FOI and personal devices: staff phones, private email and the search

Are personal devices subject to FOI?

Personal devices are subject to FOI to the extent that they hold recorded information about the public authority's business: the Freedom of Information Act 2000 turns on whose information it is, not whose phone it sits on. Under section 3(2) of the Act, information is held by a public authority if “(a) it is held by the authority, otherwise than on behalf of another person, or (b) it is held by another person on behalf of the authority.” The definition in section 84 is that information “means information recorded in any form”, which on its plain words takes in a text, an email, a voice recording or a photograph of a whiteboard that records the authority's business. Requests for environmental information follow the same rule: under regulation 3(2)(b) of the Environmental Information Regulations 2004, environmental information is held by a public authority if it “is held by another person on behalf of the authority”, and the ICO says the concepts in its guidance “apply equally to the Environmental Information Regulations (EIR).”

The ICO's guidance on official information held in non-corporate communications channels states the practical consequence plainly: “If the information held in a non-corporate communications channel amounts to public authority business, it is very likely to be held on your behalf in accordance with section 3(2)(b). However, such information may be exempt under FOIA and you would not necessarily have to disclose it.” The other half of the rule is just as clear: “Information in non-corporate communication channels that does not relate to the business of the public authority would not be subject to FOIA.” A teacher's messages to their family stay private; their message to a colleague about a pupil's exclusion does not.

For education, the public authorities are the governing bodies of maintained schools and maintained nursery schools and the academy trust as proprietor of an academy (Schedule 1, Part IV, paragraphs 52 and 52A); councils are public authorities too. Independent schools, private and voluntary nurseries, childminders, independent care providers and charities other than academy trusts are not, so FOI does not reach their staff's phones, although a subject access request can (section 05). The 20 school day clock is in our guide to freedom of information in schools.

• Scotland has the same rule in its own Act: under section 3(2)(b) of the Freedom of Information (Scotland) Act 2002, information is held by an authority if it is held “by a person other than the authority, on behalf of the authority.” Requests there are answered under that Act, the regulator is the Scottish Information Commissioner, and the ICO guidance quoted on this page does not govern them.
• The regulator for the rest of the UK is the Information Commission, still known as the ICO, which took over from the Information Commissioner on 30 September 2026; the guidance quoted here predates the change.

What it reaches: phones, private email, texts and home computers

The ICO's guidance says official information held on a public authority's behalf “could be contained in a number of non-corporate channels or locations, including”:

• “In private email accounts eg Gmail, ProtonMail or Yahoo Mail.”
• “In private messaging accounts eg WhatsApp, Signal or Telegram.”
• “Direct messages sent on apps such as Twitter or via Facebook messenger.”
• “On private mobile devices, including text messages on mobile phones and voice recordings.”

The list opens with “including”, so it is not closed. The ICO's page on information you hold for the purposes of FOIA adds storage: information held digitally on a network, in cloud storage or on “a hardware storage device (for example, a USB stick or an external hard drive). This includes personal devices and non-corporate channels of communication used by your staff when storing, sending or receiving official information.” A spreadsheet of staffing options saved on a home computer is in the same position as a text.

The same page draws the line the other way for the authority's own systems: “You are also unlikely to be holding for the purposes of FOIA private communications sent and received by members of your staff through corporate email accounts. By contrast, you are likely to hold for the purposes of FOIA official information sent and received by your staff via non-corporate channels of communication.” The device does not decide the question in either direction; the content does.

The hardest cases are mixed conversations. The ICO asks authorities to make staff aware of “the potential for a private conversation on non-corporate channels ‘drifting’ into a discussion about official matters. For example, a discussion about a social event drifting into a discussion about a work meeting.” A thread between two teachers that starts with weekend plans and turns to a parent's complaint is private until it turns, and the authority's business from that message on.

Whose devices can be involved follows from the same test. Staff are the obvious case, but section 3(2)(b) covers anyone holding information on the authority's behalf: the ICO cites a tribunal finding that school governors' private email accounts could contain information held on behalf of the public authority, and a head teacher or business manager who has left may still hold the school's information (both are covered in the WhatsApp FOI guide).

Deciding whose devices to search, and recording the search

The ICO expects an authority to decide, for each request for information, whether anyone needs to be asked to search a personal account or device. Its guidance says you “should always consider all locations where staff may hold relevant information. This may include non-corporate communications channels”, and that your procedures should set out the factors you weigh. It says the relevant factors are likely to include:

• “The focus of the request, indicated by the words the requester has used.”
• “The subject matter of the information which falls within the scope of the request.”
• “How your organisation handles the issues that the request is about.”
• “By whom and to whom was the information sent and in what capacity (eg public servant or political party member).”
• “Whether staff used a private communication channel because no official channel was available at the time.”
• “Whether there is a practice of staff using private communication channels to discuss particular issues or topics, or if there is a practice of particular officials using such channels, or both.”

