Volunteer WhatsApp groups

Whose group is it? The charity's responsibility for a personal app

There is no law about volunteer WhatsApp groups as such. There are three sets of duties the group sits inside, and none of them is switched off because the app is free and the phones are personal.

• Data protection. When a coordinator sets up a group to organise the charity's volunteering, the charity is deciding why and how the members' personal data is used, starting with their mobile numbers. That makes it the charity's processing under UK GDPR, even though the account belongs to the coordinator and the terms of use are between the app and each individual. In an ordinary group, members can normally see each other's phone numbers, so adding someone shares their number with everyone in it. Our guide to WhatsApp and GDPR at work sets out the duties that follow.
• Safeguarding. The Charity Commission expects every charity to have "first aid, fire safety and digital safety policies that everyone understands". A group in which volunteers talk about the people the charity serves, or in which adults and young volunteers are members together, is exactly what a digital safety policy is for.
• Governance. The Commission's social media guidance tells trustees to "share guidelines with their trustees, staff and volunteers, for example through their social media policy". A charity's volunteer group is one of the places those guidelines have to reach, and the trustees remain responsible for how volunteers are managed however informal the tool.

The practical consequence is that the group is the charity's in every sense except the one that matters when something goes wrong. The charity is responsible for what happens in it, but the account, the admin controls and the message history belong to whoever created it. When that person steps down, the charity's volunteer communication goes with them unless someone has planned for it.

What a volunteer group is good for, and what it is not

A group is an excellent tool for the everyday logistics of volunteering, and it would be silly to pretend otherwise. It is good at:

• shift reminders, swaps and last-minute gaps ("can anyone cover the 10 to 12 slot on Saturday?");
• practical updates: the hall is locked, the van is back, the delivery has arrived;
• quick questions that anyone on the team can answer;
• welcoming new volunteers and helping a team feel like a team, which matters for volunteer retention more than any rota system;
• sharing opportunities, training dates and thanks.

It is poor at anything that needs to be private, controlled or kept. That means it is the wrong place for the names and circumstances of beneficiaries, safeguarding concerns, complaints, anything about a volunteer's conduct, health or personal circumstances, and decisions that change a record, such as a volunteer's role, an expense approval or a trustee's agreement to spend money. Section 04 sets out where each of those should go instead.

Setting up and running the group properly

A well-run volunteer group takes twenty minutes to set up properly, and most of the problems charities have with groups come from skipping those twenty minutes.

1. Give it one purpose, and say it in the description. "Saturday food bank rota: shift cover and updates." A group with one purpose stays useful; a group for everything becomes noise within a month.
2. Make two people admins, and make them charity roles. The coordinator and a named deputy or trustee, so the group survives either of them leaving. Record in the volunteer handbook who the admins are.
3. Separate announcements from chat. Most messaging apps let admins restrict who can post, and WhatsApp's Communities feature groups several related groups under one announcement group. A main group where only admins post, plus an optional social group, means the message about Saturday is not buried under forty replies.
4. Ask before adding anyone. Tell volunteers, at induction, that joining the group shares their mobile number with the other members, and that it is optional. Offer another route, such as email or a text from the coordinator, for anyone who would rather not join.
5. Pin the group rules. Short, plain and agreed: what the group is for; no personal details about the people the charity supports; concerns go to the named lead, not the group; be kind, and do not expect replies outside reasonable hours, because a group that pings at midnight is a fast route to volunteer burnout; no forwarding outside the group; the admins will remove members who leave volunteering.
6. Remove leavers on the day they leave. Build it into the leaving checklist alongside returning keys and lanyards, and review the member list against the volunteer register every few months.
7. Plan the handover. Decide now what happens when the coordinator steps down: who becomes admin, and whether a new group should be started under the charity's control.

The Commission's volunteer guidance says "A written role description for your volunteers can help make it clear what the boundaries and expectations are." The same is true of a group. The rules above are a role description for the group itself, and they are what a volunteer will be pointed to if something goes wrong.

Young volunteers, beneficiaries and the things that never go in the group

Young volunteers. Many charities involve volunteers under 18, through Duke of Edinburgh's Award placements, youth sections and school volunteering. Adding them to a group of adults they do not know, on personal phones, is a safeguarding decision rather than an administrative one. The Department for Education's safeguarding guidance for out-of-school settings says a staff behaviour policy should include "rules on staff and volunteer contact with children by phone or messaging services". Agree the rules with the safeguarding lead before a young volunteer is added: whether they join at all, whether a parent is included, which adults may message them directly (the usual answer is none, one to one), and the app's own minimum age. NSPCC Learning's online safety resources are a good basis for those rules.

