WhatsApp policy for employees

Why the policy matters: section 109 and the reasonable-steps defence

Section 109 of the Equality Act 2010 makes an employer answerable for what its staff do in the course of their work, and that includes what they post in a work WhatsApp group. Subsection (1) of section 109 of the Equality Act 2010 reads: “Anything done by a person (A) in the course of A's employment must be treated as also done by the employer.” Subsection (3) adds: “It does not matter whether that thing is done with the employer's or principal's knowledge or approval.” An employer can therefore be liable for a message in a group it has never seen.

The employer's defence is in section 109(4): “it is a defence for B to show that B took all reasonable steps to prevent A– (a) from doing that thing, or (b) from doing anything of that description.” The Equality and Human Rights Commission's Sexual harassment and harassment at work: technical guidance (published 30 January 2020, last updated 26 September 2024) explains the test: “An employer will have taken all reasonable steps if there are no further steps that they could reasonably have been expected to take” (paragraph 3.50). Steps taken afterwards do not rescue it: “The fact that an employer has taken steps such as an investigation and disciplinary action to deal with the harassment after it has occurred will not be sufficient on its own to avoid liability” (paragraph 3.54). The guidance predates the Employment Rights Act 2025, and its banner says “We are currently working to update this guidance”, so this guide relies on it only for what reasonable steps and conduct by message look like.

Section 26 of the Equality Act 2010 defines harassment as unwanted conduct related to a relevant protected characteristic – age, disability, gender reassignment, race, religion or belief, sex or sexual orientation – that has “the purpose or effect of– (i) violating B's dignity, or (ii) creating an intimidating, hostile, degrading, humiliating or offensive environment for B”. Section 26(2) covers unwanted conduct of a sexual nature. Under section 26(4), deciding whether conduct had that effect takes account of the recipient's perception, the other circumstances of the case and whether it is reasonable for the conduct to have that effect, which is why a message can be harassment although its sender meant it as a joke.

Two further duties change on 30 October 2026, when sections 20 to 22 of the Employment Rights Act 2025 come into force under regulation 3 of S.I. 2026/1065, the Act's sixth commencement regulations, made on 1 October 2026:

• Preventing sexual harassment. Section 40A of the Equality Act 2010 has required employers since 26 October 2024 to “take reasonable steps to prevent sexual harassment of employees of A in the course of their employment”. From 30 October 2026, section 20 of the Employment Rights Act 2025 inserts “all” before “reasonable steps”, the same standard as the section 109 defence. The Commission calls it “a separate positive legal duty” (paragraph 3.57): it applies before anyone complains. Section 40A(3) makes it enforceable only by the Commission or through a compensation uplift: under section 124A of the Equality Act 2010, when a tribunal upholds a sexual harassment claim and orders compensation, it must consider whether the employer also breached section 40A(1), and the uplift “may be no more than 25% of the amount awarded”. An employee cannot bring a claim for breach of section 40A on its own.
• Harassment by third parties. From 30 October 2026, section 21 of the Employment Rights Act 2025 inserts a new section 40(1A) into the Equality Act: “An employer (A) must not permit a third party to harass a person (B) who is an employee of A.” Under section 40(1B) the employer permits it only if the harassment happens in the course of B's employment and the employer “failed to take all reasonable steps to prevent the third party from doing so”. A third party is anyone other than the employer and its employees. Unlike section 40A, the new duty is one an employee can bring to an employment tribunal.
• Regulations to come. Section 22 inserts a new section 40B into the Equality Act, under which regulations may specify steps that are to be regarded as “reasonable” when deciding whether an employer has taken all reasonable steps to prevent sexual harassment. The Department for Business and Trade's Employment Rights Act timeline says they will “complement, not replace, the broader legislative requirement to take all reasonable steps”. None has yet been made, so no prescribed list exists.

The Equality Act 2010, and the amendments the Employment Rights Act 2025 makes to it, apply in England, Wales and Scotland. Northern Ireland has its own equality law, so a policy for staff there needs advice on that law.

