DPIA — Meta WhatsApp Cloud API

Provider: Meta Platforms, Inc. Service: WhatsApp Business Cloud API via graph.facebook.com Contract owner: ZFA InsureLink (data controller) DPIA owner: DPO Last review: 2026-07-16

What data is transferred

Field	Purpose	Retention at provider
Recipient MSISDN	WhatsApp routing	Persistent (tied to user's WA account)
Message body (up to 4096 chars text)	Message content	Meta retains for 30 days on messaging_analytics API
Template payload (variables)	Rendered content	Same as message body
Media (if attached)	Content delivery	Meta CDN; ephemeral (24h URL)
Delivery/read receipts	Reconciliation	Meta business tools

Where the data goes

WhatsApp Cloud API terminates in Meta's US-based infrastructure (primary: us-east / us-west). Every WhatsApp message is a cross-border transfer to the United States.

Legal basis

Same shape as the Africa's Talking DPIA:

1. DataTransferConsent row (transferKind = whatsapp_us) for non-transactional messages.
2. legal_obligation carve-out for auth / compliance / system.

Meta additionally requires that every non-utility WhatsApp template be pre-approved through its own review pipeline; template categories and approval status live in Meta Business Manager and are cross- referenced via NotificationTemplate.metadata.

Safeguards

• HTTPS transport (TLS 1.3); Meta enforces on their side.
• Access token via WHATSAPP_ACCESS_TOKEN env; rotated per Meta's 60-day recommended cycle.
• HMAC-SHA256 signature on delivery webhooks (WHATSAPP_WEBHOOK_APP_SECRET); timing-safe compare in provider-webhooks.controller.ts. Meta's own hub.challenge verification handshake on subscription.
• STOP replies from recipient → automatic preference flip on channel whatsapp across all non-transactional categories.

Data-subject rights routing

• Access (§17(1)): DPO exports the recipient's Notification rows filtered by channel=whatsapp. Bodies decrypt under NotificationPii.
• Erasure (§17(5)): platform-side soft-delete via the DSAR module. Meta-side deletion requested via Meta Business Support; Meta's SLA is 30 days for account-scoped erasure.
• Objection: STOP OR POST /notification-preferences/me/data-transfer/withdraw (transferKind=whatsapp_us).

Residual risks

• US surveillance regime — CLOUD Act / FISA §702. Meta may be compelled to disclose message metadata (and, under narrow circumstances, content) to US authorities. Uganda-registered users are informed of this at consent-acknowledgement time via the noticeVersion=2026.07 DataTransferConsent notice text.
• Meta template review — a template rejected by Meta review cannot be dispatched. Ops maintains a rejected-template list in Meta Business Manager; dispatches to a rejected template surface as notification.status=failed with error=template_not_approved.

Review cadence

Annual, or on:

• Meta contract / DPA change
• New template category (utility → marketing conversion, etc.)
• Regulator query