Client Chats in a CRM: Where They're Stored and Who Can See Them

Some of the most careful questions we get in demos come from businesses that answer to a regulator or a professional body. A medical laboratory wanted to know exactly where its patient conversations would live and who on the team could open them. An accounting firm asked whether it could pull every client thread back out if it ever left. Neither was asking about features. They wanted to know whether they could trust the software with the record.

If you run a clinic in Bangsar, a law or accounting practice in Petaling Jaya, or an insurance agency in Cheras, and your team talks to clients on WhatsApp, those are your questions too. Once conversations move from staff phones into a shared CRM, the business is holding a lot of personal data in one place, and in Malaysia that brings the Personal Data Protection Act 2010 into the picture.

This article covers where the chats actually sit, who can read them, what the PDPA generally expects, and what to check before you sign. It's general information as of September 2026, not legal advice. For your own obligations, talk to your adviser or check the Personal Data Protection Commissioner's published guidance.

Where a WhatsApp message goes

Most people assume WhatsApp's end-to-end encryption covers everything. It's more nuanced once a business is involved.

Between two people on ordinary WhatsApp, messages are end-to-end encrypted. When a customer messages a business on the WhatsApp Business Platform, the message is encrypted on the way, but it has to be decrypted somewhere so the business's software can read it. With Meta's Cloud API, which most CRMs use, that happens on infrastructure Meta hosts on the business's behalf. Meta's documentation describes holding message content only temporarily, for delivery. Read Meta's current data-handling terms if you need the detail.

After that, the message is delivered to your CRM in readable form, and the CRM keeps it so your team can search, assign, tag and follow up. From that point, the encryption WhatsApp advertises isn't what's protecting it. Your CRM is. So the platform behind your number is the thing to question.

Free download

The Client Chat Data Checklist: Questions to Settle Before a CRM Holds Your Clients' Chats

A practical companion to this article. Free for your email address.

Get it free

Where the CRM keeps your chats

In a data centre run by, or on behalf of, your CRM provider. Ask any vendor one blunt question: which country are our conversations stored in? A vendor that can't name the region straight away probably hasn't thought about it.

For the record, Yalla stores conversation data encrypted, in an AWS data centre in South-east Asia outside Malaysia, and we'll tell you the region and put it in writing if you ask.

Storage outside Malaysia is common, and the PDPA doesn't ban it. Since the 2024 amendments, the Act allows personal data to be transferred abroad under set conditions, for example where the destination has laws substantially similar to the PDPA or ensures an adequate level of protection, and the Commissioner has issued guidelines on cross-border transfers. What you should expect from a vendor is a clear answer on where the data sits and the basis on which it's protected there.

The follow-up questions that separate a serious platform from a thin one:

• Is the data encrypted at rest, not just on the way in?
• How long is history kept, and can you set that period yourself?
• Are backups encrypted too? Backups are the quiet gap. Data can be well protected in the live system and sitting unprotected in a copy.
• If you cancel, what happens to the record, and can you take it with you?

What the PDPA generally expects

The PDPA applies to personal data processed in commercial transactions, and it's built around seven principles. In plain terms, for a team using WhatsApp:

• General: have a lawful basis, usually consent, for processing personal data.
• Notice and Choice: tell customers what you collect, why, and who it goes to. Many businesses do this with a privacy notice linked from their first reply or website.
• Disclosure: don't share the data for purposes the customer wasn't told about.
• Security: take practical steps to protect it from loss, misuse and unauthorised access. Role-based access in your inbox is part of this.
• Retention: don't keep it longer than you need for the purpose.
• Data Integrity: keep it accurate and up to date.
• Access: customers can ask to see and correct what you hold about them, so you need to be able to find it.

The Personal Data Protection (Amendment) Act 2024 came into force in phases during 2025. The changes that matter most here: data processors, which is what your CRM vendor usually is, now have direct security obligations; data controllers must notify the Commissioner of personal data breaches, and in some cases the affected individuals; organisations above certain thresholds must appoint a data protection officer; customers gained a right to data portability; and the maximum penalties went up. The Commissioner has issued guidelines on breach notification and data protection officers. Check which apply to your business and what the timelines are.