Those factors turn a vague worry into a short list. A request about a decision taken by the senior leadership team over half term, when the team is known to message each other, points at five phones; a request about the canteen contract, handled entirely by email by the business manager, may point at none.

The ICO's test for asking someone has two parts, and the second is easy to miss: “You will need to ask an individual to search their accounts and/or devices, if you decide that their personal email account, messaging accounts or personal mobile device may include information which falls within the scope of the request, and which your system does not hold elsewhere.” If every relevant email from a governor's Gmail account was copied to a school address, the school already holds it, and the request is answered from the school's own record.

The person who holds the device does the search, and the record of it matters as much as the result. The ICO says the authority should ensure that those who search “create a record of the action they take, including the locations they search. You can then demonstrate, if required, that you made appropriate searches in relation to a particular request. The ICO may need to see this in the event of a section 50 complaint arising from the handling of the request.” Beyond the ICO's minimum of the action taken and the locations searched, we suggest a search record shows:

1. Who was asked, by whom and on what date, and the wording of the request they were given.
2. Where they looked: each email account, messaging app, text messages, voicemail and any home computer or storage, and whether backups were included.
3. How they looked: the date range and the names, words or subjects searched for.
4. What they found, including a nil return, and what they passed to the person handling the request.
5. Anything they could not search, such as a phone replaced since the period in question, so that the response to the requester can say so.

The response should then say which personal accounts and devices were considered and which were searched, not only that the information is not held.

Can a school make staff hand over a personal phone?

The Freedom of Information Act gives a school, trust or council no power to take or inspect a member of staff's own phone, and the ICO's FOI guidance does not describe one: its route is to ask the individual to search their own accounts and devices and to record where they looked. Whether an employer can ever require more is a question for the contract of employment, its policies and data protection law, not FOI. There is also a privacy reason to prefer the ICO's route. The ICO's separate data protection guidance on monitoring workers says: “You should ensure that when workers are using their own personal devices for work, you are not capturing their private use of their device.” A phone holds a person's whole private life, and a search by its owner reaches the official part without exposing the rest. What an employer can and cannot see on a personal phone more generally is set out in our guide to work messages on personal phones.

Public bodies do not all describe it the same way. One council's guidance for school staff warns that it may need access to the device itself; another council's internal review records the holder searching their own account, backups included. Each reply below is one body's own words, and the first was written under the Scottish Act.

A line like Perth and Kinross's is that council's own guidance to its school staff, written under the Scottish Act; it is not a power the FOI Act gives, and in England the ICO's route is a search by the holder. A school that wants a different arrangement needs it written into its policy, and understood by staff, before a request arrives, not improvised after one.

What the Act does reach is concealment. Section 77 makes it an offence, once a request has been made, to alter, deface, block, erase, destroy or conceal a record with the intention of preventing the disclosure of information the requester would have been entitled to. It applies to the authority and to anyone employed by it, an officer of it or subject to its direction. The ICO gives an example aimed squarely at personal devices: “where information that a request covers is knowingly treated as not held because it is in a non-corporate communications channel, this may count as concealment intended to prevent the disclosure of information. The person concealing the information may be liable to prosecution.” Since 30 September 2026, proceedings in England, Wales and Northern Ireland may be brought only by the Information Commission or by or with the consent of the relevant Director of Public Prosecutions. In Scotland the equivalent offence is section 65 of the Freedom of Information (Scotland) Act 2002.

Section 77 is about concealment with intent, not about a slow or incomplete search, and deleting messages before any request has been made is not that offence. The moment a request arrives is the time to tell anyone who may hold relevant information to keep it; what that means for disappearing messages is in the WhatsApp FOI guide.

Subject access requests and personal devices

A subject access request reaches personal devices in the same way, and it reaches further: the right of access in Article 15 of the UK GDPR applies to every organisation that holds personal data as a controller, so a private nursery, a charity or a care provider that FOI never touches must still answer one. If the requester is asking for their own information, it is a subject access request, not an FOI request: section 40(1) of the Freedom of Information Act makes a requester's own personal data exempt from FOI so that it is dealt with under the UK GDPR and the Data Protection Act 2018 instead.

The ICO's guidance on how to find and retrieve the relevant information for a subject access request starts from the policy: “It is not usually appropriate for your staff to hold information about customers, contacts or other employees on their personal devices (eg in private email accounts, smartphones, home computers or private instant messaging applications).” It then deals with the reality: “If you do permit staff to hold personal information on their own devices, they may be holding it on your behalf. This means that this information may be within scope if you receive a SAR. If you have a good reason to think your staff are holding personal information about the requester on their personal devices, you should ask them to search their private emails, devices or instant messaging applications, as appropriate.”

