Last updated: 25 September 2026
TL;DR: Many practices run on a staff WhatsApp group. It is fine for quick, general coordination, but client details, clinical photos and HR matters do not belong in it. The ICO reprimanded an NHS board after staff shared patient details in an unapproved group, and messages used for work can fall within a subject access request. Set simple rules and move rota changes into a proper system.
It is 10.40pm. Someone asks who can cover Saturday. Someone else replies with a photo of a patient’s blood results, the owner’s surname visible in the corner. A third person posts a long message about a colleague who left early. Every one of those messages in the WhatsApp group is sitting on the personal phones of twenty people, including the nurse who resigned last month.
Because it is fast, free and already on everyone’s phone. A staff WhatsApp group fills the gaps between shifts, sites and people who never share a break. The app itself is rarely the trouble. What causes problems is the slow drift from parking notices and thank yous into rota changes, client details and disagreements that belong somewhere else.
That drift happens because the WhatsApp group is the easiest route for everything. If the rota lives in a spreadsheet only one person can edit, and incident reports need a form nobody can find, the group chat becomes the practice’s real system by default.
So the fix is partly rules and partly systems. Give rota changes, leave requests and incident reports a proper home, and the WhatsApp group returns to being what it does well: quick, friendly, general coordination. Our guide to employee self service shows where each type of request should live.
The main risk is personal data ending up somewhere the practice does not control: client names, phone numbers and addresses, photos of records or patients with identifying details, and information about colleagues’ health. Once posted, it sits on every member’s personal phone, including people who later leave, and the practice cannot easily delete it.
A health sector case shows how this unfolds. In a reprimand issued to NHS Lanarkshire, the ICO found that a team’s WhatsApp group, which 26 staff had access to, contained at least 533 entries including patient names between April 2020 and April 2022. At least 215 entries included phone numbers, and images, videos and screenshots with clinical information were shared.
The reprimand also records that someone was added to the group in error, leading to an inappropriate disclosure, that the app had not been approved for sharing patient data, and that no risk assessment was in place. The ICO considered the organisation’s policies should have been more specific.
A veterinary practice holds client personal data of the same everyday kind: names, addresses, phone numbers and payment histories. The lesson transfers directly, as our guides to GDPR and staff records and handling a data breach explain.
They can be. ICO guidance for employers says that if a business uses platforms such as WhatsApp for business purposes, it is the controller for the information processed there, and messages about a person, including posts supplied by others, may be in scope when that person asks for their data.
The ICO subject access request questions and answers for employers gives a pointed example: a worker supplying copies of posts a colleague made criticising their manager in a WhatsApp group. Those posts should be considered as potentially in scope.
The ICO guidance on finding information for a request adds that it is not usually appropriate for staff to hold information about customers, contacts or other employees in private instant messaging applications, and that employers should have a policy making that clear. Where there is good reason to think they do, staff should be asked to search.
In plain terms, anything said about a colleague in the WhatsApp group may one day be read by that colleague. Our guide to the subject access request covers the process and deadlines.
Keep out anything that identifies a client, anything about a colleague’s health or conduct, and anything that needs a record. The test is simple: if the message would be a problem read aloud at a tribunal, forwarded to a client, or seen by someone who left last month, it does not belong in the group.
That last item matters for safety as well as privacy. An incident mentioned in passing in a WhatsApp group is easily missed. A report through a proper route, such as our See It Report It system, is.
Is your group chat quietly running the rota? A free 30-minute HR health check will show what to move into proper systems. Book your HR health check.
Use the WhatsApp group to ask, and the rota system to confirm. A call for Saturday cover in the chat is fine. The agreed change should then be made in the rota itself, with who requested it, who approved it and when. A thumbs-up emoji buried under forty messages is not a rota record.
Who asked for a change is about to matter more. Under the new rights for zero-hours and similar workers expected in 2027, short notice payments apply to changes the employer initiates, while swaps workers arrange between themselves are excluded. Our guide to shift cancellation explains why that record needs to be clear.
Swaps agreed in the WhatsApp group still need a check for skill mix and rest between shifts before they are confirmed, as our guide to shift swaps sets out.
Set expectations rather than hoping people ignore their phones. Staff on a day off or between shifts should not feel they have to read or reply. If the practice genuinely needs someone out of hours, use a phone call to the person on call rather than a message to twenty people.
A simple quiet hours rule helps: nothing non-urgent is posted in the WhatsApp group after a set time in the evening or on days off, and anything urgent is phoned through instead. The rule protects rest and removes the pressure to watch a phone all evening.
The same goes for updates from managers. Post a short pointer in the chat, and put the detail of a rota change or a new policy in the system where it will be kept and can be found again next month.
Tone matters too. A sharp message sent at midnight reads worse in the morning, and behaviour in a work group is still behaviour at work. Our guides to bullying at work and a social media policy cover where the lines sit.
A WhatsApp group policy fits on one page. It should say what the group is for, what never goes in it, how rota changes and incidents are handled instead, when not to post, who manages membership, and what to do if something is posted by mistake.
Membership is an easy rule to skip. The ICO case above involved someone added to a group in error, and a leaver who stays in the WhatsApp group keeps receiving every message the team sends.
Yes, for general coordination, provided the practice sets clear rules and keeps personal data out. If it is used for business purposes, ICO guidance says the practice is the controller for the information processed there, so it needs managing like any other work tool.
Yes, on their last day, as part of the leaver checklist. Anyone who stays in the group keeps receiving practice information they no longer need, and a named admin makes sure it actually happens.
They can. ICO guidance for employers treats information in a messaging group used for business purposes as potentially in scope, including posts about the person that others supply. Assume anything written about a colleague could be disclosed to them.
Ask for the message to be deleted, tell the person responsible for data protection, and treat it as a possible personal data breach under your breach procedure, recording what happened and what was done even if it turns out not to be reportable.
They should not be expected to. Set quiet hours, make clear the group is not the route for anything urgent, and phone the person on call when something genuinely cannot wait.
The staff group chat is not going away, and it does not need to. Give it a clear purpose, keep client and colleague details out, move rota changes and incidents into systems that keep a record, and remove leavers on their last day.
Our rota system gives shift changes a proper home with a record of who asked, and a free HR health check will show what your group chat is currently doing that it should not be.
The Vet HR Team provides HR consultancy and white-labelled staff systems exclusively to UK veterinary practices. This guide is general information, not legal advice.
Contracts, rotas, holiday, a difficult conversation. Tell us what you are dealing with and we will come back within one working day. Nothing to sign up to.
Got it. We will come back to you within one working day. If you do not see a reply, please check your spam folder.
