WhatsApp is one of the most common questions we're asked about. Staff want to know whether they can use WhatsApp groups for school messages, and it's easy to see why: it's familiar, free and quick. But using a personal messaging app for school business brings real data protection, safeguarding and security risks. This article sets out those risks, what the ICO and WhatsApp itself say, and what schools and trusts should do instead.

Why it's a problem for school business

• No control over who's in the group. Anyone in a group can add people, including people who don't work at the school.
• Personal phone numbers are shared. Everyone in a group can see every member's mobile number. WhatsApp began rolling out usernames in June 2026, which will eventually let people chat without sharing their number, but until that is available and set up for everyone in a group, numbers stay visible.
• Leavers keep their access. Someone has to remember to remove staff when they leave, and nothing stops them keeping copies of what was shared.
• No user access control. The school can't manage roles, permissions or account security.
• Personal devices, school data. Messages, photos and documents sit on devices the school doesn't own or control.
• No access to the data. If information is needed for a subject access request, an HR investigation or a legal claim, the school may have no way to retrieve it.

What the ICO and WhatsApp say

In 2022, the ICO called for a review of the use of private email and messaging apps in government because of the lack of controls over official information.

In 2023, the ICO reprimanded NHS Lanarkshire after staff shared patient information in a WhatsApp group over two years, including names, addresses and clinical images. A non-staff member had also been added to the group by mistake. The ICO found there had been no assessment of the risks and no clear guidance for staff. The same could easily happen in a school staff group.

WhatsApp's own terms of service don't allow non-personal use of the app unless WhatsApp has authorised it. WhatsApp Business is designed for organisations to talk to their customers, not for internal staff communication.

Security and legal risks

• WhatsApp's messages are end-to-end encrypted, but that protects messages in transit, not what happens once they reach a phone that is lost, shared, unlocked or backed up to a personal account.
• In 2021, the Irish Data Protection Commission fined WhatsApp €225 million for failing to be transparent about how it uses people's data.
• Account takeover scams are common. A scammer, often posing as a friend or colleague, asks for the six-digit code WhatsApp sends by text, then uses it to take over the account and message all its contacts. Turning on two-step verification stops this.

What schools and trusts should do

• Use organisation-owned communication tools, such as those within Microsoft 365 or Google Workspace, with appropriate security to protect against hackers and cyber attacks.
• Assess the risks, with a DPIA where needed, before any new messaging app is approved, and give staff clear guidance on what can and can't be shared.
• Apply role-based user access controls. See our Information & Cyber Security best practice area and Info/Cyber Security Checklist.
• Make sure data is backed up and that you can access all of it to respond to subject access requests. This is far simpler when school communication stays on the organisation's own systems and devices.
• Monitor organisational systems so inappropriate use can be identified and dealt with.
• Don't use WhatsApp for formal communication, such as policies or official announcements, where it can cause confusion about what is authoritative.
• Never share confidential information about pupils, staff or governors, or images of children or their work, in a WhatsApp group on personal devices.

Social staff groups are a different matter, but staff should remember that the school's social media, conduct and data protection policies still apply. The education union Edapt has useful advice on staff WhatsApp groups in school.

Subject access requests and FOI

If staff use WhatsApp for school business, the messages don't stop being school information just because they sit on a personal phone. That creates real problems when someone asks for their information.

• They may be in scope of a SAR. Personal data about a pupil, parent or member of staff that is shared in a work WhatsApp group is processed for the school's purposes. If a parent or employee makes a subject access request, you may need to include it. The ICO's guidance for employers notes that staff's own messaging apps don't usually need searching, but that the position is more complicated where they have actually been used for work.
• You may need staff to search their own phones. The school can't search a personal device itself, so you would have to ask each member of the group to find, export and hand over relevant messages, and rely on them doing it fully. This is slow, hard to evidence and difficult within the one-month deadline.
• Messages may be gone, or may outlive your retention schedule. Disappearing messages, deleted chats and lost or replaced phones mean the information may no longer exist. Equally, messages can sit on phones long after your retention schedule says they should have been deleted.
• Deleting after a request is an offence. Once a SAR has been received, deliberately deleting or altering information to stop it being disclosed is a criminal offence under section 173 of the Data Protection Act 2018. Staff need to know this.
• FOI applies too. Maintained schools and academies are public authorities. The ICO's view is that information about the school's business is covered by the Freedom of Information Act even when it's held in a private messaging app or on a personal device, and the same applies to deleting information once a request has been made.

The simplest way to avoid all of this is to keep school business on school systems, where you can search, retain and delete information properly. Your acceptable use policy should say clearly that personal messaging apps must not be used for school business.

Pupils and parents

In April 2024, WhatsApp lowered its minimum age in the UK and EU from 16 to 13, so many secondary pupils will be using it. Parents and carers may find these guides helpful:

• Internet Matters: WhatsApp safety: a how-to guide for parents
• NSPCC: Chat apps and online safety

Reporting

If you have been the victim of fraud or cyber crime, report it to Report Fraud (which replaced Action Fraud in December 2025) on 0300 123 2040. If school or pupil information may have been exposed, tell your Data Protection Officer straight away.