The short answer
Using WhatsApp to manage tenant repairs isn't automatically unlawful, but it's genuinely risky under UK GDPR. The risk isn't the app itself, it's what ends up stored there without anyone deciding it should: tenant names, addresses, photos of their homes and a running history of complaints, on a personal phone that the agency doesn't control, can't properly secure, and often can't even see once a staff member leaves. This isn't legal advice, but the practical fix is straightforward: move the reporting and logging into a system the agency actually controls, and treat WhatsApp as something to retire from this job rather than police more carefully.
How WhatsApp became the repair system by accident
Nobody sits down and decides to run tenant data through WhatsApp. It happens one message at a time: a tenant texts a photo of a leak because it's quicker than calling, a staff member replies from their own phone because that's what's open, and within a few months a genuine, if informal, repair-reporting channel exists, running entirely on personal devices nobody set out to use this way. By the time anyone notices, there's a real history there: addresses, tenant names, photos inside people's homes, and a timeline of every repair and complaint for that property, scattered across however many staff members' phones have ever picked up a conversation.
What's risky under UK GDPR
A few things make this specifically risky rather than just untidy. Personal data (tenant names, addresses, photos of their homes) is being processed on a device the agency doesn't own and can't fully control, which makes it hard to demonstrate the kind of appropriate technical and organisational security UK GDPR expects. There's no clean way to respond to a subject access request, when a tenant asks what data you hold on them, because the answer may be sitting in a personal WhatsApp history that was never centrally recorded. And there's no real audit trail: no record of who saw what, when a message was read, or whether it was ever actioned, which matters if a dispute arises about whether a repair was properly reported. The ICO's guidance for organisations sets out the general principles, data minimisation, security and the right to erasure among them, that this kind of informal channel tends to sit awkwardly against. This isn't legal advice, and if you want certainty for your specific setup, it's worth a conversation with a data protection adviser.
When a staff member leaves
This is where the risk becomes concrete rather than theoretical. If maintenance conversations have been happening on a personal phone, a staff member leaving the agency takes that history with them, tenant details, property photos and all, with no practical way for the agency to retrieve or delete it from their device. Even where the intention is entirely innocent, the agency has lost control of data it was responsible for, and has no real mechanism to confirm it's been removed. Multiply this across however many staff have ever covered the out-of-hours phone, and the agency's actual exposure is considerably wider than anyone realises until someone asks the question directly.
Access control vs deletion
Two separate problems hide inside this one issue, and it's worth naming both. Access control is about who can see tenant data while they're still employed, and a shared personal WhatsApp group tends to give broader access than anyone intended, often including former tenants' details long after they've moved out, or a conversation about one property visible to staff who have no reason to see it. Deletion is about what happens afterwards: a proper system can remove or archive a record on request. A WhatsApp history on someone's personal phone generally can't be reliably deleted by the agency at all, only by the person holding the phone, which isn't a control the agency can rely on.
What to move to instead
The fix isn't a stricter WhatsApp policy, it's moving the job somewhere the agency actually controls. A simple online form for tenants to report a repair, with a photo attached, replaces the informal photo-by-text habit without losing the convenience that made WhatsApp appealing in the first place. Reports then land in one log that the agency owns, with access tied to the job rather than a personal device, and a proper trail of who saw what and when. This is the same groundwork that fixes maintenance admin eating your evenings more generally, logging requests consistently in one place rather than across scattered channels, so solving the GDPR risk and the admin problem tends to be one project, not two.
What fixing it costs
Replacing the WhatsApp habit with a proper reporting channel is usually scoped as a single automated workflow, a guide price from £350, covering a tenant-facing form and routing reports into one log your team controls. Where the agency also wants a documented data-handling policy covering devices, access and what happens when someone leaves, a security and backup check from £400 covers the wider device and access-control side alongside it. These are guide prices for a typical project; the fixed quote comes after a free 30-minute call.
Related
- General guide: Admin eats our evenings and weekends
- Sector pillar: Property drowning in admin
- Sibling page: Fixflo or a lighter workflow?
- Guide: A cyber security checklist for small businesses
Frequently asked questions
Is it illegal to use WhatsApp with tenants?
Not automatically. The risk isn't the app itself, it's the personal data that accumulates there over time on a device the agency doesn't control, with no reliable way to secure, review or delete it centrally. This isn't legal advice; check the ICO's guidance for organisations or a data protection adviser for your specific situation.
What happens to tenant data on WhatsApp when a staff member leaves?
It generally leaves with them. Conversations held on a personal phone aren't something the agency can retrieve or confirm has been deleted, which is the clearest practical risk in using WhatsApp for this job at all.
How is a proper reporting form different from WhatsApp for this purpose?
A form routes reports into a log the agency owns, with access tied to the job rather than a personal device, and a clear record of who saw what and when. WhatsApp offers none of that by default, however well-intentioned the staff using it are.
Do we need a written policy as well as a new system?
It helps. A short, written policy covering which tools are used for tenant contact, who has access, and what happens to data when someone leaves gives the new system something to sit against, rather than leaving the rules unwritten the way they likely are today.
Will tenants mind losing the WhatsApp option?
Most won't, as long as the replacement is just as quick. A simple online form that takes a photo and a few details usually takes less time to use than opening a chat app, and tenants rarely have a strong preference for the channel itself, only for how fast and easy it is to report something.