GDPR-compliant messenger for companies (2026): what the vendors actually document

"Which messenger is GDPR-compliant?" is a question no vendor can honestly answer with "we are". The GDPR puts the obligations on you, the controller: you need a data processing agreement (Art. 28), you need to know where the data sits and whether it crosses into a third country, you need to be able to delete and to answer access requests. A messenger can make those obligations fulfillable — or not. A badge on a homepage says nothing more than that.

So this guide does something different from the usual lists. It takes six checks a data protection officer asks anyway and applies them to twelve services: the consumer messengers that companies actually run on (WhatsApp, Signal, Telegram), the business messengers from Switzerland and Germany (Threema Work, Teamwire, Wire, Stackfield), the self-hosted platforms (Element, Mattermost, Rocket.Chat) and the two bundles (Microsoft Teams, Slack). Then InterMIND, which we build — on the same criteria and with the same sourcing rule. Every statement comes from the vendor's public documentation, checked August 2026, linked at the end.

A seventh check joins them, one that never appears on GDPR lists and matters every day in an international team: in which language does each member read the channel? A messenger that stores messages only in the original pushes translation onto the individual — and onto services that then process data again.

The six checks

Germany's Federal Commissioner for Data Protection (BfDI) publishes selection criteria for messenger services, the most usable public yardstick. They define end-to-end encryption as messages "encrypted on the sender's device and only decrypted again on the recipient's device", list privacy settings such as address-book access, profile visibility, read receipts, usage analytics and error reporting, and require account deletion where data is "deleted immediately". For company use, the Art. 28 obligations come on top. Together:

1. Data processing agreement (DPA). Does the vendor offer one — and is it in their documentation?
2. Entity and server location. Which company is your contracting party, where does the data sit, is there a third-country transfer?
3. Encryption. End-to-end, or transport and server-side? Both are legitimate — they just have to be named.
4. Metadata and address book. Is the address book uploaded? Which usage and device data is collected, and who is it shared with?
5. Deletion and retention. Where does the history live, who deletes it, what happens when an employee leaves?
6. Sub-processors. Are they published — including the services used for AI features and translation?

Plus the seventh: language per member.

The consumer messengers at work

WhatsApp (and the WhatsApp Business app)

• Contracting party: for the EEA, "WhatsApp Ireland Limited".
• Encryption and storage: messages are end-to-end encrypted; "we do not retain your messages in the ordinary course of providing our Services to you. Once your messages are delivered, they are deleted from our servers." The history therefore lives on employees' devices and in their backups.
• Metadata: collected are "information about your usage of our Services", device data ("hardware model, operating system information, battery level, signal strength") and, optionally, the address book ("contact upload … from your device address book on a regular basis"). Data is shared with "Meta Companies in the United States and Ireland" and transferred "globally".
• DPA: the app's privacy policy names no data processing agreement for companies (checked August 2026). The Business app "is built with the small business owner in mind".
• Language: since September 2025 a message can be translated by long-press — on the device ("translations occur on your device where WhatsApp cannot see them"); Android can auto-translate whole chats (six languages at launch), iPhone uses Apple's translation in 19+ languages. Voice notes and calls aren't part of the announcement.

Signal

• Contracting party: Signal Messenger LLC, Mountain View, California — a nonprofit.
• Encryption: "Signal cannot decrypt or otherwise access the content of your messages or calls."
• Metadata: registration by phone number; technical data is limited "to the minimum required to operate the Services".
• DPA: none documented in Signal's legal documents (checked August 2026).
• Language: no translation feature documented.

Telegram

• Contracting party and location: "Telegram Messenger Inc.", with "Telegram FZ-LLC, a group member located in Dubai"; for EU/EEA users, "your data is stored in data centers in the Netherlands". The GDPR representative is the European Data Protection Office (EDPO) in Brussels.
• Encryption: cloud chats are server-side encrypted — "all data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions" — and only secret chats are end-to-end: "Secret chats use end-to-end encryption."
• DPA: not documented in the privacy policy (checked August 2026).
• Language: "All users can translate individual messages"; Premium users "can translate entire chats, groups and channels in real time by tapping the Translate bar at the top".

