Guide · Data protection

WhatsApp and the ICO: what regulators have found

The ICO has reprimanded UK organisations over WhatsApp groups – NHS Lanarkshire in 2023, after staff shared patient data in one for two years, and Dover Harbour Board in 2024, where it considered a £500,000 penalty – but it has never said the app itself is unlawful.

By ComplyChatPublished 28 October 202614 minute read

ComplyChat is compliant team messaging for schools, charities and care. Everyone joins with a UK mobile number – no IT account and nothing to install – and paid plans meet your retention schedules within your own Microsoft 365 subscription. See how it works

What it finds, case after case, is an organisation that let work happen on WhatsApp without approving it, assessing the risk, setting rules or keeping a record. This page sets out the leading UK cases, each read at its source, from the ICO, the information tribunals, the sector regulators and the employment tribunals, and says what each one means for a school, a nursery, a care provider or a charity; our case register lists every case we have verified.

Does the ICO allow WhatsApp at work?

The ICO has not banned WhatsApp at work, and none of the cases below says the app is unlawful: what the ICO enforces is the duty in UK GDPR to keep personal data secure and to build protection into the way it is handled, wherever the work happens. The NHS Lanarkshire reprimand cites Article 5(1)(f), which requires personal data to be processed with "appropriate security", Article 32(1), which requires security measures appropriate to the risk, and Article 25(1), data protection by design.

For a public authority, a second duty applies. Messages about its business, even on a personal phone, are very likely to be information it holds under the Freedom of Information Act 2000, and the ICO's guidance on official information held in non-corporate communications channels expects them to be found when a request arrives.

A note on names: on 30 September 2026 the Information Commission took over from the Information Commissioner as the regulator, still known as the ICO. Every ICO reprimand and decision notice below was issued by the Information Commissioner; the other cases were decided by tribunals and other regulators.

The ICO's reprimands

A reprimand is the ICO's formal published finding that an organisation broke data protection law. It carries no fine. Each of these is published in full on the ICO's website.

NHS Lanarkshire, 31 July 2023

A team created a WhatsApp group at the start of the pandemic, to which 26 staff had access. Between April 2020 and April 2022 it held at least 533 entries with patient names, adults' and children's, as well as images, videos and screenshots with clinical information, and someone was added to the group in error, resulting in an inappropriate disclosure of personal data to an unauthorised individual. The ICO's reprimand of NHS Lanarkshire found breaches of Articles 5(1)(f), 25(1) and 32(1): WhatsApp had been made available on the board's devices without a formally approved process, a data protection impact assessment or a risk assessment, it was not approved for patient data, and policies did not clearly mention messaging apps.

In the ICO's words: "information governance expectations regarding WhatsApp were not understood by staff involved in the WhatsApp Group."

For a school, nursery, charity or care home: the group was set up for a good reason, in a hurry, by people doing their jobs. The finding was about the organisation that let it run without approval, rules or a risk assessment.

Dover Harbour Board (Port of Dover Police), 5 March 2024

An officer set up an intelligence-sharing group on his personal phone, first on WhatsApp and then on Telegram, to tackle vehicle crime; by the time of the ICO's investigation it had 241 members from several UK police forces and international agencies, and it ran with no risk assessment, terms of reference, oversight or process for removing people who left. The ICO's reprimand of Dover Harbour Board, dated 5 March 2024 and published ten days later, found breaches of sections 35(1) and 40 of the Data Protection Act 2018, and records that the ICO "considered notifying Dover Harbour Board of its intention to impose an administrative penalty in the amount of £500,000" before deciding on a reprimand under its approach to the public sector.

The lesson: a group on one person's phone, with no leaver process, is the organisation's responsibility once it carries the organisation's work. A charity or school is not a police force, but the missing pieces – terms of reference, an owner, removing leavers – are the same ones.

