Asked for the WhatsApp messages: how UK public bodies answered

What was asked: the messages, far more than the policy

WhatsApp messages about a public authority's business can be requested under the Freedom of Information Act 2000: section 1 gives anyone the right to recorded information an authority holds, section 84 defines information as information recorded in any form, and section 3(2) counts information held by another person on the authority's behalf as held by the authority. The ICO's guidance on official information held in non-corporate communications channels expects such messages to be found when a request arrives, even on a personal phone. Scottish public authorities answer under the Freedom of Information (Scotland) Act 2002 instead.

By far the commonest ask was for the messages themselves, usually those exchanged about a particular decision, project or event. Of the 2,118 usable replies we read, 1,198 (57%) answered a request for WhatsApp messages. Counting a request sent to many bodies once, that is 660 of the 814 distinct requests (81%).

The other asks came mostly as round-robins, one request sent to many bodies at once, and they asked about rules and numbers rather than messages:

• Discipline. A 2018 request to 225 NHS bodies asked about disciplinary proceedings over staff use of social media or instant messaging apps, and requests to 48 and 47 police forces in 2021 to 2023 asked the same about officers.
• Devices and apps. A 2022 request about IT devices and systems went to 197 NHS bodies and asked, among much else, about WhatsApp for internal communication; a 2020 request to 57 NHS bodies asked whether they used or allowed instant messaging apps for patient-identifiable information.
• Policy. A 2024 request asked 37 public bodies, from government departments and regulators to combined authorities, about their use of WhatsApp, and a 2022 request asked 9 government departments for their policies or guidance on instant messaging by officials.
• Keeping the record. A 2023 request asked 5 councils how messages between social workers and children on WhatsApp or by text are kept.

A round-robin produces one reply per body, so one request to 225 bodies outweighs dozens of single requests in any count of replies. That is why this page gives distinct requests beside replies wherever the two differ.

How public bodies answered requests for the messages

Of the 1,198 replies to requests for WhatsApp messages, 481 (40%) produced no messages: 325 (27%) said the information was not held and 156 (13%) refused because finding it would exceed the cost limit. 140 replies (12%), fewer than one in eight, disclosed what was asked in full. The full count, by reply (percentages rounded):

• Not held: 325 (27%)
• Disclosed in part: 311 (26%)
• Refused on the cost limit: 156 (13%)
• Disclosed in full: 140 (12%)
• No substantive reply: 114 (10%)
• Refused under another exemption: 51 (4%)
• Asked the requester to clarify: 34 (3%)
• Withdrawn by the requester: 21 (2%)
• Refused as vexatious: 18 (2%)
• Neither confirmed nor denied holding it: 17 (1%)
• Unclear: 11 (1%)

Counted as distinct requests, those 1,198 replies answer 660 requests. Each reply is still one body's answer to its own search, so the outcomes are counted per reply, and a large round-robin weighs heavily in them.

Questions about WhatsApp that did not ask for the messages fared very differently. Of the 920 usable replies to other questions about WhatsApp, such as policies, devices, apps or disciplinary numbers, 80 said not held and 30 refused on cost, 110 in all (12%), and 400 (43%) disclosed in full. A question about the rules usually got an answer; a request for the conversation often did not.

A not-held answer covers several different situations, from a body that never used WhatsApp for the matter to messages on phones the body does not control. The next section sets out the reasons bodies gave.

Why so many requests produced no messages

The replies give four reasons, often in combination. In their words:

Each reason is the body's own account of its search. The replies do not show whether messages existed that a search did not find, and we have not tried to test it.

What public bodies say about WhatsApp for work

169 of the 2,118 usable replies stated a position on WhatsApp for work. Counted by reply:

• Not approved or not supported: 53 (31%)
• Permitted with conditions: 53 (31%)
• Prohibited: 31 (18%)
• Permitted: 21 (12%)
• No policy: 10 (6%)
• Under review: 1

So 84 of the 169 (50%) do not allow WhatsApp for work, 74 (44%) allow it, most of them only with conditions, and 10 have no policy on it. These are the bodies that were asked and answered, not every public body: 59 of the 152 positions we can quote come from two round-robins, the 2020 request to 57 NHS bodies and the 2024 request to 37 public bodies. In their words, by type of body:

What the replies say good practice looks like

In our reading of the 2,118 usable replies, the needs the bodies themselves point at are, counted by reply: being able to search for and produce messages (256), an approved channel (96), a record of the search made (53), a rule on devices (52) and copying messages to the official record (51), followed by retention schedules (20), handing over when someone leaves (17), an audit trail (16) and a register of groups and their owners (15). The bodies that describe good practice describe the same few things.

