Why ISO 27001 lands on every APAC customer messaging conversation in 2026
Which Annex A controls actually touch your WhatsApp and WeChat inbox?
How should you classify the data flowing through customer messaging?
What does identity and access management look like for a 200-agent inbox?
Where does end-to-end encryption stop, and what does A.8.24 actually require?
What audit trails and retention windows does ISO 27001 expect for customer chats?
How do you handle vendor risk for Meta, your BSP, and the cloud underneath?
Walk into the compliance office of a Hong Kong money lender licensed under the Money Lenders Ordinance (Cap. 163), the second-line risk team at a HKMA-licensed bank, or the data protection officer at a private hospital regulated under the Personal Data (Privacy) Ordinance (Cap. 486), and one item now sits at the top of every 2026 audit plan: customer messaging.
Most APAC enterprises route customer conversations through WhatsApp Business Platform (WABA), WeChat Work, Facebook Messenger, Instagram DMs, and SMS — often unified inside a single omnichannel inbox. Each channel carries personal data, financial instructions, KYC images, and medical history. Each falls inside the scope of ISO/IEC 27001:2022 the moment a control owner ticks the "customer-facing systems" box on the Statement of Applicability.
This guide maps the 93 Annex A controls of the 2022 revision against the realities of an APAC messaging stack and ends with a 25-point readiness checklist. Use it before your next surveillance audit, your next HKMA review, or your next BSP procurement cycle.
In this article:
The 2022 revision of the standard reorganised the older 114 controls of ISO/IEC 27001:2013 into 93 controls grouped into four themes: Organizational (A.5, 37 controls), People (A.6, 8 controls), Physical (A.7, 14 controls), and Technological (A.8, 34 controls). The official ISO catalogue publishes the full text; the table below picks out the controls that map directly to a customer messaging platform.
| Control | Title | What it means for your inbox |
|---|---|---|
| A.5.19–A.5.23 | Information security in supplier relationships | Meta, your BSP, and any cloud subprocessor must be assessed, contracted, and monitored. |
| A.5.24–A.5.28 | Information security incident management | A documented playbook for a leaked chat thread, a hijacked agent account, or a BSP outage. |
| A.5.33 | Protection of records | Conversation transcripts that contain financial instructions are records and must be retained accordingly. |
| A.5.34 | Privacy and protection of PII | Direct alignment with PDPO Cap. 486 in HK, PDPA in Singapore, UU PDP in Indonesia. |
| A.8.2 / A.8.3 | Privileged and information access restriction | Role-based access to inbox queues, conversation history, and admin functions. |
| A.8.5 | Secure authentication | SSO and multi-factor authentication on every agent and admin login. |
| A.8.11 | Data masking | HKID and account numbers redacted in shared screens and outbound reports. |
| A.8.12 | Data leakage prevention | Outbound attachment scanning and template content controls. |
| A.8.15 / A.8.16 | Logging and monitoring | Every read, write, export, and configuration change captured and reviewed. |
| A.8.24 | Use of cryptography | Documented key management for data in transit, at rest, and on backup. |
The control mapping is what an external auditor will compare against your Statement of Applicability. If a control is marked "applicable" but the inbox cannot demonstrate it, you have a finding.
A typical WhatsApp thread at a money lender starts with a public ad-response ("interested in your personal loan offer"), turns confidential at the KYC photo upload (HKID, proof of address), then crosses into restricted when the borrower confirms a loan amount. The same evolution happens in a private hospital's appointment-booking flow and in a brokerage's KYC-refresh thread.
A four-tier classification scheme that maps cleanly to APAC regulators looks like this:
| Class | Example messaging payload | Storage rule |
|---|---|---|
| Public | Marketing reply, store locator, opening hours | Standard retention; no special control |
| Internal | Lead name, mobile, generic appointment time | Access logged; retention per business policy |
| Confidential (PII) | HKID, NRIC, NIK, passport, account number, KYC photo | Encrypted at rest; access restricted to assigned agent and supervisor; masked in screen-share |
| Restricted (financial/medical) | Loan amount, balance, lab result, diagnosis | Same as Confidential plus DLP scan on outbound; retention aligned to HKMA SPM, MAS TRM, or hospital records ordinance |
The platform layer needs to enforce the scheme automatically. Asking 200 agents to tag every message is a control that fails its own audit. A modern omnichannel messaging platform applies labels through templates, conversation tags, and pattern detection rules so that classification happens at message creation time, not at year-end.
The control objective in ISO/IEC 27001 is "least privilege, fully accountable." In a messaging context, that translates into five working requirements:
For HKMA-supervised institutions, these requirements line up directly with HKMA SPM IC-1 (Information Security), paragraphs on access management and privileged access. For Singapore banks and insurers, the same set is mirrored in the MAS Technology Risk Management Guidelines, sections 8 and 9.
The WhatsApp Cloud API documentation is explicit: messages routed through a Business Solution Provider (BSP) or through Meta's Cloud API leave the encrypted client-to-server path on arrival at Meta's servers. The BSP then receives plaintext over a TLS channel and stores conversation history server-side so that agents can view it, route it, and report on it.
