Comparisons
Are WhatsApp groups at work legal in Spain? What the AEPD has ruled and when an incident manager makes sense (2026)
Almost every business with premises has a WhatsApp group: the restaurant staff group, the maintenance team at the warehouse, the committee of the residents' association. The legal question is a precise one. Creating the group is not forbidden, but adding the personal mobile number of an employee, or of someone from a contractor, needs a legal basis the company can explain. Here is what the Agencia Española de Protección de Datos (AEPD, Spain's data protection authority) has ruled, what the right to disconnect adds and, for faults on the premises, what changes between a group and an incident manager.
The short answer
No Spanish law forbids WhatsApp groups at work. What the AEPD has penalised are specific cases in which an employee's personal number was used without a legal basis the company could prove. Its approach, in the rulings read, has three parts:
- The employee's consent is not a valid basis, because of the imbalance of power in the employment relationship.
- The personal number stops being “necessary” if there is a less intrusive alternative, such as a company phone or account.
- Legitimate interest is possible, but the company has to weigh it up and justify why it needs that number.
The right to disconnect does not ban the group, but it limits what it is used for outside working hours. And for faults on business premises, the problem with the group is practical rather than legal: a report that everyone reads has nobody in particular to pick it up.
What the AEPD has ruled, case by case
They are rulings published by the authority, not laws: they decide specific facts and explain what weighed in each one.
| Case file | What happened | What the AEPD decided |
|---|---|---|
| EXP202404627 (PS/00393/2024) | A sheltered employment centre added a call-centre worker's personal mobile to the work WhatsApp group and messaged him outside his working hours | Breach of Art. 6(1) GDPR for lack of a proven legal basis; the company accepted responsibility and paid in 2025 |
| EXP202202616 (PS/00269/2022) | Two committee members of a residents' association set up a group with the cleaner, employed by a self-employed contractor, to ask her for photos of her work every day | Penalty for the association under Art. 6(1) GDPR and, for not answering her right of access, under Art. 15 |
| PS/00452/2022, appeal RR/00162/2023 | A security company set up a group with the personal numbers of five guards for their training, and sent emails without blind copy | The group was not penalised because no member denied having consented; the emails without blind copy were (Art. 5(1)(f) GDPR) |
| E/11427/2021 | A works council added more than ninety employees to a group without telling them | Closed: it could not be shown whether the numbers were personal or company ones, and nobody responsible was left |
| EXP202313227 (PS/00505/2023) | An advisory firm kept sending client data by WhatsApp to the personal mobile of an employee who had refused in writing | Penalty under Art. 6(1) and Art. 32 GDPR, the security article; there was no group here, only one-to-one messages |
Rulings published by the AEPD and read on 19 October 2026. Amounts are not reproduced.
The sentence that sums up the approach is in the first of those case files:
cuando los datos de contacto utilizados por el empleador no sean corporativos, sino de uso personal de los trabajadores, el tratamiento de tales datos, incluida su revelación a otros compañeros, no podrá justificarse en la base de legitimación contemplada en el artículo 6.1.b) del RGPD. (“where the contact details used by the employer are not corporate but for the employees' personal use, processing them, including disclosing them to other colleagues, cannot be justified on the legal basis in Article 6(1)(b) GDPR.”)
The same ruling leaves another door open: the private phone “podría basarse en el interés legítimo, pero el empleador debe hacer la ponderación y justificar la “necesidad” de la utilización del mismo” (could rest on legitimate interest, but the employer must weigh it up and justify the need to use it). And the AEPD's guide on employment relationships, updated in December 2025, points out that the employment contract alone does not entitle the company to ask for a personal phone number, citing Supreme Court ruling 4086/2015. The guide does not mention WhatsApp.
Worth knowing
Someone from a contractor is no exception. In the residents' association case, the cleaner worked for the contracted company, not for the association, and the penalty still went to the association, because it was the one that had used her number.
And what is sent matters as much as who is in the group: sending client data to an employee's private phone also led to a security penalty (Art. 32 GDPR).
