Does UK GDPR really apply to a WhatsApp group?

Yes, if the group is used for the business and it holds personal data — which a job group does the moment a customer’s name, address or phone number goes in it. The law doesn’t care that it’s an app on a phone rather than a filing cabinet. You’re the controller of that data, and your staff are processing it on your behalf.

Is a photo of a job personal data?

A photo of a boiler, a roof or a trench isn’t. A photo that identifies a person — a face, a car registration, a house number with the street visible, a kitchen with the family’s post on the side — is. The test is whether a living person can be identified from it, on its own or with other information you hold.

Can I put job photos on Facebook or Instagram?

With the customer’s agreement, yes, and get it in writing — one line on the quote or a text is fine. Without it, a photo of the front of someone’s house with the number visible is their personal data being published for your marketing, and you need a lawful basis you probably don’t have. Crop to the work, and ask.

What about the lad who left and still has the group on his phone?

This is the one nobody thinks about. Every job address, customer number and site photo from the last two years is on a device you no longer control. Remove leavers from every group on their last day, and keep groups per job rather than one firm-wide group that holds everything forever.

Can I use AI to summarise the group chat?

WhatsApp’s own Meta AI inside the group has been a worry for a lot of firms. Meta says it can only see messages that are sent to it or where it’s @-mentioned, not the whole group. Pasting the group into a separate AI tool is a different matter — that’s the same question as any customer data in ChatGPT: business account, training off, and keep the names and addresses out.

Do I need to mention WhatsApp in my privacy notice?

Your privacy notice should say what you do with customer data and who it goes to. If customer details are shared with your team by messaging app and photos of their property are taken and stored, say so in a sentence. Nobody reads it, but it’s the thing you point to when someone asks.

For the trades

WhatsApp groups, site photos
and the customer’s front door.

Every building firm I know runs on WhatsApp. Job group per project, the address pinned at the top, the key-safe code three messages down, photos of the kitchen before and after, the customer’s number so the lads can ring ahead. It works. It is also a customer database on eight personal phones with no password policy, and one of those phones belongs to someone who left in March. Here’s what the law says about that, and what to do.

A job WhatsApp group is personal data the moment a customer’s name, address or number goes in it, and UK GDPR applies to it like any other record. Photos of the work are fine; photos that identify a person or their home are personal data and need care, and a customer’s agreement before they go on social media. The biggest real-world risk is leavers and lost phones carrying two years of customer data. Groups per job, leavers removed on the day, codes and photos of people kept out — that’s most of it.

Mick Stevenson Forty years across trades, construction, property and plant hire before software. RPII-registered Operational Inspector. Builds and secures AI tools for Cornish trades.

Published 15 October 2026

The short answer

Nobody is going to tell you to stop using WhatsApp. It’s free, everyone has it, and it works on a roof. But a job group is a record of personal data — names, addresses, phone numbers, photos of people’s homes — and UK GDPR applies to it exactly as it would to a customer spreadsheet. You are responsible for who can see it, how long it hangs around, and what happens to it when someone leaves.

The fixes are habits, not software: one group per job, leavers out on the day, codes and photos of people kept out, and the customer asked before their house appears on your Facebook page.

What’s in a job group, and why it counts

Scroll back through a typical one and you’ll find:

The customer’s name, address and mobile — personal data, all three
The key-safe or alarm code — which, next to the address, is a security risk to the customer as well as a data-protection one
“She’s elderly, lives alone, leave the side door” — special-category data (health) and a safeguarding issue in one line
Photos of the inside of the house, the car on the drive, the kids’ names on the bedroom doors
The tenant’s number, on a landlord job — a second person who never agreed to anything
Staff phone numbers, who was on site when, and the odd comment about the customer you wouldn’t want them to read

UK GDPR asks three things of you about that data: have a reason to hold it, hold it securely, and don’t keep it longer than you need. A job group ticks the first. The second depends on eight people’s phone settings. The third is where almost every firm fails, because nobody ever deletes a group.

Site photos: the front door problem

Photos are the best evidence a trade has — what was there before, what the customer agreed to, what the snag looked like. Keep taking them. The question is what’s in the frame.

Not personal data

The roof. The boiler. The trench. The consumer unit. A wall. Anything where no person and no identifiable property can be made out. Take as many as you like, keep them as long as you like.

Personal data

A face. A number plate. The front of the house with the number and the street. The kitchen with post, photos or a school calendar visible. Anything a person can be identified from — on its own or alongside the address you also hold.

For the job file, crop to the work. For marketing — your website, Facebook, Instagram, the van wrap — get the customer’s agreement first and keep a record of it. One line on the quote (“we may photograph the completed work for our portfolio — tick if you’d rather we didn’t”) or a text reply is enough. A happy customer will almost always say yes. The one who says no has a reason, and it’s not your business what it is.

Never post a photo with someone in it who hasn’t agreed — including your own staff. And never post one that shows how to get into the property.