Kent Police, 5 March 2024

In February 2021 a Kent officer photographed a person's identity document on her personal phone and uploaded it to the same Telegram group, of which 25 Kent officers were members. The force reported the matter itself. The ICO's reprimand of Kent Police found a breach of section 40 of the Data Protection Act 2018, and treated it as the organisation's failure, not one officer's: "the ICO considers this to be evidence of an organisational failure to adequately inform officers that such use was not acceptable."

The lesson: when many staff use personal phones and outside groups for work data, the regulator treats it as the organisation's failure to tell them clearly not to. A photograph of a resident's medication chart or a pupil's injury, posted to a group, is the same kind of processing.

Department of Health and Social Care, July 2022

A year-long ICO investigation into ministers' and officials' use of private messaging during the pandemic found that the department had identified 29 private WhatsApp accounts, 17 private text accounts and eight private email accounts used for official information. The ICO's report to Parliament, Behind the screens, found that the department "did not have appropriate organisational or technical controls in place to ensure effective security and risk management of such channels", and was accompanied by a reprimand under UK GDPR and the Data Protection Act 2018 and a practice recommendation under the Freedom of Information Act.

The lesson: the controls the ICO looked for are the ones a small organisation can put in place too – which channels are approved, for what, and how business reaches the record.

Freedom of information: the messages are held

For public authorities – academy trusts, maintained schools and maintained nursery schools, councils, NHS bodies, parish councils – the cases about WhatsApp mostly come through freedom of information. The pattern is consistent: the authority said the messages were not held – because they were on personal phones, had not been kept or were not its business – and in four of the five cases below the regulator or tribunal disagreed. Our guide to FOI requests and WhatsApp messages covers what to do when a request arrives.

Wanborough Parish Council, December 2024. A requester asked for messages sent in a parish council WhatsApp group, and the council said they did not relate to its business. The council's own review accepted the group was used to flag issues, share updates and arrange meetings, and the ICO's decision notice found that "the requested information is held by the Parish Council for the purposes of FOIA" and required a fresh response. The smallest public authorities are not exempt from this.
Department of Health and Social Care, First-tier Tribunal, July 2024. The ICO had accepted the department's position that it did not hold a former minister's WhatsApp messages because they had not been transferred to its official record. In [2024] UKFTT 581 (GRC), decided on 5 July 2024, the tribunal held that this failed to consider whether the messages were held on the department's behalf under section 3(2)(b), that not transferring them was irrelevant to that question, and substituted a notice that the department holds the information.
Cabinet Office, First-tier Tribunal, April 2025. The Cabinet Office searched its own systems for messages between two senior advisers but did not contact the advisers, who had left and whom it knew used WhatsApp on personal devices. In [2025] UKFTT 391 (GRC) the tribunal found it "has not carried out sufficient searches" and ordered it to ask them. Leavers' phones are within the search.
Department for Business and Trade, January 2026. WhatsApp messages between officials had been set to disappear after seven days under a private office policy. The ICO's decision notice accepted that the department "does not hold the requested WhatsApp messages, as they were set to be deleted after seven days", but found it had breached its duty to advise and assist by not mentioning a related note it did hold. Disappearing messages meant there was nothing to disclose; they did not end the authority's duties.
Scottish Ministers, March 2024. Ministers said they held no WhatsApp or text messages on government business for two months of 2021, then disclosed some during the investigation. The Scottish Information Commissioner's Decision 045/2024 found the authority "had breached FOISA by informing the Applicant that it did not hold any relevant information".

Schools, care and charities: what the sector cases show

The ICO's cases are mostly about public bodies. The incidents that look most like a school's, a nursery's, a care provider's or a charity's own come from the sector regulators, safeguarding reviews and employment tribunals. We describe schools, providers and charities by type, not by name, and never name the people involved; every source is linked. Our WhatsApp case register lists every case we have verified.

Schools

Concerns shared in a chat are not a referral. A North Wales Safeguarding Board extended child practice review, presented to the Board in July 2025, examined how a secondary school head teacher in Gwynedd was able to abuse pupils. It found that senior leaders had shared concerns about him among themselves in WhatsApp and other messages, in 2020 and again in 2023, without making a referral, and called each occasion a missed opportunity: "No referral to LA1 C&FS was made".