So the procedure is the same as for FOI: decide who might hold something, ask them to search, and keep a record. The difference is the subject. An FOI request asks about a decision or a matter; a subject access request asks about a person, often a parent, a former employee or a pupil, and the messages most likely to mention them are the informal ones between colleagues. What must be disclosed from those messages, and what can be redacted, is in our guide to subject access requests and WhatsApp messages.

Why the search is the hardest place to keep a record

Even a careful search by every holder leaves the authority vouching for what it was told, not for what it holds: it has the holder's word for which accounts exist, what was in them and what has gone.

The ICO's own advice points upstream. It says authorities should ensure “that staff can access official IT systems and equipment. This should mean that they do not need to use non-corporate channels and personal devices in order to undertake their roles.” Where staff do use them, it says the policy should require that anyone using a private email for the authority's business “must copy in an authority email address to ensure the completeness of the authority's records”, and that there should be “a process in place to ensure that when an individual leaves your organisation, any official information they hold on non-corporate channels is transferred to an official system.” What should be kept on official systems, and for how long, is covered by the records management code of practice issued under section 46 of the Act. Most of those measures ask staff to move a conversation onto the record after it has happened.

ComplyChat is designed to make the conversation the record from the first message. Staff, governors and the parents they need to reach talk in channels the school or trust controls, on their own phones if that is what they carry; a mobile number verified by SMS is an identity, so a governor or a parent does not need an account on the school's systems; and everyone added to a channel is told it is on the record and can object or leave. Messages are recorded on the server as they are sent, not gathered from handsets afterwards, and on paid plans, once the school's tenant is connected, they are kept under the retention schedules within its own Microsoft 365 subscription. A request is then answered from the school's own record, and the list of people who might have something on their phone gets much shorter.

ComplyChat is not the whole answer. It cannot see a personal phone, search a private email account or reach a conversation that has already happened elsewhere, and it does not decide what to disclose. Where everything already happens in school email and Teams, the useful work is the policy and the search procedure above.

A question for the next governors' or trustees' meeting: whose own phones and private email accounts would we have to ask about if a request arrived tomorrow, and how many of those conversations could have been on our own record instead?

Questions people ask

Are personal devices subject to FOI?

Information about a public authority's business on a personal phone, laptop, home computer or private email account is covered by the Freedom of Information Act 2000, because section 3(2)(b) treats information held by another person on the authority's behalf as held by the authority, and section 84 defines information as information recorded in any form. Purely private content on the same device is not covered.

Can my employer make me hand over my personal phone for an FOI request?

The ICO's FOI guidance has the authority ask the individual to search their own accounts and devices and record where they looked; it does not describe taking or inspecting the device. The ICO's separate guidance on monitoring workers says an employer should ensure it is not capturing workers' private use of their own devices. Deliberately concealing information after a request, intending to prevent its disclosure, is an offence under section 77 of the Act.

Do FOI requests cover personal email accounts?

Yes, where the emails are about the authority's business: the ICO lists private email accounts such as Gmail first among the non-corporate channels that could contain official information held on an authority's behalf, and says a policy should require staff who use private email for official business to copy in an authority email address.

Are text messages on a personal phone subject to FOI?

Text messages and voice recordings on a private mobile device are covered when they record the authority's business: the ICO names “text messages on mobile phones and voice recordings” among the places official information could be held, and the Act covers information recorded in any form.

Can individuals request their own personal data through an FOI request?

No. Section 40(1) of the Freedom of Information Act makes a requester's own personal data exempt from FOI, so a request for your own information is handled as a subject access request under Article 15 of the UK GDPR, which can also reach staff's personal devices where they hold your information on the organisation's behalf.

Official guidance and your next step

The law is in the Freedom of Information Act 2000 – sections 3, 40, 77 and 84 and Schedule 1 – and, in Scotland, the Freedom of Information (Scotland) Act 2002. The ICO's guidance on official information held in non-corporate communications channels is the authority on searching personal devices for an FOI request, its page on information you hold for the purposes of FOIA explains what counts as held, and its right of access guidance covers the same question for a subject access request. Replies from public bodies quoted in section 04 are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026. Other quotations are from the pages named as published on 31 October 2026.

This guide is a summary for schools, academy trusts and other public authorities, mainly in England, and is not legal advice. A request that touches a dispute, a complaint, a disciplinary matter or a safeguarding concern is one to take to your data protection officer.

Then do one thing: read your records management or acceptable use policy and check that it says what happens to official information on staff's and governors' own phones and private email, who would be asked to search them when a request arrives, and what a leaver hands over before they go.