All three are tools teams genuinely work in. What they share: the history belongs to the device or to the vendor's cloud, not to the company — and the DPA that Art. 28 requires appears in none of the three documentations.

Business messengers from Switzerland and Germany

Threema Work

• Location: Switzerland. The vendor notes that a data transfer from the EU to Switzerland is legally permissible without further review.
• Metadata: Threema Work "requires no personal data (such as a phone number or e-mail address)" and "can be used without access to the address book".
• DPA: according to the vendor, Threema Work "meets the requirements for data-protection-compliant processing on behalf of a controller under the GDPR and the Swiss DSG".
• Trial: "30 days, 30 users. No automatic renewal." Per-user prices aren't on the page.
• Language: no translation feature documented.

Teamwire

• Location: "German public cloud (IONOS, C5-certified)", "dedicated private cloud" or "full on-premise hosting"; "hosting in Germany instead of the USA", "no storage outside the EU".
• Certifications: "ISO 27001, BSI C5, TÜV certified"; EU GDPR, BDSG, BSI IT-Grundschutz, NIS-2, DORA and CER are named.
• Metadata: "no address book access" and "no analysis of communication".
• GDPR: the vendor describes itself as "100 % GDPR-compliant" — a self-description the DPA has to make good on case by case. No prices on the page.
• Language: no translation feature documented.

Wire

• Location: "cloud, on-premises or hybrid".
• Encryption: MLS protocol; "messages, files and calls are fully E2EE by default"; video calls "with up to 200 participants", every session end-to-end encrypted.
• Certifications: ISO 27001, ISO 27701, FedRAMP, FIPS 140-2.
• GDPR: "fully compliant with strict data protection regulations, including GDPR" (self-description). No per-user prices on the page.
• Language: no translation feature documented.

Stackfield

• Location: "all data processing is limited to the EU, and the data itself resides exclusively in German data centers"; the company is subject "exclusively to the jurisdiction of Germany and the EU".
• Encryption: "true end-to-end encryption" for messages, files and tasks.
• Certifications: ISO 27001, BSI C5.
• Meetings: audio and video conferencing included.
• Language: no translation feature documented.

The four answer the location and encryption questions as clearly as a vendor can. What none of them documents: a translation that lets a Polish, a Portuguese and a German colleague read the same channel in their own language.

Self-hosted platforms

Element (Matrix)

• Encryption: "the entire platform is end-to-end encrypted by default" — including Element Call for voice and video.
• Operation: Community free, self-hosted; Enterprise per seat per month, self-hosted; Sovereign per deployment, air-gapped.
• Language: no translation feature documented — with end-to-end encryption there is no server-side place for one.

Mattermost

• Operation: Professional and Enterprise as self-hosted annual licenses, prices on request; Mattermost Cloud Enterprise as a single-tenant offer.
• Language: automatic channel translation (beta, since v11.5) on Enterprise Advanced: back-end is "LibreTranslate: a self-hosted, open-source machine translation engine" or "Agents: uses the Mattermost Agents plugin with a configured LLM backend"; a user's target language "is determined by their Mattermost display language". Translation runs on your server.

Rocket.Chat

• Operation: the Starter plan is free, "self-managed, self-hosted", "for technical evaluation or small teams of up to 50 users"; paid plans are Commercial, Government and Defense — on-premises, private cloud or air-gapped, prices on request.
• Language: Auto-Translate per room — "each user receives translations based on their own selected language" — via DeepL, Google Translate, Microsoft Translator or LibreTranslate, with an API key the administrator supplies. Message text therefore goes to the provider you chose — unless it's LibreTranslate on your own host.

Nextcloud Talk belongs in the same group: "a fully self hosted, on-premises audio/video and chat communication service", with live transcription and translation on your own hardware (details in the team communication tools comparison).

The bundles: Microsoft Teams and Slack

Microsoft Teams

• DPA: "When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA)."
• Location: Teams data resides "in the geographic region associated with your Microsoft 365 or Office 365 organization"; country residency (Germany, France, Italy, Norway, Poland, Sweden, Switzerland and others) is "for new tenants only", existing EU tenants stay in the EMEA region. The EU Data Boundary commits Microsoft to store and process Customer Data for Microsoft 365 within the EU/EFTA — "subject to limited circumstances" with documented exceptions; customers with Multi-Geo are out of scope.
• Language: chat and channel messages translate on request or automatically ("Teams can automatically translate received messages"), 100+ languages, no license named; in meetings, translated captions need the organizer's Teams Premium or Copilot license, and the Interpreter agent (10 languages) needs a Copilot license per listener, 20 hours a month. Details: Teams live translation.