The right to disconnect does not ban the group: it limits its hours
Organic Act 3/2018 gives employees the right to digital disconnection “fuera del tiempo de trabajo legal o convencionalmente establecido” (outside the working time set by law or by agreement) (Art. 88(1)), and the Workers' Statute repeats it in Art. 20 bis. How it is exercised is decided by collective bargaining or, where there is none, by agreement between the company and the workers' representatives (Art. 88(2)).
It asks the employer for two things in writing. An internal disconnection policy, drawn up after consulting the workers' representatives (Art. 88(3)). And criteria for using the digital devices it provides to staff, which employees must be told about (Art. 87(3)). For remote work, Act 10/2021 specifies that guaranteeing disconnection “conlleva una limitación del uso de los medios tecnológicos de comunicación empresarial” (entails limiting the use of the company's technological means of communication) during rest periods (Art. 18(1)).
What they leave out matters too. Neither the act nor the Statute names WhatsApp, and neither of them, on its own, forbids a message at eleven at night. In the AEPD rulings read, the breach was always one of data protection: the out-of-hours messages appear as a fact of the case, not as a separate breach.
Rules for a company WhatsApp group
If the group stays, these rules follow from the above; they are not an official list, and each one comes from an article or a ruling cited.
- A company phone or account before a personal number. If that alternative exists and is not used, the personal number stops being necessary (EXP202404627).
- A written legal basis before the group is created, other than the employee's consent; if it is legitimate interest, with the balancing test done.
- Only what the work needs: shifts, instructions, notices. The AEPD closed a case about delivery-route groups because they handled “los mínimos necesarios para la organización del trabajo” (the minimum needed to organise the work) (EXP202105690, cited in PS/00452/2022).
- No client data on a personal mobile, because of the security duty in Art. 32 GDPR (EXP202313227).
- Nobody from outside without their own basis: staff from a contractor or a resident are not added just because (EXP202202616).
- Hours and disconnection in writing, in the internal policy under Art. 88(3) of Organic Act 3/2018, and the criteria for device use communicated to staff (Art. 87(3)).
For faults on the premises: group or incident manager
Even if it meets all of the above, a group is poorly suited to one specific job: faults. Think of a restaurant's cold room showing nine degrees at 22:40, or the extinguisher in the corridor with its seal broken. Posted in a group of twelve people, the report is read by everyone and picked up by nobody in particular; the next day nobody knows what time it was reported or who said they would look at it.
An incident manager turns each report into a fault report with an owner, a time and a status. It does not have to be a full CMMS: the difference lies in what is written down and in who answers for each thing.
| Question | WhatsApp group | Incident manager |
|---|---|---|
| Who finds out | The whole group, including people who can do nothing about the report | The person who has to fix it, and their manager if nobody picks it up |
| Who picks it up | Nobody in particular: everyone assumes someone else has already seen it | One person, and it is recorded who and at what time |
| What is recorded | Scattered messages on each member's phone, mixed up with everything else | The time of the report, the time it was picked up and the time it was fixed, fault by fault |
| The personal number | Every member sees it in the group's member list, and the company has to justify using it | With a business channel, whoever reports does not need anyone's number |
| Out of hours | It reaches the whole group at once, including people who are resting | It can go only to whoever is on call; the rest waits for their shift |
| When someone leaves the company | They leave with their phone and the history it held | The history stays with the business |
| Dated inspections | They depend on someone remembering to post them | The person in charge can be reminded before they fall due |
The honest answer for a small business: if there are three of you, you share the same shift and faults can be counted on one hand each month, a group with company phones and clear rules may be enough. It stops being enough when the same fault is posted twice, when nobody can say whether the cold room was fixed or when, or when the history of an installation has to be dug out of the phone of someone who no longer works there.
Where Bedel fits
Bedel is a WhatsApp incident manager that uses the business's number, not anyone's personal one. Whoever sees the fault writes to that number, and Bedel puts the report on the phone of the person who fixes it, not in a group, with three times: when it was reported, when it was picked up and when it was fixed. If nobody picks it up, it goes up to the manager. Everything ends up in an Excel file. And the dated inspections the business keeps in a spreadsheet are loaded by Bedel, which reminds whoever looks after maintenance every month, on WhatsApp.
