Secure messaging for social workers

What the professional standards say

Every registered social worker in England must meet Social Work England's professional standards, in force since 2 December 2019. None of them mentions a particular app, but four decide how a social worker may use messaging:

• 2.6: "Treat information about people with sensitivity and handle confidential information in line with the law."
• 3.10: "Establish and maintain skills in information and communication technology and adapt my practice to new ways of working, as appropriate."
• 3.11: "Maintain clear, accurate, legible and up to date records, documenting how I arrive at my decisions."
• 5.6: a social worker will not "use technology, social media or other forms of electronic communication unlawfully, unethically, or in a way that brings the profession into disrepute".

Standard 6.3 adds a duty to "record and act on concerns raised to me", which applies however the concern arrived. Social Work England's guidance Communicating online: guidance for social workers, first published in draft in August 2025 and last updated on 6 May 2026, "does not create any new obligations or standards", and it deliberately does not say which tools to use: the regulator will not give advice about "individual tools (apps, platforms or other methods)" or "which tools you should use in a specific context". But it defines communicating online to include "messaging, and audio and video calling apps" and "management information platforms, such as case management systems", and it covers communicating "in real-time" as well as leaving messages to be read later, so every work message and every group chat is within it.

The guidance sets out five principles, ending with "If in doubt, seek advice". The first four are these. Security: "You must uphold the privacy, confidentiality, and dignity of the people you support". Accountability: "You are responsible for what you communicate online", and "if you are communicating online as part of your practice, you must be familiar with your organisation's data protection procedures" so that you know what to do if there is a data breach. Using the right tools: understand the advantages and disadvantages of different tools "so that you can choose a tool that is appropriate for the type of communication and the needs of the people you are communicating with", because the right tool makes it easier to be confident "that you understand how the content you communicate is seen, shared or retained, and that any personal data is handled and protected appropriately". And maintaining boundaries, including knowing "your employer's data protection or social media policy". Concerns about a social worker's online communication can be raised as fitness to practise concerns.

Who social workers message, and about what

A useful policy starts from what actually happens. In a typical children's or adults' team, messages go to:

• colleagues and managers: arranging joint visits, asking for advice between visits, agreeing a decision that later appears in supervision notes;
• other agencies: schools, health visitors, GPs' practices, the police, housing officers, youth workers, often in a group formed after a strategy discussion;
• foster carers, kinship carers and residential staff: contact arrangements, behaviour overnight, a child's health, a missing episode;
• parents and family members: appointment reminders, changes to contact, documents to bring;
• young people and care leavers, for whom a message is often the only channel that works;
• adults who use services and their carers, advocates and interpreters.

Only the first of those groups usually has an account on the employer's systems. Everyone else is on a personal phone number, which is why so much of this traffic ends up in text messages and consumer apps on a work phone, or worse, on the social worker's own phone. The content is rarely trivial: a foster carer's message that a child came home with money they cannot explain is a safeguarding concern, and a manager's reply "leave it until Monday" is a decision.

Messages and the case record

A message is not automatically part of the case record, but the information and decisions in it are. Standard 3.11 asks for records that document "how I arrive at my decisions", and a decision reached in a message has to be written into the case management system with the reasons, whoever it was agreed with. The practical rule most teams adopt is that anything a colleague picking up the case tomorrow would need to know goes into the record promptly, with the date and time of the original message and who it was from.

The stakes are high because social work records are kept for a long time and read by many people. For a looked-after child, regulation 50 of the Care Planning, Placement and Case Review (England) Regulations 2010 requires the case record to be kept "until the seventy-fifth anniversary of C's birth", or for fifteen years from the child's death if they die before 18. Care leavers ask for their files decades later; courts read case records in proceedings; reviews after a serious incident reconstruct who knew what, and when. A record that says "discussed with foster carer" when the discussion was a thread of messages that no longer exists leaves a gap that nobody can fill later.

Messages held by the employer are also subject to access requests. A person can ask for their personal data, including messages about them held for the employer's purposes, and our guide to subject access requests and WhatsApp messages covers how that applies to work messages on phones. Social work data has its own exemption in Schedule 3 to the Data Protection Act 2018: the ICO's guide to the exemptions describes it as applying where complying "would be likely to cause serious harm to the physical or mental health of any individual". The exemption is narrow, and it cannot be applied to messages the organisation cannot find. The Data (Use and Access) Act 2025 has amended UK GDPR and the 2018 Act, with all its data protection changes now in force while the ICO reviews some of its guidance, so check the date on any ICO page you rely on.