A private staff group is not outside professional regulation. In two linked Teaching Regulation Agency decisions, a teacher misconduct decision of June 2024 and a teacher misconduct decision of November 2024, teachers in WhatsApp chats with male colleagues that objectified and denigrated female colleagues and abused a parent of the school were banned from teaching. In the second, the panel "concluded that the misconduct took place within the education setting", because the messages concerned school.

Messaging pupils. In a decision of March 2025, a drama teacher's over-familiar WhatsApp messages and emails with two pupils, late at night, at weekends and in the holidays, were found to be unacceptable professional conduct; no ban followed, but the finding was published.

Dismissal for group messages. An Employment Tribunal judgment of March 2018 upheld an academy trust's dismissal of a deputy head for homophobic comments in a WhatsApp group of teachers, finding he had "no reasonable expectation that the postings were or would remain private".

The rule schools work to. Keeping children safe in education 2026, in force from 1 September 2026, says a school's staff behaviour policy should cover "acceptable use of technologies (including the use of mobile devices), staff/pupil relationships and communications including the use of social media".

Care

Care arranged in a group must still reach the care record. A CQC inspection report of May 2019 on a domiciliary care agency in Rochdale found that it arranged visits and tasks through WhatsApp groups, with consent, but did not carry what happened there into care files. CQC found a breach of Regulation 17(1), good governance, saying the groups "had distracted the provider from meeting the requirement to maintain accurate, complete and contemporaneous records". It found no harm to people, and the groups helped communication; the finding was about the record.

A handover by chat that leaves out the risk. In a Safeguarding Adults Review published by Luton Safeguarding Adults Board in 2025, a woman in supported housing took her own life after telling police she wanted to. Her message was passed to night staff "over WhatsApp and at handover", but they were not told of her threats to end her life; the review found poor handovers across agencies.

A team group the managers knew about. An Employment Tribunal judgment of January 2024 against Blackpool Council, whose client finance team managed money for people who lack the capacity to do so themselves, upheld a harassment claim in part over messages in a team WhatsApp group set up in lockdown, finding the group "an important facet of the working life of the team" and that managers were aware of it. The tribunal said setting up the group had been reasonable; the problem was what it became and how the complaint was handled.

Phones in the room. A serious case review published by Cumbria Safeguarding Adults Board in 2016, after three care workers at a specialist dementia nursing home were convicted of ill-treatment and neglect, found they "were sending many thousands of texts, receiving texts and taking photographs when they should have been providing care", despite a policy banning staff phones.

Charities

We found no Charity Commission inquiry report or official warning that turns on WhatsApp. The Commission's guidance on charity meetings (CC48), last updated in July 2024, tells trustees: "Check if your governing document allows you to carry out charity business in other ways, for example by telephone, email, or on messaging apps." Our guide to the trustees' WhatsApp group sets out what that means for decisions.

On a sunny morning, a visiting inspector with a notebook walks the garden path of a care home with the registered manager, who points towards a ground-floor window

WhatsApp's own GDPR fines

The largest fines involving WhatsApp were imposed on the company, not on anyone using it, and they were about how WhatsApp explains its own processing. Because WhatsApp's European business is based in Dublin, its lead regulator under the EU GDPR is Ireland's Data Protection Commission.

€225 million, decided 20 August 2021, announced 2 September 2021. After a binding decision of the European Data Protection Board (EDPB) requiring a higher fine, the Data Protection Commission fined WhatsApp Ireland €225 million for failing to meet the GDPR's transparency obligations to users and non-users, including about sharing data with other Facebook companies, issued a reprimand and ordered it to bring its processing into compliance.
€5.5 million, decided 12 January 2023, announced 19 January 2023. Adopting a binding determination of the EDPB, the Commission, announcing the conclusion of its WhatsApp inquiry, found that WhatsApp Ireland "is not entitled to rely on the contract legal basis" for processing for service improvement and security purposes, and fined it €5.5 million.

