FOI requests and WhatsApp messages

Does the Freedom of Information Act cover WhatsApp messages?

Yes: the Freedom of Information Act 2000 covers WhatsApp messages that record the authority's business, because the Act turns on who the information is held for, not on the device or app it sits in. Under section 3(2) of the Act, information is held by a public authority if "it is held by the authority, otherwise than on behalf of another person", or if "it is held by another person on behalf of the authority". A head teacher's message about an admissions decision, sent from a personal phone, is very likely to be held on the school's behalf.

The ICO's guidance on official information held in non-corporate communications channels names the channels directly. It lists information held "in private messaging accounts eg WhatsApp, Signal or Telegram", alongside private email and personal devices, and says authorities should tell staff that information they hold "regardless of the form in which they hold it, and which relates to the business of the authority, is likely to be held on behalf of the authority and so is subject to FOIA."

The guidance is the ICO's – on 30 September 2026 the Information Commission took over from the Information Commissioner as the regulator, still known as the ICO, so check the date on any ICO page you rely on.

What falls outside is genuinely private correspondence. The test is the content and context of each message, which is why a staff group that mixes rotas, decisions and social chat is the hardest thing to answer for.

The regulator has applied this to the smallest authorities. A parish council told a requester that messages in its councillors' WhatsApp group did not relate to council business, although its own review accepted the group was used to flag issues, share updates and arrange meetings. In a decision notice of December 2024, the ICO found that "the requested information is held by the Parish Council for the purposes of FOIA" and required a fresh response. More cases are collected in our guide to what UK regulators and tribunals have found about WhatsApp.

Which schools and nurseries are covered

Schedule 1 to the Act lists the public authorities. For education it includes:

• Maintained schools and maintained nursery schools. Paragraph 52 of Schedule 1 names the governing body of a maintained school and of a maintained nursery school.
• Academies and academy trusts. Paragraph 52A names "the proprietor of an Academy, in respect of information held for the purposes of the proprietor's functions under Academy arrangements". For a multi-academy trust, the trust is the public authority for all its academies.
• Local authorities, which hold their own records about the schools they maintain.

Independent schools, private and voluntary nurseries, childminders, independent care providers and charities other than academy trusts are not public authorities under the Act. What they send to a council or another authority can still be disclosed by that authority, because the authority then holds it.

In Scotland the Freedom of Information (Scotland) Act 2002 applies instead, with its own commissioner and the same twenty working day clock.

The deadline and what the request entitles someone to

Section 1 gives anyone the right to be told whether the authority holds the information described and, if it does, to have it communicated to them. Section 10(1) sets the clock: an authority must respond "promptly and in any event not later than the twentieth working day following the date of receipt."

The requester does not have to mention WhatsApp. A request for "all communications about the decision to close the breakfast club" covers every place the school's business about that decision was recorded, and a search that stops at the email server is incomplete if the decision was discussed in a staff or governors' group.

The usual exemptions still apply to whatever is found. Personal data about other people is handled under section 40, a requester's own personal data is answered as a subject access request rather than under FOI, and the cost limit allows a refusal where finding the information would take too long. Under the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, the limit is £450 for schools, academies and councils, and staff time is costed at £25 per person per hour, which is eighteen hours of work.

How to search messages the school does not hold

The school cannot open a personal phone, so the search is done by the person who holds it. The ICO's guidance says: "You will need to ask an individual to search their accounts and/or devices, if you decide that their personal email account, messaging accounts or personal mobile device may include information which falls within the scope of the request, and which your system does not hold elsewhere."

1. Decide who might hold something. Work from the subject of the request: who took the decision, who was in the group, who sent the messages the request describes.
2. Ask them in writing to search their messaging apps and devices for anything within scope, and to send it to the person handling the request.
3. Have them record the search. The ICO says staff who search should "create a record of the action they take, including the locations they search", so the school can show the search was adequate if the requester complains to the regulator.
4. Apply the exemptions to what comes back, as with any other information, and redact other people's personal data where disclosure would be unfair.
5. Say what you searched in the response. A requester who asks whether a WhatsApp group was checked is entitled to a straight answer.

Governors count. The ICO's guidance cites King's College, Cambridge v Information Commissioner (EA/2012/0049 and EA/2012/0085), in which the tribunal, considering requests about King's College School, found that the private email accounts of the school governors could contain information held on behalf of the public authority. A governing board's WhatsApp group discussing an exclusion or a budget is in the same position.

Leavers count too. When the Cabinet Office searched its own systems for messages between two former advisers but did not approach the advisers themselves, although it knew they had used WhatsApp, the First-tier Tribunal in [2025] UKFTT 391 (GRC) found that it "has not carried out sufficient searches" and ordered it to ask them whether they had kept relevant messages. A head teacher or business manager who has moved on may still hold the school's information.

What if the messages have been deleted?

Information deleted before a request arrives is not held, and an authority cannot disclose what it no longer has. That is the normal answer, and it is lawful. Deleting information after a request arrives, to stop it being disclosed, is a crime.

Section 77 of the Act makes it an offence, once a request has been made, to alter, deface, block, erase, destroy or conceal a record "with the intention of preventing the disclosure" of information the requester was entitled to. It applies to the authority and to anyone employed by it, holding office in it or subject to its direction, and carries a fine. The ICO's guidance tells authorities to remind staff of exactly that.

Disappearing messages sit awkwardly between the two. A setting switched on long ago keeps deleting messages after a request arrives, without anyone intending to prevent disclosure. The ICO's guidance warns of "a risk of information on non-corporate channels only being held for a limited time or messages being auto deleted", and says that where staff use instant messaging, "auto-delete options should be in line with the retention policies of your official systems." The moment a request arrives, anyone who may hold relevant messages should be told to turn off disappearing messages in those chats and keep what is there.

Deleted messages do not end the authority's duties. In a decision notice of January 2026, the ICO found that the Department for Business and Trade "does not hold the requested WhatsApp messages, as they were set to be deleted after seven days", but that it had breached its duty to advise and assist the requester by not mentioning a related note it did hold. Its own policy had required significant messages to be captured before they were deleted.

Central government reached the same position for itself. The Cabinet Office's guidance on using non-corporate communication channels for government business, published in March 2023, says disappearing messages "have a role in limiting the build up of messages on devices", but that "You must ensure that any such use does not impact on your recordkeeping or transparency responsibilities", and warns that "Deletion or concealment of material relevant to an information request may be a criminal offence." It binds government departments, not schools, but it is the clearest official statement of where the line sits.

The records management code issued under section 46 of the Act asks for more than avoiding an offence. The ICO's page on the section 46 code of practice explains what it expects of an authority's records: decisions recorded, kept for as long as they are needed, and destroyed under a policy rather than by accident.

Why the search is the wrong place to fix this

Every step in the previous two sections depends on people: remembering which group a decision was discussed in, agreeing to search their own phone, not having left, not having switched on disappearing messages a year ago. A school can do all of it properly and still produce an answer it cannot vouch for.

The ICO's guidance points the other way. It asks authorities to make sure business is recorded on official systems, so that less has to be searched for in personal channels when a request arrives, and where staff do use messaging apps, to export what matters onto official systems "when key decisions are taken, or when an individual moves roles". Most schools have the policy. Very few have a channel where the conversation is the record from the first message.

That is the gap ComplyChat was built for. A channel the school or trust owns, which the people in it can use as easily as a group chat, keeps the conversation as the organisation's record as it is sent and, on paid plans, meets your retention schedules within your own Microsoft 365 subscription once your tenant is connected. A request is then answered from your own record, and the question in section 04 – who might have something on their phone – has a much shorter answer.

The question worth taking to the next governors' or trustees' meeting is simple: if a request arrived tomorrow for everything said about our last difficult decision, where would we look, and could we say we had looked everywhere?

Questions people ask

Are WhatsApp messages subject to FOI?

WhatsApp messages are subject to the Freedom of Information Act when they record a public authority's business, even on a personal phone or account, because section 3(2) treats information held on the authority's behalf as held by the authority. Purely personal messages are not covered.

Do school governors' WhatsApp messages count for FOI?

Governors' messages about the school's business can be held on the school's behalf. The ICO cites a tribunal decision about King's College School finding that school governors' private email accounts could contain information held on behalf of the public authority, and the same reasoning applies to a governing board's WhatsApp group.

Can a school refuse an FOI request for WhatsApp messages?

A school can refuse or redact under the usual exemptions, such as section 40 for other people's personal data, or refuse a request that would cost more than the £450 limit, but it cannot refuse because the messages are on WhatsApp. It still has to decide who might hold relevant messages and ask them to search.

Do FOI requests apply to academies and nurseries?

FOI applies to the proprietor of an academy, which is the academy trust, and to the governing bodies of maintained schools and maintained nursery schools, under paragraphs 52 and 52A of Schedule 1 to the Act. Private and voluntary nurseries, childminders and independent schools are not public authorities under the Act.

Is deleting WhatsApp messages after an FOI request a crime?

Deleting, altering or concealing a record after a request has been made, with the intention of preventing its disclosure, is an offence under section 77 of the Freedom of Information Act, punishable by a fine. Deleting messages under a retention policy before any request arrives is not an offence.

Where to read the official guidance

The ICO's guidance on official information held in non-corporate communications channels is the authority on searching messaging apps and personal devices, and the Freedom of Information Act 2000 itself is short and readable. For the requests that arrive about a person rather than a decision, see our guide to subject access requests and WhatsApp messages.

This page is a summary, not legal advice. A request that touches a dispute, a complaint or a safeguarding matter is one to take advice on, usually from your data protection officer.