The increasing digitalization of labor relations has introduced new communication tools, among which WhatsApp stands out for its ubiquity and informality. This platform, with millions of users worldwide, is increasingly used by employers as a working tool, allowing real-time, continuous communication with employees – or groups of employees – based on the assumption that they regularly check the messages and notifications received. It is often seen as a sign of modern management practices, reflecting the adoption of highly interactive and popular tools.

This seemingly harmless practice, however, involves the processing of workers’ personal data, with direct implications under both the General Data Protection Regulation (GDPR) and the Portuguese Labor Code.

On the one hand, whenever employees are added to such groups using their personal mobile numbers, this involves identifiable data (not only the phone number but also potentially profile pictures of the employee and third parties), all of which fall within the scope of personal data and may only be processed on the basis of a lawful ground under Article 6 of the GDPR.

It is also necessary to assess the actual need and proportionality of creating a WhatsApp group and the purposes of such a group, particularly in terms of exposing employees’ personal data to third parties. The principle of data minimization, enshrined in Article 5(1)(c) GDPR, requires that data processing be limited to what is strictly necessary for the intended purpose. Employers should therefore consider less intrusive, institutional communication channels that allow effective workplace communication without compromising private data.

In practice, the lawful basis most often relied upon is the legitimate interest of the organization in ensuring smooth internal communication. However, such interest must always be carefully balanced against employees’ rights and freedoms, namely their rights to privacy, image, rest, and digital disconnection.

It must therefore be assessed whether workplace communications via WhatsApp should instead be carried out through other channels. Providing employees with corporate email accounts or access to institutional platforms such as MS Teams are viable alternatives. These ensure reliable delivery without the risks inherent in the use of private personal accounts, even if they may not deliver messages with the same immediacy that an employer might wish.

This leads us directly to another key issue: the employer’s duty of abstention from contact, commonly referred to as the “right to disconnect.”

Portuguese law, through Article 199-A of the Labor Code, imposes a clear duty on employers not to contact employees during their rest periods, except in cases of force majeure. This provision, introduced in 2021, explicitly enshrines the right to disconnect, reminding employers (directly or via line managers) that employees must not be contacted during rest periods, save in exceptional cases.

This interpretation has recently been clarified by a technical note issued by the Portuguese Authority for Working Conditions (ACT), expressly stating that urgent matters created by the employer or managers – if they could reasonably have been addressed during working hours – do not qualify as force majeure.

“Contact” should be broadly interpreted to mean any communication or attempted communication that interrupts an employee’s right to rest, regardless of the medium used, including phone calls, visits, emails, chat notifications, meeting requests, and so on. WhatsApp messages clearly fall within this definition.

The Labor Code further establishes that any unfavorable treatment based on an employee’s refusal to respond to work communications outside of working hours, such as via WhatsApp, may constitute discriminatory practice, punishable as a serious administrative offense. This includes negative impacts on working conditions or career progression, such as reprisals for not responding to off-hours messages.

In this legal context, it becomes crucial to assess not only the necessity and proportionality of communications but also the legitimacy of using channels based on employees’ personal resources, such as personal mobile numbers, often shared with the employer only for exceptional or emergency purposes.

The intersection of data protection and labor law therefore requires a structured approach, including:

1. Clear internal policies and guidance – employers using WhatsApp for workplace communication should set rules regarding its use, including the purpose, content, tone, confidentiality, and permitted times for contact, to avoid abuse or interference with employees’ private lives;
2. Appropriate contractual clauses – ensuring that employees are fully informed of, and consent to, the potential inclusion of their personal data in employer-created WhatsApp groups;
3. Documented balancing of interests – maintaining clear records that legitimate interests were weighed against employees’ fundamental rights;
4. Data Protection Impact Assessments (DPIAs) and active involvement of the Data Protection Officer (DPO), or HR staff where no DPO exists;

All of this must be complemented with continuous management training, fostering a culture of awareness, compliance, and respect for employees’ fundamental rights.

In conclusion, the creation of WhatsApp groups based on employees’ personal numbers, even if supported by valid organizational reasons, requires rigorous legal analysis. Balancing employers’ legitimate interests with employees’ fundamental rights imposes clear limits on the use of digital communication in the workplace.

Failure to comply with these requirements may lead to significant liabilities, both in terms of administrative sanctions (imposed by the ACT and the Portuguese Data Protection Authority – “CNPD”) and reputational risks for the employer.

At Belzuz Abogados, our multidisciplinary team is fully prepared to provide expert legal advice on data protection and labor law matters.