Leavers, lost phones and the two-year archive

This is the bit that actually goes wrong. A firm with one big “Team” group that’s been running since 2024 has every customer, every address, every code and every photo from that whole period on the phone of every person who has ever been in it — including the three who left, the subbie you fell out with, and the apprentice who lost his phone in Newquay on a Saturday night.

None of that is in your control, and under UK GDPR it’s your responsibility. The ICO’s position on staff using their own devices is that the business stays accountable for the data on them. You can’t wipe a leaver’s phone. What you can do is make sure there’s very little on it:

One group per job, not one group for the firm. A leaver walks away with the jobs they were on, not your whole customer list.
Remove leavers from every group on their last day — it takes two minutes and almost nobody does it.
Close the job group when the job is done. Export anything you need to keep, then delete it for everyone.
Phone lock on, and disappearing messages on for groups that carry codes.

AI inside the group chat

Two different things get mixed up here. The first is Meta AI, the assistant WhatsApp has built into the app. Meta’s position is that it can read only the messages people send to it directly or where it’s @-mentioned in a group — not the whole conversation, which stays end-to-end encrypted. If you’d rather not have it in a work group at all, don’t @-mention it and tell the team not to.

The second is someone copying the group into ChatGPT or Claude to “summarise where we are on the Trewin job”. That’s the customer-data-in-an-AI-tool question, with the same answer: business account, training off, and take the names, addresses and codes out before it goes in. A summary of “the job” needs none of them.

Five rules for a firm that runs on WhatsApp

01
One group per job. Closed and deleted when the job is.
02
Codes don’t go in the chat. Key-safe, alarm, gate: by phone call, or in whatever job system you use, never in a message that sits there for two years.
03
Photos show the work, not the people. Crop. No faces, no plates, no house numbers. Ask before anything goes public.
04
Leavers out on the day. Every group. Put it on the same list as handing back the van keys.
05
Nothing about the customer that you wouldn’t say to their face. They can ask for everything you hold about them, and a group export is everything.

Put those five on one side of A4, give it to everyone with a phone, and add a line to your privacy notice that says customer details and job photos are shared with your team by messaging app. That’s a WhatsApp-run firm that would be fine if anyone ever asked.

Where this comes from

This is plain-English guidance for small businesses, not formal legal advice. Where something genuinely needs a solicitor or a data-protection specialist, I'll tell you straight.

Straight answers

Does UK GDPR really apply to a WhatsApp group?: Yes, if the group is used for the business and it holds personal data — which a job group does the moment a customer’s name, address or phone number goes in it. The law doesn’t care that it’s an app on a phone rather than a filing cabinet. You’re the controller of that data, and your staff are processing it on your behalf.
Is a photo of a job personal data?: A photo of a boiler, a roof or a trench isn’t. A photo that identifies a person — a face, a car registration, a house number with the street visible, a kitchen with the family’s post on the side — is. The test is whether a living person can be identified from it, on its own or with other information you hold.
Can I put job photos on Facebook or Instagram?: With the customer’s agreement, yes, and get it in writing — one line on the quote or a text is fine. Without it, a photo of the front of someone’s house with the number visible is their personal data being published for your marketing, and you need a lawful basis you probably don’t have. Crop to the work, and ask.
What about the lad who left and still has the group on his phone?: This is the one nobody thinks about. Every job address, customer number and site photo from the last two years is on a device you no longer control. Remove leavers from every group on their last day, and keep groups per job rather than one firm-wide group that holds everything forever.
Can I use AI to summarise the group chat?: WhatsApp’s own Meta AI inside the group has been a worry for a lot of firms. Meta says it can only see messages that are sent to it or where it’s @-mentioned, not the whole group. Pasting the group into a separate AI tool is a different matter — that’s the same question as any customer data in ChatGPT: business account, training off, and keep the names and addresses out.
Do I need to mention WhatsApp in my privacy notice?: Your privacy notice should say what you do with customer data and who it goes to. If customer details are shared with your team by messaging app and photos of their property are taken and stored, say so in a sentence. Nobody reads it, but it’s the thing you point to when someone asks.

Using ChatGPT for quotes and customer emails: what never goes in

Names and addresses, key-safe codes, photos of someone’s kitchen. What a trade can safely paste into an AI tool, what it can’t, and the ten-minute fix.

A one-page staff AI policy you can actually use

Free template. What staff may and may not put into AI tools, which tools are approved, who checks the output. Prevents most incidents before they happen.

Can AI write my RAMS and method statements?

It can draft them. It can’t make them site-specific, and it can’t be the competent person who signs. What to check before an AI-drafted RAMS goes to site.

Want your firm’s knowledge somewhere better than a group chat?

Kelvo gives your staff one place to ask about procedures, site rules and prices, answered only from what you’ve approved — with roles, so site staff see what site staff need. For Cornish contractors with staff.

Kelvo for contractors

WhatsApp groups, site photosand the customer’s front door.

On this page