To answer the first question, GDPR, as I understand it, is a legislative framework that establishes

criteria for the gathering and processing of personal information from European Union residents. Its
goal is to govern the processing of individuals' data. Companies cannot lawfully process any person's
personally identifiable information unless they fulfill at least one of the six standards outlined in
GDPR.

 The data subject's express permission

 Processing is required to carry out a contract with the data subject or to take measures to
enter into a contract.
 Processing is required to comply with a legal duty.
 Processing is required to protect a data subject's or another person's vital interests.
 Processing is required to carry out a job in the public interest or the exercise of official power
vested in the controller.
 Processing is required for the controller's or a third party's legitimate interests unless such
interests are outweighed by the data subject's interests, rights, or freedoms.

The GDPR summarizes that the law establishes obligations for businesses and provides rights for
citizens. Businesses are wise to update or establish their data protection compliance program.

To answer the second question, I would like to say as we know the use of WhatsApp is controversial
from a data protection perspective, companies can use the WhatsApp Business API in compliance
with the GDPR. According to Article 49 sec. 1a GDPR personal data may be transferred to third
countries with explicit consent after being informed about the existing potential risks.