What "secure" has to mean in social work

Messaging products describe themselves as a secure messaging app because messages are protected by encryption in transit, and many consumer apps encrypt end to end, so that not even the provider can read them. That protects a message from interception, which matters. It does not answer the questions an employer of social workers has to answer about secure communication, which are about the record as much as the transport; our guide to choosing a messaging app with an audit trail sets out the questions to put to any supplier. For social work, a messaging platform is secure enough when:

1. The organisation controls it. The accounts, the conversations and the retention belong to the employer, not to the individual worker, and survive the worker leaving.
2. Identity is verified. Everyone in the conversation is who they claim to be, and access can be removed when a placement ends or a worker moves on.
3. Messages are kept securely, and can be found. They are retained under the employer's retention schedule, with an audit trail of who sent what and when, and can be searched for a subject access request, a complaint, a court or a review.
4. People are told. Families, carers and young people know the conversation is on the record, which is also what the standards on dignity and transparency require.
5. It works for people outside the organisation. Foster carers, parents and care leavers can take part without an employer account or a workaround.
6. It keeps work off personal phones, or at least keeps work messages separate from a worker's personal life, which is part of maintaining boundaries.
7. You know where the data is. Where messages are stored and processed, and which suppliers touch them, is written down in terms the data protection officer has checked.

Consumer apps fail most of these for the same reason they are good at privacy: the messages live on the handsets of the people in the conversation, and the organisation holds nothing it can search, retain or produce. A worker who leaves takes the thread; a lost or stolen phone takes it too, and mobile device management can wipe a work phone but cannot recover a conversation held only on it; disappearing-message settings can delete it by design. That is not a flaw in those apps. They were built for private life, and a local authority or agency needs a record.

Good practice whatever tool you use

The regulator's guidance leaves tool choice to employers, so the employer's policy has to do the work. A workable policy for messaging in a social work team covers:

• Which tools, for which conversations. The approved tool for colleagues, the approved tool for people outside the organisation, and what is never to be used, such as personal accounts or personal numbers.
• What never goes in a message. Full case details, assessments and court documents belong in the case management system or secure email; a message says "please read the update I have added".
• Urgent concerns. A message is not a referral and not a way to raise an immediate risk. The policy says to phone, and to follow the safeguarding procedure.
• Copying into the record. Who copies a decision or a concern into the case record, how quickly, and how the original message is referenced.
• Hours and boundaries. When workers are expected to reply, how out-of-hours messages are routed to the emergency duty team or the on-call manager, and what a young person is told about response times.
• Photographs and documents. Whether images can be sent at all, and if so how they are moved into the record and deleted from the device.
• Devices and mistakes. Screen locks, turning off message previews in lock-screen notifications so a name or a detail is not visible on a desk, and what to do when a secure message goes to the wrong person, which is a data breach to report under the employer's procedure.
• Leaving and handover. How conversations pass to the next worker, so that a care leaver does not lose contact because their social worker changed job.

Our guide to work messages on personal phones covers the employer's responsibilities when a policy allows, or fails to stop, the use of personal devices.

Where ComplyChat is, and is not, the answer

Start with where it is not. ComplyChat is not a case management system, and it does not replace the case record, secure email, the referral route or the employer's recording policy. It does not decide what may be shared with another agency, and a message in it is not a referral. If every conversation your team has is between staff who already have accounts on the employer's Microsoft 365, and nothing needs to be held beyond the retention your existing tools apply, the tools you have may already be enough.

The gap it is built for is the conversation with people who are not on your systems. A foster carer messages at ten at night that a child has come home late with a new phone. A care leaver replies to a message about a housing appointment. A kinship carer sends a photograph of a letter from school. Today those arrive on a work phone's text messages or a consumer app, the worker copies what they remember into the case record the next day, and the original is held by nobody the employer can ask. When the child's file is read in twenty years, or at a review next month, the words the carer used and the time they were sent are missing.

ComplyChat gives the employer channels it controls for those conversations. Paid plans let a carer, a parent or a young person join with a mobile number verified by SMS, without an account on the council's or agency's systems, and everyone added is told the channel is on the record and can object or leave. Messages are recorded on the server as they are sent, and stored and processed in the UK, with the supporting services that may process data outside the UK, such as the SMS verification code and push notifications, named on the published sub-processor list. On paid plans, once the employer's Microsoft 365 tenant is connected, the lasting record files into that tenant under the employer's own retention rules, so it can be found for an access request, a court or a review, and survives the worker moving on. The worker still writes the case record; the message is there to be referenced and checked.

A question for the next leadership team or practice meeting: when a foster carer sends your team a message tonight, where does it land, and could the service produce it in twenty years' time?

Official guidance and your next step

The primary sources are Social Work England's professional standards and Communicating online: guidance for social workers (last updated 6 May 2026), the Care Planning, Placement and Case Review (England) Regulations 2010 for looked-after children's records, and the ICO's guide to the data protection exemptions. Your employer's recording policy, data protection policy and retention schedule sit on top. Quotations are from those documents as read in September 2026. Social workers in Wales, Scotland and Northern Ireland are regulated by Social Care Wales, the Scottish Social Services Council and the Northern Ireland Social Care Council, each with its own code.

This guide is a practical summary for England, not legal advice, and not advice on an individual case or a fitness to practise matter.

Then do one thing: ask three social workers in your team where their last three work messages with someone outside the organisation are, and whether what each said is in the case record.