Council WhatsApp policy: what it should say

The law a council WhatsApp policy sits under

Council WhatsApp messages about council business come under the Freedom of Information Act 2000 because section 3(2) of the Act says information is held by a public authority if “(a) it is held by the authority, otherwise than on behalf of another person, or (b) it is held by another person on behalf of the authority.” A message on an officer's own phone can therefore be held on the council's behalf. Part II of Schedule 1 names the councils: “in England, a county council, a London borough council, a district council or a parish council” and “in Wales, a county council, a county borough council or a community council”, with district councils in Northern Ireland at paragraph 36.

The Information Commission, which replaced the Information Commissioner on 30 September 2026 and is still known as the ICO, applies this to messaging apps in its guidance on official information held in non-corporate communications channels. It lists “private messaging accounts eg WhatsApp, Signal or Telegram” among the places official information can be, and says that information in them “may be subject to FOIA if it relates to the public authority's official business”, while information that “does not relate to the business of the public authority would not be subject to FOIA.” For local government it adds: “there is a need to have a clear demarcation between Council business and work for individuals as their local representative.”

Four more sources shape the policy:

• The records management code. The Code of Practice on the management of records issued under section 46 of the Act, laid before Parliament on 15 July 2021, applies to “a local authority or a school” as to any other public authority. It expects “written rules on what to keep and when to destroy information”, and says “there is no need to keep ephemeral material”, for example by “deleting trivial emails and messages after they have been read”. So a policy does not have to keep every “running late”.
• Section 224. Under section 224 of the Local Government Act 1972, “a principal council shall make proper arrangements with respect to any documents which belong to or are in the custody of the council or any of their officers.” It covers county, district, London borough and Welsh county and county borough councils, and combined and joint authorities, in England and Wales; it does not cover parish or community councils.
• Data protection law. Article 5(1)(f) of the UK GDPR requires personal data to be kept secure “using appropriate technical or organisational measures”, and Article 32 asks for a level of security “appropriate to the risk”. That is where a policy's rules on devices, group membership and what may be shared come from.
• Scotland. Scottish councils answer under the Freedom of Information (Scotland) Act 2002, whose section 65 makes altering or concealing a record to prevent disclosure an offence. The section 46 Code does not apply there; instead section 1 of the Public Records (Scotland) Act 2011 requires every council to prepare a records management plan “setting out proper arrangements for the management of the authority's public records” and agree it with the Keeper.

The Cabinet Office's guidance on using non-corporate communication channels (30 March 2023) is often quoted, but it says that it “applies to central government and arm's length bodies”, so it does not bind a council, though some councils borrow from it: Bromsgrove District Council's draft WhatsApp policy, below, lists it among its sources. No statute bans WhatsApp in a council. What the law asks is that the council can find, keep and produce the messages that are its business, and the ICO's guidance says how.

What councils' WhatsApp policies say in practice

Council WhatsApp policies differ more than summaries of them suggest. Councils' and combined authorities' replies to freedom of information requests, published on WhatDoTheyKnow, show four broad patterns. Each is one council's reply on the date given, not a survey of councils:

• Permitted with conditions. West Yorkshire Combined Authority, one of 37 bodies sent the same request, said in March 2024 that WhatsApp should be used only where other methods of communication are not available and it is critical to service delivery (West Yorkshire Combined Authority's reply). Rochdale Metropolitan Borough Council said in February 2025 that it allows WhatsApp on council-owned mobile devices on request (Rochdale Metropolitan Borough Council's reply).
• Notifications only. Leeds City Council said in September 2024 that in an emergency response WhatsApp and other applications are used solely as notification tools, with a Teams channel for coordination and operational decisions (Leeds City Council's reply).
• Not used for council business. Perth and Kinross Council said in October 2024 that its guidance for school staff says messaging apps, WhatsApp and texts included, should not be used to discuss council business in any circumstances (Perth and Kinross Council's reply).
• No specific policy. Rochford District Council said in February 2026 that its guidance is not specific to instant messaging and is covered by its acceptable use policy (Rochford District Council's reply).

Published policies show the same range. Bromsgrove District Council's draft WhatsApp policy, shared with Redditch Borough Council and published as a committee paper, says WhatsApp “should be considered a last resort for work purposes” and reminds staff that it “is a social media application, and is therefore also covered by our Social Media Policy.” Carmarthenshire County Council's WhatsApp guidance for staff says “Do not send Personal Identifiable Information”, warns that “conversations may be subject to FOIA requests” and asks group owners to “Review membership of groups regularly”.

