WhatsApp Business Global Data Transfer Addendum

Last updated: 22 August 2025

1. Definitions

   In this Data Transfer Addendum (“Transfer Addendum”):

   “Applicable Law” means any applicable law, regulation, directive, or other binding requirements (each as may be implemented, amended, extended, superseded, or re-enacted from time to time), including but not limited to, for the avoidance of doubt, Data Protection Requirements.

   “Data Protection Requirements” means each of the following, as applicable:

“Brazil Data Protection Requirements” means any and all Applicable Law related to data protection, data security, marketing, privacy, or the Processing of Personal Information in Brazil, including, but not limited to the General Personal Information Protection Law, Law No. 13.709/2018.

“KSA Data Protection Requirements” means any and all Applicable Law related to data protection, data security, marketing, privacy, or the Processing of Personal Information in the Kingdom of Saudi Arabia, including, but not limited to the Personal Information Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H (as amended) (“PDPL”), the Implementing Regulation of the PDPL and the Regulation on the Transfer of Personal Information Outside the Kingdom.

“LATAM and Canada Data Protection Requirements” means any and all Applicable Law other than Brazil Data Protection Requirements related to data protection, data security, marketing, privacy, or the Processing of Personal Information in the countries of South America, Central America, Mexico, or Canada.

“Türkiye Data Protection Requirements” means any and all Applicable Law related to data protection, data security, marketing, privacy, or the Processing of Personal Information in Türkiye, including, but not limited to the Regulation on Procedure and Principles regarding Transfer of Personal Information Abroad and the Law on Protection of Personal Information numbered 6698.

“WhatsApp” means WhatsApp, LLC.

“SCCs” means, collectively, the following contractual clauses which are incorporated here by reference:

The Brazilian Data Protection Authority’s standard contractual clauses for international data transfers pursuant to Law No. 13,709 as set out in Annex II of Resolution CD / ANPD No. 19, available at https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/regulation-on-international-transfer-of-personal-data.pdf (or a successor location) (“Brazil SCCs”).

The Ibero-American Data Protection Network’s model contractual clauses for international data transfers, as published by the Ibero-American Data Protection Network, available at https://www.redipd.org/en/document/annex-model-contractual-clauses-en.pdf (or a successor location) (“LATAM and Canada SCCs”).

The standard contractual clauses for personal information transfer approved by the Saudi Data and Artificial Intelligence Authority pursuant to the Regulation on Personal Information Transfer Outside the Kingdom under the PDPL, the Implementing Regulation of the PDPL and the Regulation on the Transfer of Personal Information Outside the Kingdom, available at https://sdaia.gov.sa/Documents/StandardContractualClausesForPersonalDataTransferEN.pdf (or a successor location) (“KSA SCCs”).

The standard contracts approved by the Personal Information Protection Board of Türkiye with its decision dated June 4, 2024 and numbered 2024/959, available at https://kvkk.gov.tr/Icerik/7938/Standart-Sozlesmeler-ve-Baglayici-Sirket-Kurallarina-Iliskin-Dokumanlar-Hakkinda-Kamuoyu-Duyurusu (or a successor location) (“Türkiye SCCs”).

