WhatsApp Chatbots and Customer Data: PDPA Considerations for Sri Lankan Businesses

WhatsApp is where Sri Lankan customers already ask “where is my order?”, book appointments, and send NICs as photos. Connecting an AI chatbot to that channel creates speed—and personal-data risk—unless you design controls before go-live.

Disclaimer: this is operational guidance for product, ops, and IT teams. It is not legal advice. Have compliance counsel review notices, consent, and sector-specific rules (especially patient and employee data).

Parent guide: Digital Transformation in Sri Lanka. Companion checklists: PDPA for SMEs and cloud ERP data protection.

Why chatbots are a PDPA control surface

Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 entered enforcement on 18 March 2025 (date checked: August 2026). Chat logs, phone numbers, delivery addresses, and ticket history are personal data. AI that summarises chats or looks up ERP/HMS records can widen access if roles and prompts are loose.

WhatsApp / AI chatbot PDPA checklist

1. Purpose lock: list the three intents the bot may handle (e.g. hours, order status, appointment slots)—everything else escalates.
2. Data minimisation: do not ask for NIC, full card numbers, or medical details in free text.
3. Identity before disclosure: require order ID + phone match (or equivalent) before sharing account-specific facts.
4. Human handoff: publish escalation triggers for complaints, refunds, clinical questions, and unclear Sinhala/Tamil/Singlish.
5. Staff access: limit who can open the WhatsApp Business inbox and export chat history.
6. Retention: define how long bot transcripts and CRM tickets are kept; disable indefinite personal-phone backups.
7. Model boundary: keep prompts from sending payroll, patient notes, or full customer dumps to unmanaged public AI tools.
8. Logging: retain enough audit trail to investigate misuse without storing unnecessary message bodies forever.
9. Vendor file: document Meta Business API host, chatbot vendor, and any AI subprocessors.
10. Privacy notice: ensure website/app notice mentions messaging channels in language counsel approves.

Industry examples

• Retail: order status and LankaQR payment-link nudges—never full card data in chat.
• Clinics: appointment booking and report-ready notices—escalate clinical interpretation; see WhatsApp AI for clinics patterns.
• Hotels: booking FAQs and deposit reminders—verify guest reference before sharing stay details.
• HR/recruiting: acknowledge CV receipt—do not auto-discuss salaries or rejection reasons via bot.

Implementation patterns: WhatsApp AI chatbots use cases and costs, WhatsApp AI for clinics, and AI integration services.

Revision history

• 2026-08-07 — Initial operational chatbot/PDPA checklist published.

Next step

Scope a Business API pilot with handoff rules on Capricon’s WhatsApp AI automation page, or contact Capricon. For hospital messaging patterns tied to billing systems, see the private hospital HMS case study.

Sources

• Parliament of Sri Lanka — Personal Data Protection Act, No. 9 of 2022.
• Data Protection Authority of Sri Lanka — https://www.dpa.gov.lk/guidelines.php (date checked: August 2026).