What it does not do. It is not a CMMS: it keeps no equipment inventory or work orders with parts and costs, and it does not store the certificate or report from each inspection. It does not connect to other tools. It does not replace the maintenance contractor or the inspection body. And it does not replace the device-use policy or the disconnection policy that Organic Act 3/2018 requires of every company (Arts. 87 and 88): the business decides and writes those. If the question is a spreadsheet or a CMMS, see CMMS or Excel.
Frequently asked questions
Are WhatsApp groups at work legal in Spain?
Yes, no law forbids them. What the AEPD has penalised is using the personal number of an employee, or of someone from a contractor, without a legal basis the company can prove. The worker's consent is not valid because of the imbalance in the employment relationship, and if there is a less intrusive alternative, such as a company phone, the personal number stops being necessary (case file EXP202404627).
Can my employer add me to a work WhatsApp group without my permission?
Permission is not the key point: the AEPD says that, with an employee, consent is not a valid legal basis. The company needs another one, usually a legitimate interest that has been weighed up and justified, and has to explain why it needs your personal number. In the cases read, where it had none, the AEPD imposed a penalty (EXP202404627 and EXP202202616); where nobody in the group complained, the group was not penalised (PS/00452/2022).
Do I have to answer the work group outside my working hours?
Organic Act 3/2018 recognises the right to digital disconnection outside working time (Art. 88(1)) and leaves the way it is exercised to the collective agreement or an agreement with the workers' representatives (Art. 88(2)). The company must have an internal policy on it (Art. 88(3)). The act does not name WhatsApp or set hours: the specifics are in your collective agreement and in that policy.
What rules should a company WhatsApp group have?
Those that follow from the AEPD and the law: a company phone or account before a personal number; a written legal basis other than consent; only the information the work needs; no client data on a personal mobile; nobody from a contractor without their own basis; and hours and disconnection set out in the internal policy under Art. 88(3) of Organic Act 3/2018.
Can a residents' association add the cleaner to a WhatsApp group?
Not without a legal basis. In case file EXP202202616 (PS/00269/2022), two committee members of an association set up a group with the cleaner, who worked for a contracted company, to ask her for photos of her work every day. The AEPD penalised the association for using her mobile number without a legal basis (Art. 6(1) GDPR) and for not answering her right of access (Art. 15).
Does an incident manager replace the WhatsApp group?
Only for things that need an owner: faults, inspections, jobs somebody has to pick up. General notices, such as a shift change or closing on a bank holiday, can stay in a group with the rules above. The difference is that in the incident manager every fault records who picked it up and at what times, and the history stays with the business, not on each employee's phone.
Comparisons
- CMMS or Excel for maintaining business premisesWhen a spreadsheet is enough and when a CMMS is needed, how to build the preventive plan in Excel and which records the law says to keep.
- Best CMMS for businesses with premises: criteriaSix criteria built for premises, seven CMMS described with what their websites say, and where Bedel fits, which is not one of them.
Rules by sector
- Restaurants and barsThe obligations of a restaurant or a bar in Spain: what is specific to the kitchen and the checks on the premises, each with the condition that triggers it, how often it applies and its article.
- GymsA gym: no national law; qualifications, insurance and notices under each region's sports professions act, plus low voltage, Legionella, pool, RIPCI and defibrillator as premises.
- HotelsA hotel: guest register and reporting within 24 hours, regional classification, low voltage and lift as a public-assembly venue, RIPCI, Legionella, pool, kitchen and defibrillator.
- Residents' associationsThe obligations of a Spanish residents' association: upkeep, reserve fund, owners' meeting and administrator under the Horizontal Property Act, building logbook, building inspection and the checks on each communal installation.
- Shops and franchisesA shop: responsible declaration up to 750 m², opening hours, prices, franchises with no register since 2018, complaint forms, accessibility adjustments and the inspections of premises open to the public.
- OfficesThe obligations of an office in Spain: temperature and upkeep of the premises, screen work, health and safety, coordination with contractors, internal reporting channel, right to disconnect and building checks.
- SchoolsA school: minimum facilities, protocols against violence and a wellbeing coordinator, canteen and menus from April 2026, self-protection and the building inspections.
- Industrial unitsAn industrial unit: fire inspection every five years under the 2025 regulation, chemical storage (APQ), air receivers, work equipment, low voltage, cooling towers and self-protection.