So a summary that presents a ban on personal data in WhatsApp as the universal council rule overstates it: some councils keep the app away from council business altogether, while others allow approved use with service users on council phones (section 05). What most of them share is the ICO's starting point – corporate channels first, and a route for anything official to reach the council's systems.

The clauses a council WhatsApp policy should contain

The ICO's guidance says a records management policy should explain that, “as far as reasonably practicable, you should always ensure that you use corporate channels for official business.” Where officers do use WhatsApp or another app, we recommend these clauses. The ICO's words are quoted where its guidance asks for a clause; the rest draw on councils' own policies and replies:

1. Scope. Who the policy covers (officers, agency and contract staff, and councillors when they act on council business), which devices and numbers it covers (council-supplied phones, and personal phones and phone numbers), and how it fits the acceptable use, social media, information security and records management policies.
2. When the app may be used, and who approves it. Corporate channels first; the app only for named purposes, such as reaching someone no corporate channel reaches or coordinating an urgent operational response, with approval recorded.
3. What never goes in a group. Personal information about residents, service users or staff beyond what an approved purpose needs, confidential council information, and anything abusive or discriminatory, which falls under the employee code of conduct whatever the platform.
4. Lost phones and messages sent to the wrong place. How staff report a lost or stolen device, or personal information sent to the wrong person or group, to information governance, so a possible personal data breach can be assessed straight away.
5. The transfer rule. The ICO says transfers of information from the app to official systems “should certainly take place when key decisions are taken, or when an individual moves roles”. For the conversation that drifts into business, it says: “At the point that the discussion becomes about official business, you should use official communication channels. Or at the very minimum, you should forward the official part of conversation to an official system.”
6. Where transfers go. The ICO says: “You should place transferred or exported information on an official system with an appropriate retention period, for example, not onto a corporate chat function where the information will be deleted after a short time period.”
7. Disappearing messages. “If staff use instant messaging services, then auto-delete options should be in line with the retention policies of your official systems.”
8. A register of work groups. Each group's name, purpose, owners, members and the dates it opened and closed. Fermanagh and Omagh District Council said in April 2023 that groups should have at least two group admins, only the people who need to be members, and a member removed by the admin once they no longer need to be (Fermanagh and Omagh District Council's reply). The register is what tells the council where to search when a request arrives.
9. Leavers and movers. The ICO says: “You should have a process in place to ensure that when an individual leaves your organisation, any official information they hold on non-corporate channels is transferred to an official system.” The ICO warns that when someone leaves or moves roles, access to official information held in these channels “can be lost”, so put the transfer on the leaver's checklist beside returning the laptop, and hand group ownership to a named successor.
10. Searching for a request. Staff who search their own accounts or devices should “create a record of the action they take, including the locations they search.” Our guide to FOI requests and WhatsApp messages sets out the search itself.
11. The section 77 reminder. Under section 77 of the Act, once a request has been made, it is a criminal offence for the council or anyone “employed by, is an officer of, or is subject to the direction of” it to alter, erase, destroy or conceal a record with the intention of preventing disclosure. The ICO adds that knowingly treating information a request covers as not held because it is in a non-corporate channel “may count as concealment intended to prevent the disclosure of information”.
12. Training and review. Make staff and councillors aware of what the policy says, and review it regularly. The ICO notes that “If staff repeatedly use non-corporate communication channels, this may signal that you need to review the capability, usability and limitations of your current corporate channels.”

Councillors' WhatsApp groups, ward work and council decisions

Councillors' WhatsApp messages are not all council business. The ICO's guidance draws the line between “Council business and work for individuals as their local representative”, and its guidance on information held for the purposes of FOIA draws it the same way: a councillor corresponding with residents of their ward, or campaigning for their party, does not hold that information for the council, while a councillor holding information as a cabinet member or in carrying out the council's functions can hold it on the council's behalf.

Several councils have told requesters that councillors' messages sit with the councillors. Milton Keynes Council said in May 2021 that for discussions between councillors the information is held by the councillors themselves, who are their own data controllers, so a request would have to go to each councillor (Milton Keynes Council's reply). Bromley Borough Council, one of five bodies sent the same request, said in September 2023 that individual councillors are data controllers independent of the council and that it does not provide personal messaging accounts such as WhatsApp (Bromley Borough Council's reply). Bristol City Council said in December 2023 that councillors are elected representatives of a ward, not council employees (Bristol City Council's reply), and Rochdale said in February 2025 that its ICT team cannot audit WhatsApp use by council officers or councillors (Rochdale Metropolitan Borough Council's reply).