2. General
   1. No Modification to SCCs. For avoidance of doubt, nothing in the Business Terms including but not limited to this Transfer Addendum is intended to vary or modify any SCCs or prejudice the fundamental rights or freedoms of any natural person.
   2. Adequate Countries or Territories. Sections 3 to 6 of this Transfer Addendum shall each not apply to the extent that Personal Information is transferred to a country or territory which is, at the time of such transfer, deemed to ensure an adequate level of protection under the Data Protection Requirements referenced in each respective Section.
   3. Technical and Organizational Measures. For purposes of this Transfer Addendum, WhatsApp shall implement and maintain the technical and organisational security measures set out in the Data Security Terms (as updated from time to time, for example, to reflect technological developments).
   4. No Optional Clauses Unless Specified. WhatsApp and Company agree that any optional clauses, paragraphs, or language in the SCCs that are not required by Applicable Law are not incorporated unless explicitly specified in the Business Terms.
   5. Binding Agreement. WhatsApp and Company agree that the SCCs, to the extent applicable, constitute valid and binding agreements between them.
   6. Regulatory Approval. Where regulatory approval is required under Applicable Law for Company’s use of any SCCs, Company represents that it has obtained such approval or shall obtain such approval at such time when such approval is required.
   7. Alternative Format of SCCs. Each party shall promptly comply with any request by the other party to enter into the SCCs in any alternative format that may be required by Data Protection Requirements (e.g., wet-ink signature), which shall be executed in accordance with this Transfer Addendum and WhatsApp and Company’s respective designation as Controller or Processor as specified herein.
   8. Description of Transfer. To the extent required under Data Protection Laws, applicable party and transfer details are set forth in the Processing Details, unless expressly provided otherwise in the Business Terms.
   9. Conflicts.
      1. All definitions and capitalized terms provided for in the SCCs are hereby adopted as-is where such SCCs apply to the Processing of Personal Information. If there is a conflict or inconsistency between this Transfer Addendum and any SCCs, the term or definition from the SCCs shall govern to the extent such SCCs apply to the Processing of Personal Information.
      2. If there is conflict or inconsistency between the SCCs of different jurisdictions applying to the same Processing activity, the term that is most protective of Personal Information shall apply.
      3. If WhatsApp or Company enters into the SCCs pursuant to Section 2(g) of this Transfer Addendum, those terms shall take precedence to the extent applicable.
      4. If the SCCs or their use in connection with the Business Terms are deemed invalid by the relevant regulator for whatever reason and are replaced by other SCCs or another valid transfer mechanism issued or approved by the relevant regulator, WhatsApp and Company shall promptly implement such other SCCs or such replacement transfer mechanism for transferring Personal Information.
3. Brazil. To the extent that Personal Information which is subject to Brazil Data Protection Requirements is transferred by you to WhatsApp in connection with the Business Terms, such Processing shall be governed by the Brazil SCCs.
   1. For the purposes of the Brazil SCCs, you are the Controller and Exporter of Personal Information transferred to WhatsApp, and WhatsApp is the Processor and Importer of such Personal Information.
   2. In Clause 4 of the Brazil SCCs, Option A will apply and you shall be the Designated Party.
   3. WhatsApp is authorized to carry out Onward Transfers of Personal Information provided all provisions of Clause 18 of the Brazil SCCs as well as all applicable provisions of the Business Terms are observed.
4. Kingdom of Saudi Arabia (“KSA”). To the extent that Personal Information which is subject to KSA Data Protection Requirements is transferred by Company to WhatsApp in connection with the Business Terms, such Processing shall be governed by the KSA SCCs. For purposes of the KSA SCCs you are the Controller and Exporter of Personal Information transferred to WhatsApp, and WhatsApp is the Processor and Importer of such Personal Information and the Second Template (“Controller to Processor”) shall apply.
5. LATAM and Canada. To the extent Personal Information which is subject to LATAM and Canada Data Protection Requirements is transferred by Company to WhatsApp in connection with the Business Terms, such Processing shall be governed by the LATAM and Canada SCCs. Where this paragraph applies:
1. For the purposes of the LATAM and Canada SCCs, you are the Controller and Exporter of Personal Information transferred to WhatsApp, and WhatsApp is the Processor and Importer of such Personal Information, and the "Controller to Processor” clauses shall apply.
2. Clause 7 in those clauses: Option 2 (general written authorization) is selected. Unless otherwise prohibited under the Business Terms, WhatsApp is authorized to carry out Onward Transfers of Personal Information to the Sub-processors included in the Business Terms in accordance with Clause 7.
3. Competent Supervisory Authority: according to Applicable Law.
6. Türkiye. To the extent that Personal Information which is subject to Türkiye Data Protection Requirements is transferred by Company to WhatsApp in connection with the Business Terms, such Processing shall be governed by the Türkiye SCCs. For purposes of the Türkiye SCCs you are the Controller and Exporter of Personal Information transferred to WhatsApp, and WhatsApp is the Processor and Importer of such Personal Information and the “Data Controller to Data Processor” contract shall apply.

Processing Details:

1. Parties

Start Date	The date upon which the parties enter into the Business Terms.
The Parties	Exporter	Importer
Parties’ details	Full legal name: Available from the Company directly. Main address (if a company registered address): Available from the Company directly.	Full legal name: WhatsApp LLC Main address (if a company registered address): The Data Importer’s address and contact details are specified in the Business Terms.
Key Contact	Available from the Company directly.	As specified in the Business Terms.
Contact for data subjects	The contact details are available from Exporter directly.	The contact details are available in WhatsApp's Privacy Policy.
Signature (if required)	The parties agree that agreement of the Business Terms by the data exporter and the data importer shall constitute agreement to, and execution of this Transfer Addendum by both parties on the date on which the Business Terms are agreed.	The parties agree that agreement of the Business Terms by the data exporter and the data importer shall constitute agreement to, and execution of this Transfer Addendum by both parties on the date on which the Business Terms are agreed.

2. Transfer

Categories of data subjects whose personal information is transferred	The categories of Data Subjects comprise customers with whom you communicate using the WhatsApp service.
Categories of personal information transferred, including sensitive personal information transferred (if applicable) and restrictions or safeguards applied:	The categories of Personal Information transferred comprise customer contact information as described in the Business Terms.
Frequency of the transfer	Continuous for the duration of the agreement.
Purpose of the data transfer and further processing	The Importer will process Personal Information for the purposes described in the Business Terms.
The period for which the personal information will be retained, or, if that is not possible, the criteria used to determine that period	Until deletion in accordance with the provisions of the Data Processing Terms.
For transfers to sub-processors, also specify subject matter, nature and duration of the processing	As specified above.
Sub-processors	The agreed list of sub-processors is available at https://www.whatsapp.com/legal/business-subprocessors.