# Messaging Consent and Data Retention Readiness Assessment > Source: https://netray.co/tools/messaging-consent-and-data-retention-readiness-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Ten questions that score how well your business messaging handles consent evidence, opt-outs, retention and access. ## Category compliance-legal ## Audience - Compliance officer - IT manager - Data protection lead ## Tool **Kind:** assessment **Questions:** #### How do you record consent to receive business messages? **Help:** Think about whether you could show proof for one specific customer today. **Options:** ##### We do not record it **Score:** 0 ##### Verbally or in staff notes **Score:** 1 ##### A flag in the CRM or ERP without date or source **Score:** 2 ##### Date, source, wording and channel stored per contact **Score:** 4 #### Is consent specific to each channel and purpose? **Options:** ##### No, one general agreement **Score:** 0 ##### Partly, by channel only **Score:** 2 ##### Yes, by channel and by transactional or marketing purpose **Score:** 4 #### How are opt-out requests handled? **Options:** ##### No defined process **Score:** 0 ##### Manual, staff remove people when asked **Score:** 1 ##### Keyword or link opt-out updates one list, but not all systems **Score:** 2 ##### Opt-out is applied automatically across all senders within a day **Score:** 4 #### Do sending systems check consent status before every send? **Options:** ##### No check **Score:** 0 ##### Only for marketing sends **Score:** 2 ##### Yes, enforced in code for all sends **Score:** 4 #### Do you have a defined retention period for message content and logs? **Options:** ##### No, we keep everything **Score:** 0 ##### Defined but not enforced **Score:** 2 ##### Defined, enforced by automated deletion or archiving **Score:** 4 #### Can you find and export all messages for one individual on request? **Options:** ##### No **Score:** 0 ##### Only with manual searching across systems **Score:** 2 ##### Yes, through a documented procedure with a time target **Score:** 4 #### Where is message content stored and who can read it? **Options:** ##### Not documented **Score:** 0 ##### Documented, broad internal access **Score:** 1 ##### Documented, role based access with logging **Score:** 3 ##### Documented, role based, logged and reviewed on a schedule **Score:** 4 #### Do you limit personal data inside message variables? **Help:** For example avoiding account balances or health details in template text. **Options:** ##### No review **Score:** 0 ##### Reviewed informally at launch **Score:** 2 ##### Template content reviewed against a data minimisation rule **Score:** 4 #### Are messaging vendors covered by data processing agreements? **Options:** ##### Not checked **Score:** 0 ##### Some are **Score:** 2 ##### All vendors, with sub-processor and location details recorded **Score:** 4 #### How often is the programme reviewed against block rates and complaints? **Options:** ##### Never **Score:** 0 ##### After a problem **Score:** 1 ##### Quarterly **Score:** 3 ##### Monthly with owners and actions **Score:** 4 **Bands:** #### High exposure **Min:** 0 **Max:** 34 **Verdict:** Consent and retention are largely informal, so you could struggle to evidence compliance or respond to a request. **Recommendations:** - Start recording consent date, source and wording for every contact. - Stop marketing sends to anyone without clear consent. - Write a one page retention rule and apply it to message logs. - Name one owner for opt-outs. #### Partially controlled **Min:** 35 **Max:** 59 **Verdict:** Some controls exist but they are inconsistent across channels and systems. **Recommendations:** - Make consent checks a hard gate in every sending system. - Propagate opt-outs to all senders within a day. - Document where message content is stored and who can read it. - Confirm data processing terms with each messaging vendor. #### Mostly in place **Min:** 60 **Max:** 84 **Verdict:** The core controls work, with gaps in enforcement or review. **Recommendations:** - Automate retention deletion and test it. - Practise an individual data export and time it. - Add template content reviews to the approval step. - Review block and complaint rates monthly. #### Well controlled **Min:** 85 **Max:** 100 **Verdict:** Your messaging programme shows strong evidence of consent, retention and review. **Recommendations:** - Keep reviewing when regulations or platform policies change. - Test the opt-out and export processes at least yearly. - Include new channels in the same controls before launch. ## Content **Intro:** Business messaging over WhatsApp, SMS or Teams collects phone numbers and message content, which brings consent and retention duties under laws such as the EU GDPR and India's DPDP Act, plus platform policies. This assessment scores how ready your handling is. **Sections:** #### How to use the assessment **Body:** Answer each question for the messaging you run today, not what is planned. Choose the option you could demonstrate with a record or a screenshot, because an auditor or a complaint will ask for evidence. The score is converted to a percentage and mapped to one of four bands with specific next steps. **Bullets:** - Involve whoever owns the CRM and the sending systems. - Answer for the weakest channel if channels differ. - Repeat after changes to see the score move. #### What the questions test **Body:** Consent questions test whether you can prove who agreed to what, when and through which channel. Opt-out and enforcement questions test whether that choice actually changes behaviour in every system that sends. Retention and access questions test whether you can limit how long you hold content and retrieve it for an individual. Vendor and review questions test governance around the platforms involved. #### Reading the result **Body:** A low score does not mean you are breaking the law, but it means you may be unable to show you are not. The largest gains usually come from two changes: store consent as a dated record rather than a flag, and enforce the consent check in code at the point of sending. Retention automation is next, since it reduces risk without changing customer experience. #### Common mistakes **Body:** Treating a purchase as consent to marketing messages, scattering opt-out lists across tools, and keeping message logs indefinitely because storage is cheap are the usual causes of weak scores. **Cta:** This is a self assessment, not legal advice. If you want to connect consent records in your ERP or CRM to your sending systems, Netray can help build that. **Faq:** #### Is this assessment legal advice? **Answer:** No. It is a self scored readiness check. Requirements depend on your country, the type of message and your data. Ask your legal or data protection adviser to confirm what applies to your business. #### Do I need consent for transactional messages? **Answer:** It depends on the law and the platform. WhatsApp business policy expects opt-in for messaging users, and data protection law may allow other legal bases for service messages. Keep records either way and confirm with your adviser. #### How long should I keep message logs? **Answer:** Keep them only as long as you have a reason, such as dispute handling or a legal retention duty, then delete or anonymise. Set a defined period, write it down and enforce it automatically. #### What counts as good consent evidence? **Answer:** A record per contact showing the date and time, the channel, how consent was obtained, the exact wording shown, and the purpose. A bare yes flag with no source is weak evidence. ## Search terms whatsapp consent management, messaging opt-out process, whatsapp data retention policy, dpdp whatsapp consent, gdpr messaging consent records, business messaging compliance assessment --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json