Subject access requests and WhatsApp messages

Does a subject access request cover WhatsApp messages?

Yes: a subject access request covers WhatsApp messages where they are work-related and contain the requester's personal data. A subject access request under UK GDPR gives an individual the right to a copy of personal data an organisation holds about them. The right attaches to the data, not to the system it happens to sit in.

The ICO's position is that personal data held on personal devices is in scope when it is processed for the organisation's purposes. A manager discussing an employee in a work WhatsApp group is processing that employee's personal data on the employer's behalf, and the fact that it is a personal account on a personal handset does not remove it from the SAR.

The ICO's subject access request Q&As for employers answer the question directly. Where a company uses platforms "such as Facebook, WhatsApp, Twitter and chat channels on Microsoft Teams for business purposes, then you are the controller for the information processed on those pages", and "If you receive a SAR, you must search these platforms for any personal information if it falls within scope." Posts that reach you from someone else count too: the ICO says to consider them "as potentially in scope", giving the example of a worker who "submits a copy of posts made by a colleague criticising their manager in a WhatsApp group".

What is not in scope is genuinely personal correspondence that has nothing to do with the employment. The dividing line is purpose, not location – which is precisely why a group that mixes rotas, social chat and comments about colleagues is so difficult to answer for.

What an employer must disclose

The obligation is to provide a copy of the requester's personal data, along with the supplementary information UK GDPR requires – the purposes of processing, the recipients, the retention period, and the individual's rights.

Three points that catch employers out:

• Opinions count. Personal data is not only factual records. A message expressing a view about someone is their personal data, and unflattering opinions are not exempt for being unflattering.
• The requester does not have to name a system. A request for "all my personal data" reaches the WhatsApp group whether or not the requester knows it exists.
• The clock is one month, extendable by two further months for complex requests. The same extension applies where the person has made a number of requests. Technical difficulty retrieving the information can add to a request's complexity, but a large volume of information does not make a request complex on its own.

You are not required to hand over the whole chat. The duty is to disclose the requester's personal data within it, which in practice usually means extracts rather than a full export.

What can be withheld, and how to redact a group chat

A SAR is not an unlimited right of discovery, and there are legitimate grounds to withhold information. In a message export the ground that does most of the work is the one the ICO calls the 'rights of others' exemption, because a group chat is other people's personal data from the first line: the person making the request is one data subject among many third parties.

The rule is stated in the ICO's guidance on information about other people in a SAR: you do not have to provide information "to the extent that this would reveal information about another person, unless: the other person has consented to the disclosure; or it is reasonable to disclose the information without their consent". The ICO sets out a three-step process, and it is worth following in order.

1. Does the request require disclosing information that identifies another person? You are obliged to provide information, not documents, so you "could delete names or redact documents if the third party's information does not form part of the requested information". The trap is that removing a name is not always enough: the requester may still be able to identify a colleague from what they already know. If you cannot take the third party out and still comply, go to step two.
2. Has the other person consented? If they have, you must disclose. You are "not obliged to ask for consent", and the ICO lists cases where asking is inappropriate: you have no contact details; asking would reveal the requester's information to the third party; it would be inappropriate for the third party to know a SAR has been made; or "the third party cannot give their consent freely because there is an imbalance of power between you and them (for example, if they are your employee)".
3. Is it reasonable to disclose without consent? Weigh "the type of information that you would disclose; any duty of confidentiality owed to the third party; any steps you have taken to try to get the third party's consent; whether the third party is capable of giving consent; and any stated refusal of consent". The ICO adds that information the requester already knows is more likely to be disclosable, that information about "a member of staff (acting in the course of their duties)" is more likely to be disclosed than information about an anonymous person, and that the importance of the information to the requester counts. The factors are set by the Data Protection Act 2018, and the decision is the controller's.

Confidentiality is the factor employers get wrong in both directions. The ICO says an employment relationship "would generally carry with them a duty of confidence", so a colleague's message about their own health, family or grievance is usually withheld absent consent. But a label does not create confidence: "A duty of confidence does not arise merely because a letter is marked 'Confidential'", and a message about the requester's work, sent by a manager in the course of their duties, is not confidential simply because the manager would rather it were not seen.

Applied to a WhatsApp export, the three steps give a workable redaction pass. Messages the requester sent are theirs. Messages about the requester are their personal data and are disclosed, with the sender named where the sender was acting in a work role and the balance favours disclosure. Other members' messages about other things are not the requester's data and come out. Numbers and names of members who said nothing about the requester come out. Where a message is about the requester and about a colleague at once, you decide under step three and you write the decision down.

• Legal professional privilege. Advice from a solicitor is exempt.
• Management forecasting and negotiations, where disclosure would prejudice them, and confidential references given for employment.
• Information that is not personal data at all: a message about the van, a rota, a joke that mentions nobody.