Scope: which WhatsApp groups and messages the policy covers

The first clause of a WhatsApp policy says what it applies to, and it should reach further than the groups the organisation set up itself. Section 109 turns on “the course of employment”, and the Commission's guidance says the phrase “has a wide meaning”: it includes circumstances “in which the worker is not actually working but that are connected with work”, and whether conduct outside work counts “will depend on the strength of the connection with work in each particular case” (paragraphs 3.47 and 3.48). Its own example is colleagues' drinks in the pub straight after work and a leaving party, both held to be in the course of employment. In a case decided in 2023 (written reasons 2024), a colleague at a residential care provider for young people had sent an employee late-night messages with remarks about her appearance; because they had swapped numbers for work and she was on shift, the tribunal held the messages were in the course of employment and the employer was liable for harassment related to sex and race. The employer did not argue the reasonable-steps defence (Employment Tribunal judgment 3220651/2020).

So the scope clause names five things:

• Official groups the organisation creates for work, each with a named owner and admin.
• Staff-run groups about work – a team, shift, department or year-group chat that colleagues set up themselves. The policy cannot make these the organisation's groups, but it can say that its conduct standard applies to anything posted in them about work or about colleagues.
• Messages between colleagues, one to one, on personal phones as well as work devices. The Commission asks whether policies on IT, communications and social media “include appropriate warnings against online harassment and encourage workers to report it, even where such harassment takes place on personal devices” (paragraph 4.21).
• Groups and chats with people outside the staff: parents, families, volunteers, residents or service users. These bring in the third-party duty (below) and the sector rules on contact with children and on confidentiality.
• Who the policy covers. The Commission's first item for a good anti-harassment policy is to “confirm who the policy covers” (paragraph 4.18): employees, bank and agency staff and contractors, and volunteers through the volunteer code of conduct. Whether the Equality Act protects a particular volunteer depends on the arrangement, so the policy can bind volunteers to its standard without promising them the rights of an employee.

Which app carries which kind of work is a question for the staff messaging policy, which holds the channel table. Where everyone already has a work account, it may move official groups to a workplace tool such as Microsoft Teams; the usual gap is bank, agency and frontline staff with no account, and parents, families and service users outside the organisation. Two scope points belong in the WhatsApp policy itself. First, joining a work group is voluntary, and nothing essential is sent only there; the guide to WhatsApp and UK GDPR at work explains why an employer cannot realistically require staff to use a personal account. Second, the consumer app was not built for organisations. WhatsApp's Terms of Service, under which WhatsApp LLC provides the service to users in the UK (effective date 4 January 2021), say users will not use the service in ways that “involve any non-personal use of our Services unless otherwise authorized by us”. Whether a staff group is non-personal use is for WhatsApp to decide, but an organisation that runs its official groups on the consumer app is relying on a service whose terms restrict exactly that.

The conduct clauses: what staff may post in a work group

The conduct clause sets one standard: a message in a work group or to a colleague is held to the same professional rules as something said in the workplace face to face. It gives examples, because the Commission asks a policy to “provide clear examples to illustrate each definition of the different forms of harassment, which are relevant to the employer's working environment” (paragraph 4.18). Its list of unwanted conduct includes “written words”, “banter”, “posts or contact on social media” and “imagery” (paragraph 1.8), and its examples of conduct of a sexual nature include “sexual comments or jokes” and “sending sexually explicit emails or text messages” (paragraph 1.20). It also lists “social media contact between workers” and “out of hours working” among the factors a harassment risk assessment may consider (paragraph 4.10).

