As far as I can understand, if I install WhatsApp, the app sends my contact list to the server.

Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my contacts (some of which might not use WhatsApp already) whether they agree or not, and ideally get their signature for that?

I've found so far this assessment but I fail to understand the text regarding the implications and ramifications of private, not business use.

1 Answer 1


The GDPR requires that Data Controllers can't share data with third parties unless they have a valid purpose and a legal basis for the sharing. The legal basis might be consent by the affected data subject, but other alternatives exist.

However, the GDPR exempts purely personal or household use from its requirements. You are not required to obtain consent from your friends and family when sharing your contacts with WhatsApp.

This exemption stops when you enter the public sphere. For example, if you store contracts for the members of a club that you organise on your phone, or if you store contacts of customers, then you'd have to fulfill your obligations as a Data Controller.

  • But, the WhatsApp/Facebook is a party which stores the contacts for a business purpose, isn't?
    – J. Doe
    Aug 28, 2019 at 8:49
  • 1
    @J.Doe Yes, and WhatsApp is responsible for its own GDPR compliance. But that is not what your question was about.
    – amon
    Aug 28, 2019 at 9:00
  • that is, Facebook is doing illegally while accepting my contact list without permissions of third parties, but I am not its "accomplice"?
    – J. Doe
    Aug 28, 2019 at 9:30
  • 2
    @J.Doe You are responsible for your compliance, they are responsible for theirs. If you only act for private purposes the GDPR imposes no compliance obligations on you. The GDPR also doesn't require that the data subjects must consent to any processing. It can be legal to process personal data without the affected person knowing about it.
    – amon
    Aug 28, 2019 at 9:46
  • "can be legal to process personal data without the affected person knowing about it" I thought the sense of GDPR to avoid exactly that? In terms, if this is not a crime investigation possibly.
    – J. Doe
    Aug 28, 2019 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .