Non-corporate communication channels

What are non-corporate communication channels?

A non-corporate communication channel is one that does not give the organisation access to the information in it. The definition is the Cabinet Office's, in Using non-corporate communication channels (e.g. WhatsApp, private email, SMS) for government business, published on 30 March 2023. Paragraph 12 says: “‘Government systems’ are corporately-overseen systems providing corporate access to the information held in them. In contrast, a NCCC is a communication channel that does not provide corporate access to information.”

Paragraph 13 gives the examples: “Examples of NCCCs include WhatsApp, Signal; private email; private messaging on social media platforms e.g. Facebook or LinkedIn; and SMS text messaging.” Paragraph 15 adds that the guidance “covers the use of NCCCs from any device regardless of ownership and management.” On that definition the test is who can reach the information, not who paid for the phone: a WhatsApp group on a work-issued handset is still a non-corporate channel, and a work email account or a Microsoft Teams chat on a collaboration platform the organisation runs is a corporate one, even on a personal phone.

The ICO's guidance for public authorities, Official information held in non-corporate communications channels, gives its own list of where official information can sit:

• private email accounts, such as Gmail, ProtonMail or Yahoo Mail;
• private messaging accounts, such as WhatsApp, Signal or Telegram;
• direct messages sent on apps such as Twitter or Facebook Messenger;
• private mobile devices, “including text messages on mobile phones and voice recordings.”

The ICO adds that “you should not assume that the above is a definitive list of non-corporate communications channels.” The two bodies spell the term differently – the Cabinet Office writes “communication channels”, the ICO “communications channels” – and NCCC is the abbreviation for both.

Does the Cabinet Office guidance apply to councils and academy trusts?

The Cabinet Office guidance on non-corporate communication channels does not apply to councils or academy trusts. Paragraph 3 says: “This guidance applies to central government and arm's length bodies. It applies to all individuals in central government (ministers, special advisers, officials, contractors, non-executive board members and independent experts advising ministers).” It is a useful model, and many local policies borrow its wording, but it binds neither a council nor a trust.

What applies to them follows from their being public authorities under the Freedom of Information Act 2000. Schedule 1 to the Act names, in paragraph 7, county, London borough, district and parish councils in England and county, county borough and community councils in Wales; combined authorities are listed in paragraph 19B. Paragraph 52A names “the proprietor of an Academy, in respect of information held for the purposes of the proprietor's functions under Academy arrangements”, which is the academy trust; the ICO's advice for schools on the FOIA makes the trust board responsible “for compliance with FOIA and EIR, regardless of how many schools are in the trust.” For those bodies three documents matter:

1. The ICO's guidance on official information held in non-corporate communications channels, which says: “It is written for use by public authorities.”
2. The records Code. The Code of Practice on the Management of Records issued under section 46 of the Freedom of Information Act 2000 (July 2021) is “a statutory code of practice”. Its principles “apply to information in any format or medium that the authority holds or that another body holds on its behalf”, and paragraph 1.4.2 says: “The standards set out in the Code apply to authorities regardless of how long they have existed for, their size or proximity to central government.” It puts “a local authority or a school” on the same footing as a government department.
3. For principal councils, section 224(1) of the Local Government Act 1972: a principal council “shall make proper arrangements with respect to any documents which belong to or are in the custody of the council or any of their officers.” Section 224(2) applies the same duty to joint and combined authorities. It does not apply to parish, town or community councils, which have the FOI duties but not this one.

Three further points settle the scope:

• The government's review. On 2 July 2026 the Cabinet Office announced an independent review of the use of non-corporate communications channels in government. Its terms of reference say “the communications of local government and other public sector bodies are generally out of scope” and “The reviewer will report in early 2027.” Until then the March 2023 guidance stands.
• Scotland. Scottish councils and schools answer under the Freedom of Information (Scotland) Act 2002. The section 46 Code says it “does not apply to bodies subject to the Freedom of Information (Scotland) Act 2002”, which have their own code under section 61 of that Act. Since 20 June 2025 the Scottish Government's own mobile messaging apps policy has removed messaging apps and non-corporate channels from its devices and says “The use of MMAs for everyday government work is not permitted”; it applies to all users of the Scottish Government's SCOTS platform – staff, contractors, special advisers and ministers – not to Scottish councils.
• Wales and Northern Ireland work under the same Act and the same Code as England: Annex A of the Code says it applies to “any body in England, Wales and Northern Ireland that is subject to FOIA”. Section 224 of the Local Government Act 1972 extends to England and Wales only, so it does not reach councils in Northern Ireland.

Why messages in a non-corporate channel can be the authority's information

Under section 3(2) of the Freedom of Information Act 2000, information is held by a public authority if “(a) it is held by the authority, otherwise than on behalf of another person, or (b) it is held by another person on behalf of the authority.” Limb (b) is what reaches a message on someone's own phone.

The ICO applies it directly: “If the information held in a non-corporate communications channel amounts to public authority business, it is very likely to be held on your behalf in accordance with section 3(2)(b). However, such information may be exempt under FOIA and you would not necessarily have to disclose it.” Held is not the same as disclosed: the usual exemptions, including personal data, still apply once the information is found.

The other side of the line matters as much. The ICO says: “Information in non-corporate communication channels that does not relate to the business of the public authority would not be subject to FOIA.” Which side a message falls on depends on what it says and why it was sent, not on the app.

The principle has reached governors before. The ICO's guidance cites King's College, Cambridge v Information Commissioner (EA/2012/0049 and EA/2012/0085): “the Tribunal found that information held in the private email accounts of the school governors could contain information held on behalf of the public authority under section 3(2)(b) of FOIA.” The same reasoning applies to a trust's trustees and local governors, and to a council's officers and members, when they discuss the body's business in their own accounts.

Using these channels is not in itself unlawful. The ICO's July 2022 report to Parliament, Behind the screens – maintaining government transparency and data security in the age of messaging apps, issued by the then Information Commissioner about government use, said “it is not unlawful for ministers and officials to use private channels for conducting official business.” What the law requires is that the authority can find, keep and produce its information wherever it sits. The ICO's current guidance adds a data protection note: “The use of such channels for communicating official information may make it more difficult for you to meet your obligations under data protection law.”

What a non-corporate communications policy should say about FOI and SAR

The ICO's first expectation is about channels, not capture: “As far as reasonably practicable, you should always ensure that you use corporate channels for official business. Where this is not possible for whatever reason, you should make arrangements to store official information on your corporate systems as quickly as possible.” It also treats habitual use as a signal about the authority's own tools: “If staff repeatedly use non-corporate communication channels, this may signal that you need to review the capability, usability and limitations of your current corporate channels.”

Where non-corporate channels are used, the ICO lists what the policy should cover. In its words or close to them:

1. Record official information routinely. The policy should make clear that staff “frequently and routinely record any information on authority-related business on non-corporate channels on your official record keeping systems.”
2. Copy in a work address. The ICO's recommended wording for private email is that staff “must copy in an authority email address to ensure the completeness of the authority's records.”
3. Know how to export, and do it at key decisions. Staff should know how to transfer or export from each channel and do it frequently; “transfers should certainly take place when key decisions are taken, or when an individual moves roles.” The ICO sets no fixed interval, and expects training where it is needed.
4. Put it somewhere it lasts – an official system with an appropriate retention period, “not onto a corporate chat function where the information will be deleted after a short time period.”
5. Watch for drift, such as “a discussion about a social event drifting into a discussion about a work meeting.”
6. Align auto-delete. “If staff use instant messaging services, then auto-delete options should be in line with the retention policies of your official systems.”
7. Plan for leavers. “You should have a process in place to ensure that when an individual leaves your organisation, any official information they hold on non-corporate channels is transferred to an official system.”
8. Security. The ICO expects adequate information security policies and oversight alongside the records rules.

Two statements make the rest work, and a policy should make them in plain words. First, what counts as the authority's business, with examples from its own work, because the FOI duty turns on that line. Second, that information about the authority's business in these channels is subject to freedom of information and, where it is about a person, to their right of access.

That second right is the one NCCC policies most often leave out. A subject access request under Article 15 of the UK GDPR is not limited to corporate systems. The ICO's subject access request Q&As for employers say that where an organisation uses platforms “such as Facebook, WhatsApp, Twitter and chat channels on Microsoft Teams for business purposes, then you are the controller for the information processed on those pages”, and “If you receive a SAR, you must search these platforms for any personal information if it falls within scope.” A member of staff, a parent or a resident asking for their data can therefore reach the same group chat an FOI requester asks about.

The records Code supplies the limit on what has to be kept. Paragraph 2.7.3 says staff should know “there is no need to keep ephemeral material, and this may be destroyed on a routine basis”, and paragraph 2.7.6 says authorities “should be able to explain why they no longer hold information, either by reference to a record of its destruction or by reference to the authority's policy.” A policy that names what is ephemeral and what must be moved is that explanation.

For the mechanics, the Cabinet Office's capture rule is a workable model: copy, forward, screenshot or export the information to an official system, or record its substance there (paragraph 21), with “a final review before you change device or leave your post” (paragraph 23). Whether or not the authority adopts a formal NCCC policy, the clauses, the device table and a template sit in our staff messaging policy guide, and WhatsApp-specific wording in our WhatsApp policy for employees.

Councillors, trustees and what happens when a request arrives

Councillors wear more than one hat, and the ICO draws the line for them: “In the context of local government, there is a need to have a clear demarcation between Council business and work for individuals as their local representative.” A councillor's message about a council decision is very likely to be held on the council's behalf; a message about ward casework or party campaigning usually is not. The Cabinet Office makes the same cut for central government – its guidance “does not cover the use of NCCCs for personal, political, constituency or parliamentary purposes” – and says that where such conversations drift into government business, individuals must consider the responsibilities it sets out.

The same reasoning reaches trustees and local governors: a trustee's discussion of a trust decision in a personal account is likely to be held on the trust's behalf, while their messages about their own job or family are not the trust's business. The policy should say so.

When a request may reach these channels, the ICO lists the factors for deciding whom to ask to search:

• the focus of the request, from the words the requester used;
• the subject matter of the information within its scope;
• how the organisation handles the issues the request is about;
• by whom and to whom the information was sent, and in what capacity, “eg public servant or political party member”;
• whether staff used a private channel because no official channel was available at the time;
• whether there is a practice of staff using private channels to discuss particular issues or topics, or of particular officials using them.

The people who search should keep a record: “You should ensure that members of staff or other relevant individuals who conduct such searches create a record of the action they take, including the locations they search.” The ICO may need to see it if the requester complains under section 50.

Deleting what a request covers is not routine housekeeping. Under section 77 of the Freedom of Information Act 2000 it is an offence to alter, erase, destroy or conceal a record held by a public authority with the intention of preventing its disclosure to a requester entitled to it, and the offence reaches anyone employed by, an officer of, or subject to the direction of the authority. The ICO adds that “where information that a request covers is knowingly treated as not held because it is in a non-corporate communications channel, this may count as concealment intended to prevent the disclosure of information.”

The search itself, step by step, is in our guide to FOI requests and WhatsApp messages. How public bodies have actually answered requests for messages is in Asked for the WhatsApp messages, and the tribunal and regulator cases are in WhatsApp and the ICO.

A channel the authority can see into

Every measure in the ICO's list is a workaround for one fact: the conversation happened somewhere the authority cannot reach. A cabinet member and a director settle a point in a WhatsApp thread on a Sunday evening. Trustees talk through a building contract by text the night before the board meets. The policy then relies on someone remembering to export the thread, to the right place, before the phone is replaced.

The ICO's first expectation is a corporate channel people will actually use, and that is what ComplyChat is designed to be. Officers, councillors, trustees, governors and staff talk in channels the council or trust controls, so the authority has corporate access to those conversations and no capture step is needed for them. A mobile number verified by SMS is an identity on the platform, so a councillor, trustee or local governor without an account on the authority's systems can still take part. Everyone added to a channel is told it is on the record and can object or leave. Messages are recorded on the server as they are sent, and on paid plans, once the authority's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription, where an FOI or subject access search can find them.