Two practical points from the ICO's guidance on supplying the information. First, "it may often be better to leave information in (unless it's covered by an exemption), particularly if it helps the person understand how you are using their information": a response that is all black bars is not intelligible, and the right of access includes the context. Second, the ICO's separate guidance on redaction says to "only redact from a copy of the document, not the original", and the method must actually remove the words rather than paint over them: black marker on a printout works only if what you disclose is a photocopy or scan of the marked page, checked before it goes, and a black box drawn over text in a PDF leaves the text underneath. Sensitive information about a colleague, such as health or a grievance, is the commonest reason for redactions in a staff chat, so expect them and plan the pass rather than improvising it message by message.

You must respond either way. The ICO is clear that "you must respond to the person, whether or not you decide to disclose information about a third party". Where you withhold, tell the requester that information has been withheld and, in general terms, why, and disclose the categories of people the information was shared with even where you withhold their identities. Keep a record of your redactions: for each withheld passage, the exemption relied on and the reasoning in a sentence. SARs are answered one at a time, but the log is what lets the next one be answered consistently. If the requester complains to the ICO, that log is your answer.

Are WhatsApp messages legal proof in the UK?

They are admissible evidence and are relied on routinely in employment tribunals. Screenshots are accepted, though their weight depends on how credibly they can be authenticated – a full thread is stronger than an isolated screenshot, and metadata helps.

Two asymmetries are worth understanding before a dispute rather than during one.

First, the employee usually has the messages and the employer usually does not. An individual keeps their own phone; an organisation whose record lives on other people's phones cannot assemble its own side. In a tribunal that reads as the employer having no answer, not as the employer being neutral.

Second, a SAR is often the opening move in a dispute, and a poor response is itself damaging. An employer who discloses partially, late, or with unexplained gaps invites an adverse inference about what is missing – and the ICO takes a dim view separately from the tribunal.

What happens when the messages cannot be produced

This is the practical position most organisations are actually in, and it is worth being honest about the options because none of them is good.

You can ask staff to search their own devices and provide work-related messages. Many will cooperate. Some will not, and you cannot compel access to a personal phone – you can instruct an employee to comply with a lawful request, and enforcement against a refusal is a disciplinary matter that will look worse than the original problem. A leaver is beyond reach entirely.

One setting makes that search harder. WhatsApp's restricted chat setting (which is replacing its advanced chat privacy), switched on chat by chat, stops anyone in the chat from exporting it and stops photos and videos saving to phones automatically. Screenshots and saving a single item by hand still work, and nothing is deleted, but while the setting is on nobody in the chat can produce the thread as a whole, with every message, its time and its sender. A member searching their phone for a request can then offer only screenshots. In a group, WhatsApp's help centre says group admins can turn it on. The duty to search is the same either way; the setting changes only what the search can produce.

You then have to answer the SAR anyway. The honest response is to disclose what you hold, explain what you have searched, and say what you could not reach. That is defensible once. It is not a position to be in twice, and an organisation that has been through it usually changes something afterwards.

The change that works is not a better search. It is that the conversations happen somewhere the organisation can search in the first place – which is a records decision taken before the request arrives, not after.

Reducing the exposure before a request arrives

1. Decide where work conversations belong, and make that channel as immediate as the one people currently use. A rule alone moves nothing.
2. Write it down. A short policy saying which channel carries what, and that personal-app messaging about colleagues, pupils or service users is not sanctioned.
3. Give the retention schedule somewhere to apply. Personal data in an ungoverned group chat has no retention period, which is its own UK GDPR problem before any SAR arrives.
4. Rehearse the search. Know today which systems you would search and who would do it. Most organisations discover the gap on the clock.

None of this recovers what already exists on personal devices. Nothing does.

Questions people ask

What are the rules on redaction under UK GDPR?

The rule that decides what is redacted is the protection of other people in the Data Protection Act 2018: you do not have to disclose information relating to another identifiable individual unless they have consented or it is reasonable to disclose it without their consent. The ICO's redaction guidance adds that you should redact only from a copy of the document, not the original, make sure no evidence of the redacted information remains in an electronic copy, and check documents before disclosing them.

What should I do if I receive a DSAR?

Log the date it arrived, because an employer must respond without delay and within one month of receipt, then search everywhere the requester's personal data is held for work purposes, including emails, documents and any WhatsApp group used for business. The ICO's subject access request Q&As for employers say staff should know what to do if they receive a SAR, and recommend a designated person, team and email address for subject access requests.

Where to read the official guidance

The ICO's right of access guidance is the authority, and its subject access request Q&As for employers answer the questions employers ask most, including which platforms to search. Acas covers the employment-relations side.

This page is a summary, not legal advice. A live SAR that touches a dispute is one to take advice on.