The clauses, in the order most policies need them:

1. The standard. Messages in work groups and between colleagues follow the code of conduct and the bullying and harassment policy, on any device and at any hour.
2. Harassment and discriminatory content. No comments, jokes, images, GIFs or forwarded posts that relate to a protected characteristic or are sexual in nature and that a colleague could reasonably find hostile, degrading, humiliating or offensive. Say plainly that intention is not the test: under section 26 the effect counts, and the recipient's perception is part of it.
3. Bullying. No mocking, piling in or deliberately leaving a colleague out of a group the team uses for work. If bullying sits in the same policy as harassment, the Commission says to “distinguish between bullying and harassment” (paragraph 4.18).
4. Confidentiality. No names, photographs or details of pupils, children, residents or service users in any group or private chat the organisation does not control: they are personal data, held on phones the organisation cannot manage. The sector rules are in the guides to staff WhatsApp groups in schools (KCSIE and the route to the DSL), care home staff WhatsApp groups (residents' information and CQC), a nursery's social media policy and volunteer WhatsApp groups.
5. Concerns go through the proper route. A safeguarding concern, an incident or a complaint goes through the organisation's own reporting route the same day, even if it was first mentioned in a group; a message in a group chat is not a report, and the policy says what to do if one has already been posted.
6. Voluntary membership. Nobody is penalised for not joining, leaving or muting a group, and anything essential also goes through the official channel.
7. Hours. No expectation of a reply outside working hours, and a separate route for something urgent; the right to disconnect policy guide covers the wording.
8. Consequences. A breach may lead to disciplinary action. The Commission asks a policy to say that harassment may lead to disciplinary action “up to and including dismissal” if it is committed “in a work situation”, at a work-related event such as a social event with colleagues, or “against a colleague or other person connected to the employer outside of a work situation, including on social media” (paragraph 4.18).

Then tie it in. The Commission asks: “Do the examples of misconduct and gross misconduct in the disciplinary policy match or cross reference the anti-harassment policy?” (paragraph 4.21). The WhatsApp policy names the bullying and harassment policy, the disciplinary procedure and the grievance procedure, and the disciplinary procedure lists harassment by message among its examples of misconduct. How messages are used fairly once a case begins is in the guide to WhatsApp messages in a disciplinary hearing.

Two cases from the register of WhatsApp tribunal and regulator cases show why intention is not the test. In October 2025 an employment tribunal upheld a race harassment complaint over a photograph a senior colleague posted to a council leadership team's WhatsApp group, in which the claimant was the only Black member, while finding that the sender “did not set out to offend”; the later remedy judgment awarded £3,750 for injury to feelings plus interest, covering both complaints upheld (Employment Tribunal judgment 3308103/2023). In July 2025 the Employment Appeal Tribunal considered a colleague who had posted, without explanation, a beer advert depicting a utopia of white blond people to a small work group that included a Black British employee; it held the tribunal's finding of no connection with race perverse and sent the question of effect back (Employment Appeal Tribunal judgment [2025] EAT 95).

Reporting, admins and harassment by parents, families and service users

A policy that forbids harassment but gives no way to report it is a weak reasonable step. The Commission asks for “an effective procedure for receiving and responding to complaints of harassment and sexual harassment” (paragraph 4.18). For WhatsApp, the reporting clause says:

1. Who to tell. A named role and an alternative, so nobody has to report to the person they are complaining about.
2. How. A screenshot showing the message, the sender, the group and the date and time, sent to that person. Mentioning it in the group is not a report.
3. What happens next. The person handling it acknowledges the report, keeps a copy in the organisation's own case record, deals with it under the bullying and harassment or disciplinary procedure, and tells the person who reported it what will happen.
4. No detriment. Nobody suffers for a report made in good faith. The Commission found that policies “often overemphasise malicious complaints”, and says a policy should make clear that “workers will only face disciplinary action if it is found both that the allegation is false and made in bad faith” (paragraph 4.20).
5. Admins and leavers. Who may create a work group, who is its admin, who removes leavers on their last day and who closes the group when its purpose ends. No regulator prescribes admin rules; the guide to WhatsApp group admin responsibilities sets out what an admin can and cannot do, and what to note at handover.