Clinics, law firms and financial businesses often have professional confidentiality rules on top of the PDPA. Those don't change because the conversation happens on WhatsApp.

Who on your team can see which conversations

This is where a shared WhatsApp number becomes a real risk, and where most small teams have no answer. When everyone logs into the same phone or the same WhatsApp Web session, everyone sees everything. For a furniture shop that's fine. For a clinic or an accounting practice it isn't, because not every staff member should be able to open every client's thread.

What you want is role-based access. A good WhatsApp CRM lets you decide by role and by who owns the conversation, so a junior officer handles their assigned enquiries, a manager sees the pipeline and reports, and sensitive threads aren't open to the whole office by default. Internal notes on a conversation should be visible to the team and never sent to the customer, and it should be obvious which is which.

If a vendor's answer to "who can see this conversation?" is "anyone with the login", what you have is a shared password.

Disputes, access requests and leaving

Three moments show whether a platform was built to hold a record or just to send messages.

A dispute. A client says you never agreed to that fee, that deadline, that scope. If the WhatsApp thread is the only place the agreement lives, you need to find it, read it in full and show it. That means searchable history with the context intact, not a view that only keeps the last thirty days.

An access request. Under the PDPA, a customer can ask what you hold about them. If their data is spread across four staff phones, answering that properly is close to impossible. In one system, it's a search.

Leaving. You only really own your data if you can get it out. Before you sign, ask what an export includes: which fields, what format, how far back, and how long it takes. A vendor confident in its product has no reason to make leaving hard.

What the AI agent can see

Every WhatsApp CRM now has an AI layer, and it reads your conversations to do its job. Two things to pin down.

First, what it's allowed to read. A well-built agent answers from a knowledge base you control, rather than roaming across every record. That's an accuracy safeguard and a data one.

Second, what it can act on. Yalla's AI works across pipelines, WhatsApp, Instagram, Facebook, email campaigns and reporting from one instruction. That reach is what makes it useful, and it's also why you should hold a platform like ours to a higher bar on permissions, storage and logging. Ask any vendor what their AI can read, what it can change, and whether customer data is used to train anyone's models.

Where a WhatsApp CRM isn't the right home

If your compliance regime needs formal certifications, field-level audit logs, legal hold and data processing terms negotiated by your own counsel, a large enterprise platform is built for that scrutiny in a way a lean WhatsApp CRM isn't, and you should expect to pay for it.

If what you really need is document management, secure file exchange and deadline tracking after the sale, a CRM is the wrong tool. A practice-management or document system is what you want, and we've said so to accounting firms in demos.

A WhatsApp CRM earns its place when the conversation is the relationship, the team shares the enquiries, and the record you care most about is the thread.

A seven-point check before you sign

1. Storage location. Which country holds the data, and is it encrypted at rest?
2. Cross-border basis. If it's stored outside Malaysia, how does the vendor support your PDPA position?
3. Access control. Can you limit who sees which conversations by role, not just by login?
4. Retention. How long is history kept, can you set the period, and are backups encrypted?
5. Export and access requests. Can you pull a customer's full record, or everything, in a usable format?
6. Breach notification. How fast will the vendor tell you about an incident, so you can meet your own obligations?
7. Official API and AI scope. Is the platform on the official WhatsApp Business API, and what can its AI read and change?

A vendor who answers all seven without hesitating is treating your record as yours.

Frequently asked questions

Can Meta read my customer conversations?

Messages are encrypted in transit. On the Cloud API, Meta processes them on the business's behalf to deliver them and describes holding content only temporarily. Once delivered, protection depends on your CRM's encryption, access controls and backups.

Is it legal under the PDPA to store WhatsApp chats outside Malaysia?

Cross-border transfers are allowed under conditions set out in the Act and the Commissioner's guidelines. Ask your vendor where the data sits and on what basis, and check your position with your adviser.

Do we need customer consent to message them on WhatsApp?

Meta requires opt-in before a business starts a conversation, and the PDPA expects you to tell people how their data is used. Keep a record of how and when each customer opted in.

Does the AI agent see all our customer data?

Only what you let it. Confirm what it can read and act on before you switch it on.