Those are the councils' answers to particular requests, not a rule that every councillor's message is outside FOI; whether a message is held on the council's behalf turns on whether it is about the council's business. A council policy can make that line easier to hold:

• Give council business a council channel. Council email and any council-provided messaging account are where elected members do council business; a group set up by officers for members, such as a cabinet or committee group, is likely to be council business and should follow the transfer rule.
• Keep ward and party groups separate from groups that discuss the council's business, so a later request is answered from the right place.
• Say what a group chat cannot do. Under paragraph 39(1) of Schedule 12 to the Local Government Act 1972, subject to any enactment, questions before a local authority are decided by a majority of the members “present and voting thereon at a meeting of the authority.” Other legislation lets some decisions be taken by an executive member or an officer under delegated powers, but a group chat is neither a meeting nor a delegation. It can arrange a meeting; it cannot replace one.

Parish and town councils are public authorities under the Act too, although section 224 does not reach them. New Waltham Parish Council's Respectful Use Policy WhatsApp & Social Media, prepared for adoption in May 2025, lists “Communication regarding council events and meeting arrangements” as a permitted use of its councillors' group and reminds members “that the platform is an extension of their official duties.” For a small council that shape works well: logistics in the group, decisions at the meeting, and anything that needs keeping sent to the clerk.

Residents, service users and children's services

Some councils allow officers to use WhatsApp with residents and service users, under conditions. Bristol City Council said in March 2023 that its instant messaging policy allows WhatsApp with service users only on a council-supplied device where permission has been granted, never on an officer's own phone, and that using such apps with service users without a data protection impact assessment and a recommendation from information governance could breach the employee code of conduct (Bristol City Council's reply). Councils also take WhatsApp messages from residents through their contact centres: Liverpool City Council, one of 66 bodies sent the same request, listed WhatsApp among its contact centre's channels in July 2024 (Liverpool City Council's reply). A policy that allows the app with residents should name the approved purposes, the devices, who signs off the impact assessment, and where the conversation is filed.

Children's services need one rule more. For a looked-after child in England, regulation 49 of the Care Planning, Placement and Case Review (England) Regulations 2010 requires the council to keep a written case record including “any other document created or considered as part of any assessment of C's needs, or of any review of C's case”, and regulation 50 requires it to be kept “until the seventy-fifth anniversary of C's birth”, or for 15 years after the child's death if the child dies before 18. The regulations do not mention messages, but a message that forms part of an assessment or review belongs on the record, not only in the app. Welsh councils work to their own regulations, which this guide does not cover.

Councils' replies describe that practice. In a 2023 FOI request sent to five councils about retaining WhatsApp messages, texts and emails, with replies in March and April 2023, 4 of the 5 said social workers' or case workers' WhatsApp or text messages are copied or saved to the case record (two of them naming the child's or children's social care record), and 3 of the 5 said they had no specific policy on retaining WhatsApp or text messages. Hull City Council said its social workers are expected to copy WhatsApp messages to the social care case management system and then delete them (Hull City Council's reply).

Two further points belong in the children's services part of the policy. WhatsApp's UK terms of service (effective 17 August 2026) say: “You must be at least 13 years old to use our Services or such greater age required in your country or territory.” Younger children cannot use the app under its own terms, so the policy needs another route for them. And the record rule runs both ways: copying a message into the case record does not make the copy in the app disappear, so the policy should say when the app copy is deleted, as Hull City Council's reply did for its social workers. Our guide to secure messaging for social workers covers the professional standards.

The step every council WhatsApp policy depends on

Read the clauses above again and most come down to the same instruction: copy it to the council's systems. Bristol's policy says exactly that, adding that the chat is then deleted, and four of the five councils in the 2023 request about retaining messages describe copying staff's messages to the case record. The step relies on each officer remembering, on the phone still existing when a request arrives, and on nobody having switched on disappearing messages. A consumer app built on end-to-end encryption keeps the messages on members' phones and in their own backups, and holds nothing the council can open from its own systems, so when a request arrives a year later the search is of people's phones, and of the phones of the people who have left.