The third-party clause is the one most WhatsApp policies lack, and from 30 October 2026 it matters wherever parents, relatives, residents or service users have staff's personal numbers or share a group with them. Acas's guidance on the harassment law changes (last updated 26 August 2026) says “A third party could be anyone a worker is in contact with through work”, including “service users, for example, school students or healthcare patients”, and that “A third party could harass someone online or in-person.” A parent's abusive messages to a teacher, a relative's messages to a carer at midnight and a service user's messages to a charity's support worker are the WhatsApp versions.

Acas lists steps an employer could take. They are examples, not a statutory list:

• “regularly assessing risks for third-party harassment and taking action to avoid or reduce those risks”
• “monitoring and recording incidents and actions taken”
• “having a policy that sets out how to deal with third party harassment, for example a bullying and harassment policy”
• “training workers, for example in staff safety and de-escalation”
• “telling customers the consequences of harassing workers, for example on posters or in emails”

In a WhatsApp policy that becomes four lines: staff are not expected to give parents, families or service users their personal numbers or add them to staff groups; contact with them goes through a route the organisation runs; harassment by a third party is reported in the same way as harassment by a colleague; and the organisation's own messages to parents, families or service users say what happens if staff are harassed. Acas adds: “It is a good idea to record why you have not taken steps you've decided are not reasonable.”

The Commission's technical guidance was written before the third-party duty, and still says an individual “cannot bring a claim for third party harassment alone”, which the 2025 Act changes from 30 October 2026. Its outline of a third-party clause still fits: that third-party harassment “will not be tolerated”, “that workers are encouraged to report it”, and what steps will be taken to prevent it and to remedy a complaint (paragraph 4.18).

What the employer will read, and making the policy count

The policy also says what the employer will look at, because the ICO (since 30 September 2026 the Information Commission) sets conditions before an employer reads staff messages. Its guidance Monitoring workers: specific data protection considerations for different methods, now marked under review after the Data (Use and Access) Act 2025, says: “If you are considering monitoring emails and messages, you must complete a DPIA”, and “You must not access content unless there you have a clear policy in place explaining the circumstances where such monitoring may take place.” A worker's own WhatsApp account on a personal phone is not a system the employer controls, so the honest clause says the employer does not ask to see personal phones as a matter of routine: it acts on messages reported to it, and checks its own channels only as its policy describes. The full rules are in the guide to monitoring staff communications.

Then make the policy a step a tribunal would recognise. The Commission's examples set the bar: an employer with a harassment policy, but no induction or training to make staff follow it, was still liable (paragraph 3.52); training that “was very brief and took place two years ago”, with managers who then took no action on a complaint, left another employer “unlikely to have met the reasonable steps defence” (paragraph 3.56).

• Tell everyone. At induction, with a copy, and again when it changes. The Commission suggests staff meetings, noticeboards and “an annual reminder to staff” (paragraph 4.26), and says policies should be available to workers “who do not have access to the internal IT systems” (paragraph 4.23) – bank and agency staff, volunteers and frontline staff without a work account.
• Train managers and admins on what harassment by message looks like and what to do when someone sends them a screenshot.
• Consult recognised trade unions or, where there are none, other worker representatives (paragraph 4.17), and the people who run the current groups.
• Review it at a fixed interval and after an incident. The Commission asks for “a commitment to review it at regular intervals and to monitor its effectiveness” (paragraph 4.19), and says an improvement made after one incident helps an employer show preventative steps for the next (paragraph 3.54).
• Keep the evidence of each step: the version issued, who received it, the training dates and the reports dealt with.

The rules, the report and the response: what the employer can show

The reasonable-steps defence, and from 30 October 2026 the third-party duty, are argued from evidence. When a complaint about a staff group reaches a tribunal, the employer has to show what it did before the harassment – the policy issued, the training given, the reminders sent – and what it did once the harassment was reported. Most of the first half sits in HR records. The conduct itself, and often the report and the manager's first reply, sit in a WhatsApp group on the phones of the people in it.