Slack

• DPA: "Slack offers a Data Processing Addendum that supplements the Customer Terms of Service" — executed via a form, not incorporated automatically.
• Location: data residency from Business+: Frankfurt, Paris, Stockholm, Zurich, London. Covered: messages, canvases, files and the search index; not covered: member profiles and usage analytics. The Free plan keeps 90 days of message history.
• Language: "Translate message" on Business+ and Enterprise+, on request per message; "translations are only visible to you, so other people will always see the original message."

InterMIND

We build a communication space in which every member reads meetings, chat, documents and their history in their own language — and hold it to the same seven checks:

1. DPA: signed per customer — Art. 28 processor terms with a 30-day notice of new sub-processors and a 72-hour breach window; a signed copy is available for procurement (/legal/dpa).
2. Entity and location: operated by an Estonian OÜ; the runtime is in the EU at every hop — voice and chat translation on our own engine on dedicated servers in France, meeting orchestration in Paris, database in Frankfurt, EU-resident storage and analytics. The map, vendor by vendor: where one InterMIND meeting actually runs.
3. Encryption: transport encryption — audio and video over DTLS/SRTP, chat and files over HTTPS/WSS and encrypted at rest on our servers. No end-to-end encryption: translation is processing, and it happens on our engine, not at a third party. If E2EE outranks everything else for you, Element, Wire or Threema are the better fit — we say so.
4. Metadata and address book: no address-book upload; participants join by link, without an account and without a phone number.
5. Deletion and retention: the retention criterion is written into the privacy policy — data stays until you or your team owner delete it; deleting an account deletes its data. We audited our own code against the GDPR obligations and documented what we closed: GDPR audit.
6. Sub-processors: published, with function and domicile per vendor. The language-model steps (recap, document summaries, writing assistant, Ask AI) run on the AI gateway the organization selects — Azure OpenAI in the EU Data Zone by default, Vertex AI EU or Amazon Bedrock Frankfurt by choice — in InterMIND's own tenant with zero data retention and no training on customer content; the vendors are US companies operating EU regions, stated on the trust page. Document translation runs through DeepL as a named EU sub-processor.
7. Language per member: chat and notes in 23 languages, documents in 30, live speech for every participant in their own language — as the room's default behavior, without add-ons or per-listener licenses. Quality is published monthly per language pair: /benchmark.

What we don't claim: an ISO certificate we don't yet hold. Our answer to the checklist is architectural and verifiable in the code; certifications are on the roadmap.

The overview

Which messenger for which case

• End-to-end encryption is your first criterion and translation doesn't matter: Threema Work (Switzerland, no phone number), Wire (MLS, calls included), Stackfield (German data centers) or Element (self-hosted, free in the Community edition).
• Everything must run on your own servers, and you have the staff: Rocket.Chat (free to 50 users, translation via your provider key), Mattermost Enterprise Advanced (beta channel translation on your LibreTranslate or LLM), Nextcloud Talk.
• You're a Microsoft or Slack customer anyway: both document a DPA and EU residency — Teams via tenant region and the EU Data Boundary, Slack from Business+. Translation is per reader, on request; the meeting language in Teams hangs on Copilot licenses.
• The team works in WhatsApp, Signal or Telegram: services documented for private communication, partly end-to-end encrypted — but with no documented DPA, the history on devices or in the vendor's cloud, and at WhatsApp usage and device data going to Meta companies in the US. A DPO will ask questions the documentation doesn't answer.
• The channel itself is multilingual — colleagues and customers replying to each other in three languages, guests without your licenses, and a compliance team that wants to name the location: that's what we build InterMIND for — EU at every hop, DPA per customer, published sub-processors, and every member reading the space in their own language.