The Commission's own register of fines lists both as pending appeal. Neither decision says anything about whether a UK school, charity or care provider may use WhatsApp. The UK cases on this page do, and every one of them concerns the organisation's own controls.

What every case has in common

Read together, the cases make the same point from different directions. None of the organisations chose WhatsApp as a records system. It arrived because it was quick, everyone already had it, and the work needed doing. The findings came later, and they are always about the same four things:

No decision. Nobody approved the channel, assessed the risk or wrote down what it was for – NHS Lanarkshire, Dover.
No owner and no leaver process. The group lived on one person's phone, and people who left stayed in it or took the messages with them – Dover, the Cabinet Office.
No record. The organisation's business was in the messages, but the organisation could not find, search or produce them – the Department of Health and Social Care, the Scottish Ministers.
Deletion by default. Disappearing messages left nothing to disclose, and the regulator still found a breach of the duty to advise and assist, because the authority had not mentioned a related note it did hold – the Department for Business and Trade.

A policy fixes the first two. It cannot fix the third, because the record of a WhatsApp conversation sits on members' handsets, and the organisation can see only what members choose to hand over. That is the gap ComplyChat was built for: a channel the organisation owns, which staff, volunteers and families can use as easily as a group chat, where the conversation is the organisation's record as it is sent and, on paid plans, meets your retention schedules within your own Microsoft 365 subscription once your tenant is connected. Everyone added is told it is on the record.

The question to take to the next leadership or board meeting: if one of our groups became the subject of a complaint, a request or an inspection tomorrow, could we produce it?

Questions people ask

Has the ICO fined anyone for using WhatsApp?

We found no published ICO fine of a UK organisation for staff use of WhatsApp; the published cases end in reprimands. In the Dover Harbour Board case, the ICO recorded that it had considered a £500,000 penalty before issuing a reprimand under its approach to the public sector.

Does the ICO allow WhatsApp?

The ICO does not prohibit WhatsApp; it requires any channel used for personal data to be secure and properly controlled under UK GDPR. Its reprimand of NHS Lanarkshire turned on the absence of approval, a data protection impact assessment, a risk assessment and clear policy, not on the app.

Why was WhatsApp fined €225 million?

Ireland's Data Protection Commission fined WhatsApp Ireland €225 million in a decision announced in September 2021 for failing to meet the GDPR's transparency obligations, including how it explained data sharing with other Facebook companies to users and non-users. The fine was imposed on the company, not on organisations that use the app, and the Commission's register lists it as pending appeal.

Can WhatsApp group messages be requested under FOI?

WhatsApp group messages about a public authority's business can be requested under FOI. In December 2024 the ICO decided that messages in a parish council's WhatsApp group were held by the council for the purposes of FOIA, and in 2024 a tribunal held that a department held a former minister's WhatsApp messages from his personal device.

Where are ICO reprimands published?

The ICO publishes reprimands, fines and enforcement notices on the enforcement pages of its website, and its freedom of information decision notices in a separate searchable list. Tribunal decisions on FOI appeals are published by the National Archives' Find Case Law service.

Where to read the official guidance

The ICO's enforcement action pages list every reprimand and fine, and its guidance on official information held in non-corporate communications channels sets out what a public authority should do about WhatsApp before and after a request. Central government's own rules are in the Cabinet Office's guidance on using non-corporate communication channels for government business, the clearest published model for a workplace policy.

This page summarises published decisions as they were issued and is not legal advice. Decisions can be appealed; check the source before relying on one, and take advice on a live matter.

Why we publish this

ComplyChat exists because of the pattern in section 06. It gives work conversations a channel your organisation owns, on the record from the first message and, on paid plans, meeting your retention schedules within your own Microsoft 365 subscription once your tenant is connected. There is no WhatsApp, Signal or Meta anything in the path, and we cannot see a personal phone or reach a conversation that has already happened.

How it works · Why us · Pricing · FAQ