In a staff-run group the organisation holds none of that. WhatsApp is end-to-end encrypted, so the organisation cannot see the messages or keep a copy, and when a member leaves or changes phone, their copy goes with them. In one case in the register, a care agency's director had deleted an employee's WhatsApp messages from his phone around the time he dismissed her, and her surviving screenshots showed no warnings had been given; her sexual harassment claims succeeded (Employment Tribunal judgment 3312293/2022).

ComplyChat is designed to keep work conversations on the organisation's record. Staff, and the parents, families or volunteers an organisation chooses to add, talk in channels it controls; a mobile number verified by SMS is the identity, so bank staff, volunteers and families need no account on the organisation's systems; and everyone added is told the channel is on the record and can object or leave. Messages are recorded on the server as they are sent, and on paid plans, once the organisation's Microsoft 365 tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. ComplyChat does not connect to or record WhatsApp, it is not an HR case system, and it does not write, issue or enforce the policy. A small team whose groups carry nothing it may ever need to produce may not need it.

A question for the next leadership meeting: if a complaint about a staff WhatsApp group arrived tomorrow, what could we show about the rules, the report and the response?

Questions people ask

Is an employer responsible for what staff post in a work WhatsApp group?

Often, yes. Under section 109 of the Equality Act 2010, anything an employee does in the course of employment is treated as done by the employer, whether or not the employer knew or approved. The employer's defence is to show it took all reasonable steps to prevent it, and a written policy that staff know, are trained on and see enforced is usually the first of those steps.

Can harassment happen in a WhatsApp group?

Yes. Harassment under section 26 of the Equality Act 2010 is unwanted conduct related to a protected characteristic, or of a sexual nature, that has the purpose or effect of violating someone's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment, and a message, image or joke posted in a group can meet that test. In 2025 an employment tribunal upheld a race harassment claim over a photograph posted to a council leadership team's WhatsApp group, although it found the sender “did not set out to offend”.

What changes for employers on 30 October 2026?

From 30 October 2026, under sections 20 to 22 of the Employment Rights Act 2025 (commenced by S.I. 2026/1065), employers must take “all reasonable steps”, not just reasonable steps, to prevent sexual harassment of their employees, and must not permit third parties such as parents, service users or members of the public to harass their employees; an employer permits it if it failed to take all reasonable steps to prevent it. The sexual harassment duty is enforced by the Equality and Human Rights Commission and through a compensation uplift of up to 25% on a successful sexual harassment claim, while the third-party duty is one an employee can bring to an employment tribunal.

Can my employer read my WhatsApp messages?

An employer that monitors workers' messages must be clear about its purpose, tell workers in advance and complete a DPIA, and the ICO says it “must not access content unless” a clear policy explains when such monitoring may take place. A worker's own WhatsApp account on a personal phone is not a system the employer controls; in practice an employer sees messages from it when someone reports them or chooses to share them.

What are the policies for managing group admins on WhatsApp?

No regulator prescribes rules for WhatsApp admins, so the organisation's own policy sets them: who may create a work group, who is its admin, who removes leavers and agency staff on their last day, and who closes the group when its purpose ends. The guide to WhatsApp group admin responsibilities covers what an admin can and cannot do.

Official guidance and your next step

The law is in section 109, section 26, section 40A and section 124A of the Equality Act 2010, and sections 20 and 21 of the Employment Rights Act 2025, commenced on 30 October 2026 by S.I. 2026/1065; legislation.gov.uk had not yet applied those amendments to the Equality Act text in late October 2026. Acas's harassment law changes guidance and the Department for Business and Trade's timeline explain the changes. The Equality and Human Rights Commission's technical guidance is the fullest account of reasonable steps, but it predates the 2025 Act and the Commission is updating it. The ICO's guidance on monitoring messages covers what an employer may read, and WhatsApp's Terms of Service set the personal-use limit. Quotations are from those pages as read in October 2026.

This guide covers England, Wales and Scotland and is not legal advice. For a dispute already under way, take employment law advice.

Then do one thing: open your current bullying and harassment policy and search it for WhatsApp, for messages and for third parties. Whichever of the three is missing is the clause to write first.