WhatsApp Business: Obligations Under Panama's Data Law

Understanding Law 81 and Its Impact on WhatsApp Business

Implemented in Panama since 2019 and updated on October 4, 2026, Law 81 outlines clear obligations for small businesses utilizing AI assistants on platforms like WhatsApp. This is essential knowledge for businesses using chatbots to handle appointments, sales, or inquiries.

Key Obligations for Implementing an AI Assistant

• Explicit Customer Notice: Inform customers at the interaction's start that they are engaging with AI, that the conversation is recorded, and its purpose. On WhatsApp, this notice should be part of the first message or in the profile, linking to your privacy policy.
• Consent or Legal Basis: Outbound messages require explicit consent or a prior commercial relationship.
• Data Minimization and Limitation: Collect only information strictly necessary for the transaction (e.g., scheduling does not require medical data).
• Limited Retention: Clearly define timelines for storing conversations and documents based on their purpose.
• User Rights: Ensure customers can access, rectify, cancel, or object to data processing through the same channel.
• Security and Records: Use encryption, access roles, and keep logs of data access. Also, arrange written protocols for incident notifications.
• International Transfers: If an AI model or cloud provider is based outside Panama, obtain consent, a contract, or demonstrate equivalent protection.
• Incident Notification: Report any data breach to authorities and affected clients within 72 hours.

These guidelines apply to tools available on WhatsApp or via API, offered by companies like Inferencia Digital and other local AI automation specialists. It is crucial to document all aspects, from suppliers to internal privacy policies.

What to Do This Week?

1. Review your WhatsApp message flow: Ensure it includes legal notices about AI use and links to your privacy policy.
2. Formally document customer consents and the legal basis for outgoing messages.
3. Implement a clear data retention policy, minimizing information collected and ensuring timely deletion.
4. Formalize contracts or agreements with external data processors, specifying locations and managed data.
5. Define an incident response protocol, including timelines, notifications, and corrective measures.

Complying with Law 81 not only avoids penalties but also strengthens customer trust and your business reputation in Panama.

Tools like LabHub's WhatsApp assistant can simplify compliance by providing automatic notices, managing consents, limiting data, recording access, and automating security protocols. It helps small businesses operate legally and efficiently without overwhelming them.