It is not the whole answer. ComplyChat has no connection to WhatsApp and cannot reach what is already in staff's, councillors' or trustees' own WhatsApp, private email or texts; those still need the policy, the capture habit and the leavers' process above. It does not decide what is council or trust business, and it is not an FOI case management system: the log, the search record, the exemptions and the response stay with you.

A question for the next leadership or board meeting: if a request arrived tomorrow for what we said about our last contested decision, which channels would we have to search, and who could search them?

Questions people ask

What are non-corporate communication channels?

Non-corporate communication channels are channels that do not give the organisation access to the information in them. The Cabinet Office's examples are “WhatsApp, Signal; private email; private messaging on social media platforms e.g. Facebook or LinkedIn; and SMS text messaging”, from any device regardless of ownership; the ICO adds texts and voice recordings on private mobile devices and says its list is not definitive.

Does the Cabinet Office guidance on non-corporate communication channels apply to councils?

No. Paragraph 3 says it “applies to central government and arm's length bodies.” Councils and academy trusts are public authorities under the Freedom of Information Act 2000, so the ICO's guidance on official information held in non-corporate communications channels and the section 46 records Code apply to them, and principal councils also have the section 224 duty under the Local Government Act 1972.

What should a non-corporate communications policy include?

A non-corporate communications policy should, following the ICO's guidance, require corporate channels as far as reasonably practicable; routine recording of official information from other channels on official systems with a proper retention period; a work address copied into private email; auto-delete in line with official retention; and transfers at key decisions, role moves and when someone leaves. It should tell staff this information is subject to FOI and to subject access requests. Our staff messaging policy guide has the clauses.

Are councillors' WhatsApp messages subject to FOI?

Council business in a councillor's WhatsApp is very likely to be held on the council's behalf under section 3(2)(b) of the Freedom of Information Act 2000, wherever it sits, though exemptions may still apply; information that does not relate to the council's business is not subject to FOI. Which side a message falls on depends on its context and content, and the ICO says local government needs “a clear demarcation between Council business and work for individuals as their local representative.”

Is it illegal for officials to use WhatsApp for work?

Not in itself. The ICO's 2022 report to Parliament on government use said “it is not unlawful for ministers and officials to use private channels for conducting official business.” The ICO's guidance says authorities should use corporate channels as far as reasonably practicable, store official information on corporate systems, and consider these channels when a request arrives. Altering, erasing, destroying or concealing requested information to prevent its disclosure is an offence under section 77 of the Freedom of Information Act 2000.

Can staff use disappearing messages?

The ICO says that where staff use instant messaging, “auto-delete options should be in line with the retention policies of your official systems.” The Cabinet Office guidance for central government says disappearing messages have a role in limiting the build-up of messages on devices, but “You must ensure that any such use does not impact on your recordkeeping or transparency responsibilities.” Our WhatsApp retention policy guide covers the settings.

Official guidance and your next step

The regulator's guidance is the ICO's Official information held in non-corporate communications channels, with its subject access request Q&As for employers on the data protection side. The statutory framework is the Freedom of Information Act 2000 (sections 3 and 77 and Schedule 1), the section 46 Code of Practice on the Management of Records (July 2021) and, for principal councils, section 224 of the Local Government Act 1972. The Cabinet Office's 2023 guidance and its 2026 review describe central government's position. Since 30 September 2026 the regulator is the Information Commission, still known as the ICO; the 2022 report and the 2021 Code were issued under the old name. Replies from public bodies quoted in section 04 are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026. Other quotations are from the pages named as published on 30 and 31 October 2026.

This guide is a summary for councils and academy trusts, mainly in England and Wales, and is not legal advice. A request that touches a complaint, a dispute or a councillor's conduct is one to take to your data protection officer or monitoring officer.

Then do one thing: open your records management or acceptable use policy and search it for WhatsApp, text message and private email. If none of them appears, or they appear only as things staff must not do, the policy has not yet said what happens to the conversations that take place there anyway.