WhatsApp alternatives for business communication

The messaging app WhatsApp has enjoyed great popularity for years—and not just among private individuals, but also among employees in companies. The latter often like to use the messaging service for business communication as well. As simple, convenient, and useful as that may be, it is increasingly becoming a problem for companies: WhatsApp and many other messaging services can have significant shortcomings in terms of security and data protection, which is a recurring subject of statements by German data protection supervisory authorities. This raises the question: What is a good WhatsApp alternativethat can also be used in companies?

Messaging services and shadow IT

Services like WhatsApp are often part of what is known in companies as shadow IT. This refers to IT systems and applications that are used outside the official corporate IT infrastructure and often without the knowledge of the IT department. If they are not taken into account by IT management for this reason—for example, because they are used on private devices used for work (so-called BYOD)—this is highly likely to lead to security gaps and data protection deficits. This is especially true for WhatsApp and other messengers that are often used for the sake of convenience.

If you or your employees want to use WhatsApp for business purposes, you should be aware of the fact that this very usage could represent a data protection vulnerability for the company and thus lead to potential data protection breaches or even facilitate a hacker attack to intercept company data. This is due in no small part to the data that WhatsApp shares with Facebook due to a loophole in the GDPR—the fact that this data also affects the company when WhatsApp is used for business purposes is easily overlooked.

WhatsApp in the company & the GDPR: New requirements in the age of the GDPR

With the General Data Protection Regulation (GDPR), data protection requirements have become stricter. In particular, the rights of consumers have been strengthened, allowing them, for example, to demand information from companies about the processing of their personal data. Data subjects also have the right to be informed about the sharing of their data and to request its deletion. In many cases, the consent of the data subjects is also required before processing—if companies ignore this fact, they face severe sanctions for such violations. Liability extends not only to internal, secure IT structures but applies across the board: personal data used within the scope of business-related messaging services by employees is therefore also affected. If there is a lack of control over the messaging services used, or if the service is not secure or does not offer sufficient data protection, this can pose a major problem.

Problems with data security and data protection at WhatsApp

Data security on the internet and with online tools like messaging services is extremely important. But do they go together: WhatsApp in the company & data protection? Unfortunately, not quite. As part of the Facebook group of companies, WhatsApp also shares personal data with other companies within the group. While end-to-end encryption is now used for the content of messages and calls, which also benefits data protection, this does not apply to metadata—that is, information surrounding the use of WhatsApp. Consequently, the following data may be subject to sharing when using WhatsApp:

• The users' phone numbers
• Device identifier and operating system
• The version of WhatsApp being used
• Billing information for long-term registered users
• When and from where the messenger service is used
• The user's registration date
• The date of last WhatsApp usage
• Profile pictures
• Frequently used features

Transferred data could, for example, be used for advertising purposes . Even though WhatsApp is generally considered a fairly secure system, there are recurring Reports on security vulnerabilities. Furthermore, the transfer of third-party personal data (contact details, i.e., name and phone number, and potentially profile pictures) is problematic. When address books are uploaded, the respective contacts have generally not effectively consented to the sharing of their data. Messengers often transmit the data of all saved contacts to the provider so that it can check whether they are active users of the service. The fact that personal data can be transferred to the USA, as is the case with WhatsApp, is an additional concern.

Tip: If you want to use WhatsApp to communicate with customers, only contact them via WhatsApp after prior agreement!

Are there alternatives to WhatsApp for businesses?

There are alternative services to WhatsApp specifically for business use that are less problematic from a data protection perspective. Below is a brief overview:

• Threema: This WhatsApp alternative is a Swiss messenger service with over 8 million users. Messages can be exchanged completely anonymously, meaning no personal data needs to be transmitted. Threema Work is available specifically for companies.
• Hoccer: Another WhatsApp alternative that also works anonymously. The service is based in Germany, but has relatively few users (estimated at around two million). However, this service was discontinued quite unexpectedly in mid-May 2020.
• Telegram: With over 500 million users, Telegram is a fairly widespread alternative to WhatsApp. Use is only possible with registration, and the app uses two different encryption techniques; a distinction must be made here between the different types of groups, as the content of standard messages is, in principle, accessible to the operators in plain text. In addition, Telegram has recently come under repeated criticism because messages can be sent to many thousands of members at once in groups that are barely moderated. According to media reports, this has made Telegram a popular messenger and platform, particularly for right-wing extremists and conspiracy theorists. Incidentally, public content that violates the law can be reported to abuse@telegram.org must be reported.
• Signal: Signal is a highly data-efficient messenger that also uses end-to-end encryption. Thanks to its zero-knowledge architecture, the service providers have no access to user data whatsoever. Following the tightening of WhatsApp's policies and public promotion by Elon Musk, the messenger saw a massive surge in users at the beginning of 2021. You can read a detailed article on the topic of Signal & data protection here.
• Teamwire: The German messenger service Teamwire is specifically designed to meet the security and data protection needs of government agencies, institutions, and organizations.

Alternatives to WhatsApp are therefore available, and switching should not pose a technical problem—especially for internal business communication. The real challenge likely lies in ensuring that these alternatives gain acceptance among employees and customers, and that the switch seems attractive enough given the user base of the new service.

Using WhatsApp correctly in the workplace

If your company does not want to stop using WhatsApp, you should at least follow the requirements recommended by the Bavarian State Office for Data Protection Supervision:

• WhatsApp should generally not be used by professionals bound by confidentiality, such as doctors.
• WhatsApp should not be used for purely internal company communication.
• WhatsApp chat histories should not be archived.
• Automatic saving of messages to internal storage, especially attachments, should be avoided if other apps with access to internal storage are installed on the mobile device (risk of unauthorized access and accidental sharing of attachments).
• WhatsApp should be operated on a separate smartphone or via a container solution as part of a mobile device management system.
• If access to the contact list is granted, you must ensure that only contacts (e.g., customers) who have provided their consent for this purpose are saved in the address book.