See it instead of reading about it

• Try the live demo — no signup; speak, and hear the room translated per listener in any of 23 languages.
• See the benchmark — per-pair, monthly translation quality on real traffic, with the methodology public.
• Read the sub-processors — function and domicile per vendor, no request needed.

FAQ

Which messengers are GDPR-compliant?

None is by itself — the obligations sit with the company. What can be checked is whether the vendor makes them fulfillable: a DPA is documented by Microsoft Teams (via the Product Terms), Slack (via a form), Threema Work (vendor: GDPR/DSG-compliant processing) and InterMIND (per customer, Art. 28); Teamwire and Wire describe themselves as GDPR-compliant. For WhatsApp, Signal and Telegram the documentation names no DPA (checked August 2026). Self-hosted services — Element, Mattermost, Rocket.Chat, Nextcloud — move the question into your own operation.

Is Signal GDPR-compliant?

Signal documents end-to-end encryption ("Signal cannot decrypt or otherwise access the content of your messages or calls") and technical data limited to the minimum; the contracting party is Signal Messenger LLC in California, registration is by phone number. The legal documents name no data processing agreement for companies. Private use is a different picture from company use, which has to satisfy Art. 28.

Is WhatsApp GDPR-compliant for business use?

WhatsApp Ireland documents end-to-end encryption and that delivered messages are deleted from its servers — and, at the same time, usage and device data, optional address-book upload and sharing with "Meta Companies in the United States and Ireland". The privacy policy names no DPA for the app; the Business app is, per the vendor, built for small business owners. Whoever uses WhatsApp in a company has to justify these points to the DPO themselves.

Is Telegram GDPR-compliant?

Telegram states that EU data is stored in the Netherlands and names an EU representative (EDPO, Brussels); cloud chats are server-side encrypted with keys "in several other data centers in different jurisdictions", only secret chats end-to-end. No DPA is documented. That's a documented data situation, not GDPR compliance in the Art. 28 sense.

Is Microsoft Teams GDPR-compliant?

Microsoft documents the DPA as part of the Product Terms, storage of Teams data in the tenant's region — country residency only for new tenants — and the EU Data Boundary for Microsoft 365 customers based in the EU/EFTA, with documented exceptions. For companies already on Teams that's a solid basis; the translation features in meetings depend on Copilot licenses per organizer and listener.

What must a GDPR-compliant messenger for companies offer?

Six documented answers instead of a badge: a DPA under Art. 28, a named entity and server location with no unexplained third-country transfer, a named encryption model, control over address book and metadata, a deletion concept that covers an employee leaving, and a published sub-processor list — including the AI and translation services. For international teams a seventh point joins: a messenger that stores the channel only in the original pushes translation onto every individual.

Is there a free GDPR-compliant messenger for companies?

Free and self-hosted: Rocket.Chat Starter (up to 50 users) and Element Community — the GDPR obligations then sit entirely in your own operation. Threema Work offers 30 days for 30 users without payment details. With InterMIND, participation is free for every participant — join by link without an account — and the live demo needs no signup; the host pays for the room.

Sources: BfDI — Selection criteria for messenger services (German), WhatsApp — Privacy policy (EEA), WhatsApp — Privacy policy, WhatsApp blog — Introducing message translations, WhatsApp Business app, Signal — Terms & Privacy Policy, Telegram — Privacy Policy, Telegram blog — Real-time translation, Threema — GDPR-compliant messenger (German), Teamwire — GDPR-compliant messenger (German), Wire — Wire vs. MS Teams (German), Stackfield — Microsoft Teams alternative (German), Element — Pricing, Mattermost — Pricing, Mattermost — Set up Auto-translation (Beta), Rocket.Chat — Our plans, Rocket.Chat — Auto-Translate messages, Nextcloud Talk, Microsoft — Products and Services Data Protection Addendum, Microsoft Learn — Location of data in Microsoft Teams, Microsoft Learn — What is the EU Data Boundary?, Microsoft — Translate a message in Microsoft Teams, Microsoft — Interpreter in Teams meetings and calls, Slack — Data Processing Addendum, Slack — Data residency for Slack, Slack — Pricing, Slack — Guide to AI features in Slack. Vendors change plans, locations, features and self-descriptions over time; check their pages for the current state. All facts checked August 2026.