None of these depends on the app. Each depends on the organisation deciding where work conversations happen and making sure that what matters ends up somewhere it can find.

When the conversation was never on the record

Read together, the replies describe one gap. Bodies with clear rules still had to search phones they do not control, ask staff for summaries, or copy messages across by hand. The request arrived, and the conversation was somewhere the organisation could not reach.

That gap is not peculiar to councils and government departments. A school or academy trust answers requests under the same Act. A charity, private nursery or independent care provider is usually not a public authority under it, but a subject access request, a complaint or an inspection can still ask for the same messages, as our guide to subject access requests and WhatsApp messages sets out.

ComplyChat is designed to close the gap before a request rather than after it. Staff, volunteers, governors and families talk in channels the organisation controls. A mobile number verified by SMS is an identity, so people outside your systems, such as bank staff, volunteers and parents, join without an account on them. Everyone added is told the channel is on the record and can object or leave at any time, and messages are recorded on the server as they are sent, not gathered from handsets afterwards. On paid plans, once your tenant is connected, conversations meet your retention schedules within your own Microsoft 365 subscription, so a search for them is a search of your own records.

It is not the answer to everything on this page. ComplyChat has no connection to WhatsApp and cannot retrieve a conversation that has already happened there, and it is not an FOI case management system: the log, the search, the redaction and the decision to disclose stay with you.

A question for the next leadership or board meeting: if a request arrived tomorrow for what we said about our last difficult decision, where would we search, and how long would it take?

Questions people ask

Can you make an FOI request for WhatsApp messages?

Yes, to a public authority, for messages about its business: the Freedom of Information Act 2000 covers information recorded in any form that the authority holds, including information held on its behalf by someone else. You cannot make an FOI request to WhatsApp itself, which is a private company. In the replies we read, 1,198 answered requests for WhatsApp messages and 140 (12%) disclosed them in full.

How do you make an FOI request?

Under section 8 of the Act, a request must be in writing, give the requester's name and an address for correspondence, and describe the information wanted; an email counts. It goes to the public authority that holds the information, which must normally reply within 20 working days under section 10; schools and academies work to a school-day rule, set out in our guide to freedom of information in schools. Every request on this page was made through WhatDoTheyKnow, which sends requests by email and publishes them with the replies.

Can you make a freedom of information request to a private company?

No. Under section 3(1) the Act applies to the public authorities listed in Schedule 1, bodies designated by order and publicly owned companies, so a private company is not covered unless it is designated, and most charities and independent care providers are not covered either. That is why the replies on this page come from councils, NHS bodies, government departments, police forces, regulators, schools and academy trusts, and say nothing about care providers or charities.

Where can you see other people's FOI requests?

WhatDoTheyKnow, mySociety's freedom of information site, publishes the requests made through it with the authorities' replies. Every quote on this page links to its request there.

How we read the replies, and the official guidance

We captured 4,387 requests about WhatsApp from WhatDoTheyKnow, with replies dated from 2015 to October 2026. Of those, 2,675 were classified for what was asked, how the body answered, any position it stated and the reasons it gave, and every classification was checked by an independent verifier; none was rejected. 2,118 were usable, meaning substantively about WhatsApp or similar messaging at work: 814 distinct requests, answered by 786 bodies. The classification and verification were completed on 29 October 2026.

Every outcome on this page is our reading of the reply, not the status shown on WhatDoTheyKnow, which the requester sets. The two disagree in 14% of the records, for example a request marked long overdue that the body had answered, or marked refused when the body said the information was not held.

The limits:

• Public bodies under FOI only. Usable records by sector: health 789, local government 447, central government 404, policing 234, other public bodies 152, care 57, schools 33, charities 2. Care providers and charities are not FOI bodies, so nothing here speaks for them; the 57 care records are public bodies’ replies (at least 47 of them from councils), not care providers’ own, and the 2 charity records are public bodies’ replies too.
• Schools. 33 school records are too few for any finding about schools.
• Round-robins inflate replies. One request sent to many bodies produces one reply per body, so we give distinct requests beside replies, and a large round-robin weighs heavily in any count of replies.
• Stated reasons are the bodies' own. We counted what each reply said; we did not test it.

Every quote is the authority's own words as captured, with the month and year of the reply and a link to the request. No requester or officer is named. Our thanks to WhatDoTheyKnow, a mySociety service, without which none of these replies would be public in one place.

The law is in the Freedom of Information Act 2000 and, in Scotland, the Freedom of Information (Scotland) Act 2002. The ICO's guidance on official information held in non-corporate communications channels sets out what a public authority should do about WhatsApp before and after a request, and the Cabinet Office's guidance on using non-corporate communication channels for government business is the clearest published model for a workplace rule. This page reports what public bodies said and is not legal advice.