Start with where ComplyChat is not the answer. ComplyChat is not a case management system, an FOI case log or a records management system, and it does not decide what to disclose. Councillors' ward and party messages and residents' own chats stay in their own apps, outside any council system and outside ComplyChat. If every conversation a team has is between staff who already have accounts on the council's Microsoft 365, the tools the council has may be enough.

The gap it is built for is the conversation with people who are not on the council's systems: a foster carer, a care leaver, a tenant, a volunteer. ComplyChat gives the council channels it controls, on any phone. On paid plans a resident or carer can join with a mobile number verified by SMS, without an account on the council's systems, and everyone added is told the channel is on the record and can object or leave. Messages are recorded on the server as they are sent, so there is no export step to forget; on paid plans, once the council's Microsoft 365 tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription, where a search for a request can find them. It is designed to replace the WhatsApp group, not to read it.

A question for the next information governance group: name the WhatsApp groups where council business was discussed last month. Who owns each one, and if a request arrived tomorrow, could the council produce them without asking anyone to search their own phone?

Questions people ask

Can council staff use WhatsApp for work?

Yes, no law bans it, but the ICO's guidance says that “as far as reasonably practicable, you should always ensure that you use corporate channels for official business”, and that official information in an app should be transferred to the council's official systems frequently, and certainly when key decisions are taken or someone moves role. Councils' own rules range from approved use on council phones to not using the app for council business at all.

Are council WhatsApp messages subject to FOI?

Yes, when they are about council business: under section 3(2)(b) of the Freedom of Information Act 2000, information “held by another person on behalf of the authority” is held by the authority, and the ICO lists “private messaging accounts eg WhatsApp, Signal or Telegram” among the places official information can be. Messages that are not about the council's business are not covered.

Does a council need a WhatsApp policy?

No statute requires a WhatsApp-specific policy, but the ICO says a public authority's records management policy should set out how staff who use non-corporate channels transfer or export information to official systems, and the section 46 Code expects “written rules on what to keep and when to destroy information”. Some councils have told FOI requesters that they have no messaging-specific guidance and rely on their acceptable use policy.

Can councillors make decisions in a WhatsApp group?

Not decisions of the council as a body: in England and Wales, subject to other enactments, “all questions coming or arising before a local authority shall be decided by a majority of the members of the authority present and voting thereon at a meeting of the authority” (Local Government Act 1972, Schedule 12, paragraph 39(1)). Other legislation lets some decisions be taken by an executive member or an officer under delegated powers, but a group chat is neither a meeting nor a delegation; it can arrange a meeting, not replace one.

Can social workers message families on WhatsApp?

Some councils allow it with conditions. For a looked-after child in England the council must keep a case record that includes “any other document created or considered as part of any assessment of C's needs, or of any review of C's case”, so messages that form part of that work belong on the record, not only in the app. In a 2023 FOI request to five councils, 4 of the 5 said social workers' or case workers' WhatsApp or text messages are copied or saved to the case record, and Bristol City Council said in March 2023 that WhatsApp with service users is allowed only on a council-supplied device.

What happens to council WhatsApp messages when an officer leaves?

The ICO says authorities “should have a process in place to ensure that when an individual leaves your organisation, any official information they hold on non-corporate channels is transferred to an official system”, and warns that if someone leaves or moves roles, access to official information held in non-corporate channels can be lost. Make the transfer part of the leaver's checklist and hand any group the officer owned to a named successor.

Official guidance and your next step

The law is in the Freedom of Information Act 2000 – sections 3 and 77 and Schedule 1 – section 224 and Schedule 12 of the Local Government Act 1972, Articles 5 and 32 of the UK GDPR and, for children's services in England, regulations 49 and 50 of the Care Planning, Placement and Case Review (England) Regulations 2010. The ICO's guidance on official information held in non-corporate communications channels is the regulator's view, and the section 46 Code of Practice sets the records management standard outside Scotland. Replies from public bodies are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026; each is that body's reply on its date, not a statement of its current policy. Other quotations are from the pages named as published on 30 October 2026.

This guide is a summary for councils and their services, mainly in England, and is not legal advice. A question about a particular request, a councillor's position or a child's record is one for your data protection officer or legal team.

Then do one thing: ask each service head to list the WhatsApp groups their teams use for council business, with an owner for each. If the list takes more than a week to assemble, the register in section 03 is the first clause your policy needs.