Compliance & ContractsFree assessmentPDF, Excel, Word export

Messaging Consent and Data Retention Readiness Assessment

Business messaging over WhatsApp, SMS or Teams collects phone numbers and message content, which brings consent and retention duties under laws such as the EU GDPR and India's DPDP Act, plus platform policies. This assessment scores how ready your handling is.

0 of 10 answered0%

1. How do you record consent to receive business messages?

Think about whether you could show proof for one specific customer today.

2. Is consent specific to each channel and purpose?

3. How are opt-out requests handled?

4. Do sending systems check consent status before every send?

5. Do you have a defined retention period for message content and logs?

6. Can you find and export all messages for one individual on request?

7. Where is message content stored and who can read it?

8. Do you limit personal data inside message variables?

For example avoiding account balances or health details in template text.

9. Are messaging vendors covered by data processing agreements?

10. How often is the programme reviewed against block rates and complaints?

How to use the assessment

Answer each question for the messaging you run today, not what is planned. Choose the option you could demonstrate with a record or a screenshot, because an auditor or a complaint will ask for evidence. The score is converted to a percentage and mapped to one of four bands with specific next steps.

Involve whoever owns the CRM and the sending systems.
Answer for the weakest channel if channels differ.
Repeat after changes to see the score move.

What the questions test

Consent questions test whether you can prove who agreed to what, when and through which channel. Opt-out and enforcement questions test whether that choice actually changes behaviour in every system that sends. Retention and access questions test whether you can limit how long you hold content and retrieve it for an individual. Vendor and review questions test governance around the platforms involved.

Reading the result

A low score does not mean you are breaking the law, but it means you may be unable to show you are not. The largest gains usually come from two changes: store consent as a dated record rather than a flag, and enforce the consent check in code at the point of sending. Retention automation is next, since it reduces risk without changing customer experience.

Common mistakes

Treating a purchase as consent to marketing messages, scattering opt-out lists across tools, and keeping message logs indefinitely because storage is cheap are the usual causes of weak scores.

Frequently Asked Questions

Is this assessment legal advice?

No. It is a self scored readiness check. Requirements depend on your country, the type of message and your data. Ask your legal or data protection adviser to confirm what applies to your business.

Do I need consent for transactional messages?

It depends on the law and the platform. WhatsApp business policy expects opt-in for messaging users, and data protection law may allow other legal bases for service messages. Keep records either way and confirm with your adviser.

How long should I keep message logs?

Keep them only as long as you have a reason, such as dispute handling or a legal retention duty, then delete or anonymise. Set a defined period, write it down and enforce it automatically.

What counts as good consent evidence?

A record per contact showing the date and time, the channel, how consent was obtained, the exact wording shown, and the purpose. A bare yes flag with no source is weak evidence.

This is a self assessment, not legal advice. If you want to connect consent records in your ERP or CRM to your sending systems, Netray can help build that.

Talk to an Expert Explore More Free Tools

Related Tools

Developer Tools

More Compliance & Contracts tools

See all

Back to All Tools