Beneficiaries. Service users, clients and families do not belong in a volunteer group, and volunteers should not create groups with them on their own initiative. If the charity needs to message the people it supports, that is a separate decision with its own safeguarding and data protection assessment.

Then there is the information that should never be posted in a volunteer group, whoever is in it. Each has a proper destination:

• A safeguarding concern about a child or adult: straight to the safeguarding lead, by phone or in person, then recorded in the safeguarding record. Never to the group, not even "has anyone else noticed…".
• Beneficiaries' names, addresses, health or circumstances: in the charity's own system, with access limited to those who need it. If volunteers need an address for a visit, send it directly, and ask them to delete it after the visit.
• Photographs of beneficiaries, and of children in particular: only with consent, and only in the charity's own storage.
• A complaint, from a member of the public or a volunteer: to the person named in the complaints procedure.
• Anything about another volunteer's conduct, health or personal life: to the coordinator, privately.
• Decisions: a change to a volunteer's role, an expense approval, a trustee decision. They can be discussed anywhere, but they must end up in the record: the volunteer register, the accounts, the minutes.

When the group stops being enough

For a small team that only swaps shifts, a well-run group may be all the charity needs, provided the records live elsewhere. The signs that it has outgrown the job are usually clear:

• the group has grown past the point where members know each other, and new volunteers are joining a list of strangers' phone numbers;
• the charity runs several sites or activities, and people are in five groups to hear about one;
• the coordinator is maintaining the rota, the register and the group by hand, and they no longer agree;
• decisions, concerns or complaints keep arriving in the group despite the rules;
• someone has asked, or will ask, to see what was said.

When several of those are true, the question is no longer how to run the group but what should replace it. Our guide to choosing an internal communication app for a small charity works through the six questions to answer before comparing products, the realistic options from volunteer management software to team messaging, and how to make a new tool work for people who give two hours a week. Whatever replaces the group has to reach the person doing Saturday on the phone they already carry, without asking them to remember a password for something they open twice a month.

When the group holds the only record

Even a well-run group collects things it was never meant to. A volunteer posts, late one evening, that the man she delivers to seemed frightened of his son. A new volunteer asks whether it is normal for another volunteer to offer lifts home to the teenagers from the youth session. The coordinator replies to a shift swap with "fine, and yes, the trustees agreed we can pay for the training". Each message was sent in good faith to the people the sender trusted, and each is now the charity's first record of a safeguarding concern, a conduct concern and a spending decision.

That record sits on the personal phones of everyone in the group. The app's end-to-end encryption means the messages are readable only on those devices, so the charity holds no copy, cannot search it and cannot keep it when the coordinator steps down and a volunteer clears their phone. If the charity is later asked what it knew and when, by the safeguarding partners, the Commission or a family, the honest answer depends on whether anybody still has the thread.

ComplyChat is a replacement for the charity's work group, not an addition to anyone's personal apps. It gives the charity channels it owns, with everyone added told that the channel is on the record and free to object or leave, and a mobile number verified by SMS as the identity, so volunteers with no work account can join from their own phones. Messages are recorded on the server as they are sent, and on paid plans the lasting record files into the charity's own Microsoft 365 once its tenant is connected, under the charity's own retention rules. Volunteers' own chats with friends and family stay exactly where they are. ComplyChat is not a rota or volunteer management system, and a group that only swaps shifts may not need it. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive, so it is not a way to meet a retention duty.

A question for the next trustees' meeting: who are the admins of each group our volunteers use, and if the first mention of a safeguarding concern were in one of them, would the charity be able to find it a year from now?

Official guidance and your next step

The Charity Commission's guidance on managing volunteers, its safeguarding and protecting people guidance and its guidance on charities and social media set the governance frame. The Department for Education's safeguarding guidance for out-of-school settings applies to charities running activities for children, and NSPCC Learning covers online safety in more depth. For the data protection side, the ICO's advice for small organisations is the place to start; the Data (Use and Access) Act 2025 has amended UK GDPR, and its last data protection provisions came into force on 19 June 2026, so check the date on any ICO page you read. Quotations are from those pages as published on 25 September 2026.

This guide is practical guidance for charities and community groups in England, not legal advice. Where a group has already been used for a safeguarding concern or a complaint, take advice from your safeguarding lead before deleting or changing anything.

Then do one thing: list every group your volunteers use for the charity, with its admins and its purpose. Any group whose admin has left, or whose purpose nobody can state, is the first one to fix.