That has three implications for ISO/IEC 27001 Annex A.8.24 (Use of cryptography):
The Annex A.8.24 control does not demand end-to-end encryption — it demands a documented, defensible cryptographic posture. A platform that publishes its TLS configuration, its at-rest cipher, and its key-rotation schedule meets the bar. WeChat Work behaves similarly: messages are server-stored, so the same posture applies, with the additional consideration that Tencent's data residency profile differs from Meta's.
Three log layers should be available for every customer messaging deployment:
Retention is where regulators diverge. The headline numbers used by APAC compliance teams in 2026:
| Regulator / standard | Typical retention for customer interaction records |
|---|---|
| HKMA (SPM IC-1, IC-5) | 7 years for customer instructions and complaints; risk-based for general correspondence |
| SFC (Securities and Futures Ordinance Cap. 571) | 7 years for licensed-corporation records |
| PCPD (PDPO Cap. 486) | "No longer than necessary" — purpose-bound, not a fixed window |
| MAS (TRM Guidelines, Notice on Cyber Hygiene) | Risk-based; financial transaction records typically 5–7 years |
| PDPC Singapore (PDPA) | Cease retention once the purpose is fulfilled and no legal need remains |
The practical pattern that survives both ISO and regulator audit: keep conversation logs for the longest period any applicable regulator requires, segregate them in immutable storage (write-once, append-only), and apply purpose-bound deletion to the working copy.
The suppliers in a typical APAC enterprise messaging stack:
The audit pack each of these suppliers should be able to provide:
imBee's own certification under ISO/IEC 27001:2022 covers the platform layer. The Meta WhatsApp Business Platform stack is governed by Meta's parent compliance program. Your BSP DPA should make the chain explicit, naming every hop.
The 2026 baseline for an APAC enterprise running customer messaging:
The single most useful artefact a messaging platform can provide here is an export of the affected message scope by customer, time window, and channel. That export is the input to the regulator filing and to customer notifications. Without it, your incident response process clocks out at "we cannot quantify exposure," which is the worst possible posture in any APAC notification regime.
Governance and scope
Access and identity
Cryptography and data handling
Logging, monitoring, retention
Vendor risk and incident response
What is ISO/IEC 27001 in the context of customer messaging?
ISO/IEC 27001 is the international standard for information security management systems. For customer messaging, it certifies that an organisation has identified the risks of running WhatsApp, WeChat, and other channels, has selected and implemented controls from Annex A, and has documented the result in a Statement of Applicability that an external auditor can verify each year.
Does ISO 27001 require end-to-end encryption on WhatsApp?
No. Annex A.8.24 requires a documented, defensible cryptographic posture, not a specific architecture. WhatsApp Cloud API and BSP-hosted platforms decrypt server-side; this is acceptable when transit encryption, at-rest encryption, and key management are documented and applied consistently.
What is the difference between WhatsApp Business API, WABA, and WhatsApp Cloud API?
"WABA" is the WhatsApp Business Account, a tenant entity issued by Meta. "WhatsApp Business API" and "WhatsApp Cloud API" are two delivery models for sending and receiving messages against that WABA. Cloud API is Meta-hosted; the older "On-Premises API" is being deprecated. ISO 27001 scope is identical in either model, but the supplier list differs.
How does ISO 27001 relate to HKMA SPM and MAS TRM?
Both regulators accept ISO/IEC 27001 as foundational and add their own sector-specific requirements on top. HKMA SPM IC-1 maps cleanly to the access, logging, and cryptography controls; MAS TRM goes further on incident reporting timing. Mapping the SoA to both at design time prevents duplicate evidence packs.
Is a BSP's ISO 27001 certificate enough for my own audit?
No. Your BSP's certification covers the BSP's platform. Your own ISMS still needs to scope the data flowing through that platform, the suppliers behind it, and the controls you operate on your side (RBAC, agent training, retention policy).
What retention period applies to WhatsApp chats in Hong Kong?
It depends on the regulator. HKMA-supervised institutions typically retain customer instructions for 7 years. SFC licensed corporations follow the 7-year record-keeping rule under the Securities and Futures Ordinance (Cap. 571). The PDPO (Cap. 486) requires purpose-bound retention rather than a fixed window. Apply the longest applicable.
Do generative AI features in the inbox change the ISO 27001 scope?
Yes. Any LLM that receives message payloads becomes a sub-processor under A.5.19–A.5.23. The sub-processor list, DPA, and data-residency posture must be updated, and the human-review and prompt-injection controls should be added to the messaging risk assessment.
What are the most important ISO 27001 controls for a Hong Kong money lender on WhatsApp?
Supplier relationships (A.5.19–A.5.23), privacy (A.5.34), secure authentication (A.8.5), access restriction (A.8.3), logging (A.8.15), and cryptography (A.8.24) are the controls that almost always carry findings in a first audit. Tighten them before pursuing breadth across the full 93.
Ready to map your messaging stack against the 25-point checklist? Book a demo with imBee and walk through it with one of our solutions engineers, or try imBee for free and start the scoping from inside the product.
Last updated 28 May 2026.
