApp already) whether they agree or not, and ideally get their signature for that?

I've found so far this assessment but I fail to understand the text regarding the implications and ramifications of private, not business use.


The GDPR requires that Data Controllers can't share data with third parties unless they have a valid purpose and a legal basis for the sharing. The legal basis might be consent by the affected data subject, but other alternatives exist.

However, the GDPR exempts purely personal or household use from its requirements. You are not required to obtain consent from your friends and family when sharing your contacts with WhatsApp.

This exemption stops when you enter the public sphere. For example, if you store contracts for the members of a club that you organise on your phone, or if you store contacts of customers, then you'd have to fulfill your obligations as a Data Controller.

  • But, the WhatsApp/Facebook is a party which stores the contacts for a business purpose, isn't? – J. Doe Aug 28 '19 at 8:49
  • 1
    @J.Doe Yes, and WhatsApp is responsible for its own GDPR compliance. But that is not what your question was about. – amon Aug 28 '19 at 9:00
  • that is, Facebook is doing illegally while accepting my contact list without permissions of third parties, but I am not its "accomplice"? – J. Doe Aug 28 '19 at 9:30
  • 2
    @J.Doe You are responsible for your compliance, they are responsible for theirs. If you only act for private purposes the GDPR imposes no compliance obligations on you. The GDPR also doesn't require that the data subjects must consent to any processing. It can be legal to process personal data without the affected person knowing about it. – amon Aug 28 '19 at 9:46
  • "can be legal to process personal data without the affected person knowing about it" I thought the sense of GDPR to avoid exactly that? In terms, if this is not a crime investigation possibly. – J. Doe Aug 28 '19 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.