Nearly every agency we speak to messages its flex pool. Often from a private number, often in a group, and almost always without anything having been written down. Then the question comes up: are we actually allowed to do this?
The short answer: yes, you may message your workers. But a few things many agencies do are not right. Below is what is allowed, what is not, and what you need to arrange. This is not legal advice, and it describes the Dutch and European rules. Have your own approach checked by someone who knows your situation.
Asking for consent is usually the wrong route
The reflex is: I will just ask for consent. That feels tidy, but it is the weakest basis you can pick.
The GDPR gives six legal bases for using personal data, and consent is one of them. The condition is that the consent is freely given. Between an employer and a worker there is an authority relationship, and someone who gets their shifts from you does not say no easily. Regulators therefore assume consent in an employment relationship is rarely truly free. On top of that, if someone withdraws consent later, you have to stop sending.
In practice agencies rely on one of these two:
- Performance of the contract. You have to be able to reach someone about their shifts, schedule and working hours. That is part of the arrangement you have with each other.
- Legitimate interest. You have a legitimate interest in reaching your pool for open shifts. That comes with a balancing test between your interest and the recipient's privacy, and you write that down. One page is enough, as long as it exists.
What you have to do in both cases: tell people what you do with their number, and make it easy for them to say they no longer want to be contacted.
Meta's opt-in is not the same as consent
Almost everyone mixes these up. Meta requires you to have an opt-in before you send someone a template message. That is a rule from Meta, not from the GDPR. You need it to be allowed to send on the platform, separate from which legal basis you use under data protection law.
Practically: record when and how someone indicated they want to be reachable over WhatsApp, for example at registration. That serves two purposes at once. You meet Meta's rules, and you can show that you informed people.
People who do not work for you yet: be careful
This is where the real risk sits for staffing agencies. Messaging someone who registered with you is one thing. Messaging a purchased list, or numbers you got from another party, is something else entirely.
The Dutch spam rules in the Telecommunications Act cover unsolicited messages with a commercial purpose, and they do not care which channel you use. WhatsApp falls under them just as much as email or SMS. There is also no lower limit: a single personal message can already fall within the rules. So you do not message people who are not known to you and never asked for anything.
That is also exactly why this kind of traffic tends to end in a block. People who did not expect your message report it. See WhatsApp number blocked.
Can you require someone to use their own WhatsApp?
Asking is fine, requiring gets difficult. It is a private phone and a private account. If you want to make WhatsApp mandatory, something should be offered in return, such as a work phone.
Two things to arrange either way:
- An alternative for people who would rather not. Calling or email has to stay possible, without that person getting fewer shifts as a result.
- Clarity about timing. A shift offer at half past eleven at night for tomorrow morning is technically easy and legally awkward. Agree when you send and when you do not.
The group chat is your biggest risk
If there is one thing we run into at agencies that really does not work, it is the group chat with the whole pool in it.
- Everyone sees everyone else's number. Put 200 workers in one group and you have shared 200 phone numbers with 200 people. That is a disclosure of personal data nobody asked for, and you cannot undo it.
- People who left stay in it. Almost every crew group contains people who have not worked there for six months and are still reading along.
- You have no way to delete anything. The messages sit on private phones. If something goes wrong, you cannot pull it back.
- Nothing is recorded. Who sent what, when, and to whom is impossible to reconstruct afterwards.
Numbers that become broadly visible by accident can amount to a data breach, with the reporting duty that comes with it. One-to-one messages from a business number remove that problem entirely: nobody sees anyone else's number. See the alternative to your group chat.
What you need to arrange
Four things, and none of them is much work:
- Your legal basis, on paper. Pick performance of the contract or legitimate interest, write down why, and keep it.
- A processing agreement with your platform. If you send through a supplier, that party processes data for you, and an agreement belongs with that. Ours is at verwerkersovereenkomst, in Dutch.
- A retention period. There is no statutory retention duty for the phone number of someone who no longer works for you. Pick a period you can explain, and stick to it. Numbers you are not using anymore will also cost you money from October, see what a message costs.
- Informing people, and opting out. Explain at registration how you will contact them, and make it simple to say it is no longer wanted.
Where your data sits
One more point that comes up with larger clients: WhatsApp is owned by Meta, an American company. Transfers to the United States run under a decision of the European Commission that permits them. That decision has been challenged several times and has held so far, but proceedings are still running. For most agencies this is not a reason to do anything differently. It is a reason to know which data you actually send over the channel. Salary details, sick notes and copies of documents do not belong in a chat, whichever platform you use.
How we have arranged it
Boomer sends through the official WhatsApp Business Platform and works with individual messages instead of groups, so your workers never see each other's numbers. There is a processing agreement ready and our privacy statement sets out what we process and why, both in Dutch. You stay the owner of your data.
Want to know how this works out for your agency, including what you still have to record yourself? Book a demo and we will walk through it.
This article is practical guidance for staffing and flex agencies operating under Dutch and European rules, and is not legal advice. Last updated on 13 August 2026.