Key takeaways
- Phone numbers, message content and delivery logs can all be personal data.
- You need a lawful basis for sending, and marketing by text also has its own consent rules.
- Your messaging provider processes the data for you, so you need a data processing agreement.
- Send as little personal data as you can, and decide how long logs are kept.
What counts as personal data in messaging
Together these describe who was contacted, when and about what, which is why they are handled with care.
- The phone number
- The message text, which may name the person or reveal an order, an appointment or a balance
- Delivery status, timestamps and the network the number belongs to
- Replies and opt-out records
Lawful basis and consent
Under GDPR every use of personal data needs a lawful basis, such as performing a contract, a legal obligation, legitimate interests or consent. Which one fits depends on the message. A delivery update for an order is different from a promotional campaign.
Marketing by text message has its own layer in the national rules that implement the ePrivacy Directive, which in many countries require prior consent. Our article on consent records describes how to document it.
Your provider is a processor
When a provider sends messages for you, it processes personal data on your behalf. GDPR requires a written agreement, usually called a data processing agreement, that sets out what the provider may do, how it secures the data, which sub-processors it uses and what happens at the end of the contract.
Ask for it early, and read the parts on sub-processors, locations and deletion.
Practical habits
- Do not send sensitive information in a text message; SMS is not end-to-end encrypted
- Keep message content out of logs where you do not need it
- Decide how long delivery logs and message content are kept, and write it down
- Know where your provider and its sub-processors process data, including outside the EU and EEA
- Be ready to find and delete a person’s messaging data when they ask
- Have a plan for reporting an incident
How ZafeConnect fits
ZafeConnect is a Danish company. Its security and data protection page and its privacy policy describe what it states; ask for the data processing agreement and for answers to your own questions in writing. This is general information and not legal advice.