A WhatsApp thread containing a customer's name, number, address or photos is personal information. It is not a chat, and it is not ephemeral — it is a record of an identifiable person, held on a device that is probably not in the business and probably backed up to a cloud account the business does not control. For most small businesses this single fact is the largest POPIA exposure they have.
The honest position is straightforward: a personal WhatsApp account cannot be made compliant by being careful. It has no access control, no audit trail, no deletion path and no owner. The only fix is to move the business conversation onto a business number and decide deliberately who sees what. That is an afternoon of work once, and it removes a category of risk that no amount of care on a personal phone will.
What is in a WhatsApp thread that actually counts as personal information?
More than people assume. A typical thread between a plumber and a customer contains most of the following:
- The customer's name and cell number, which identify them.
- Their home or work address, often with the gate code or a directions note.
- Photographs of the property, the vehicle, the meter or the fault, sometimes with a house number clearly visible.
- Details of what is inside their house, such as what is broken, what is where, or what a previous contractor did badly.
- Their bank details if a payment was discussed, or their ID number if you foolishly asked for one.
- Voice notes, which can contain more than the text would.
- Complaints, which are often the most sensitive thing in the thread.
Any one of those, on its own, is personal information about an identifiable person. Keep the whole thread for years, add a photo of their face, and you have created a permanent record on a device that follows a staff member home.
Why is a personal account the biggest single exposure you have?
Because of who else can reach it, not because of the technology.
- One login, everybody. Everyone who has ever used the phone can see every customer thread ever had on it. Add a new staff member and you have no way of knowing what they can already read.
- There is no access log. You cannot tell who looked at a customer's details, when, or what they did with them. That matters the moment anything goes wrong.
- There is no deletion path. Delete a chat on the phone and it may still exist in a backup, on another linked device, and on the handset of a staff member who forwarded a screenshot to themselves.
- It leaves the building. The phone goes home, goes on holiday, goes to a family member, and is sold when it breaks.
- It cannot be handed over. When someone leaves, you cannot revoke their access, because you never had it to begin with.
None of these are hypothetical in a trade business. Staff routinely forward a customer's address to their own number "so I have it for Saturday", and that number stays on the phone for years after they have gone.
What actually goes wrong?
| Risk | What happens in practice |
|---|---|
| Staff leaving on a personal phone | They leave with your full customer list, every address, every fault history and every complaint |
| Lost or stolen phone | Customers' names, addresses and gate codes leave the business in somebody's pocket |
| Cloud backups | Deleted chats and photographs are retained somewhere you do not control and cannot reach |
| Screenshots | A thread sent to a personal number, or a photo saved to a personal gallery, becomes a permanent second copy |
| Forwarding threads to yourself | Done constantly, for good reasons, and rarely deleted afterwards |
| Old chats searchable years later | An employee on an old handset can still find a customer from five years ago |
| Ex-staff keeping conversations | Nothing stops a former employee reading a conversation history years later |
| Shared phones and shared logins | One phone passed around the workshop means everyone who touched it can open everything |
| No access control | You cannot remove one person without removing everyone's access |
| No deletion path | You cannot demonstrate to a customer, or to yourself, that you deleted what you said you deleted |
| A dispute or a complaint thread | The most sensitive material in the business, held on the least controlled device you own |
Read that list again and notice something: not one of these items requires a hacker. Every one of them is an ordinary Tuesday.
What does WhatsApp Business fix, and what does it not?
Moving onto a business account is the right first step, and it is a bigger step than most owners expect. It gives you:
- A business profile with your trading name, hours, address and a phone number the business owns rather than a person.
- Separation of the business conversation from the owner's personal chats, which removes the most common accidental disclosure.
- Labels and tags on conversations, so a customer can be found by name, by job, or by status.
- Quick replies, so a repeated answer is typed once and cannot be sent slightly wrong.
- An away message, so a customer who messages at 21:00 knows the message was received.
- A visible list of linked devices, which you can check and revoke.
- Verified business details, which customers can see.
What it does not do, and owners are often disappointed by this:
- It does not give per-person permissions inside one account. Two staff sharing one business number still see everything.
- It does not stop a staff member taking a screenshot or forwarding a thread to their own number.
- It does not give you an access log you can audit.
- It does not turn a chat history into a record you can reliably export, search across years, or delete from every backup.
So a business account is necessary and not sufficient. The second half of the fix is the access rule below, and it is a written decision rather than a setting.
How do you decide who can see which customers?
Write it down, in one table, and make it a rule rather than a preference. The register template in the templates file is the working version.
| Role | What they can see | Who approves their access |
|---|---|---|
| Owner or manager | All customer conversations and all records | — |
| Office or booking person | Customer contacts, job details, appointment conversations | Owner, named in writing |
| Technician | Only the customers assigned to them that week, plus the job details for those jobs | Owner or office, per job |
| Accounts | Invoices, payment conversations, nothing else | Owner |
| Anyone not on this list | Nothing | Owner, in writing, with a date |
Three rules that follow from the table:
- Named people, not roles. "Accounts" is not a person, and it is impossible to revoke.
- Share only where the work needs it. A technician does not need the owner's relationship history with that customer, only today's job.
- Leave when they leave. Access that does not end with employment is not access control, it is a delayed handover.
What do you do with a staff phone when someone leaves?
Do this on the day, not in the week after. The list is short and it is not negotiable.
- Have the person hand over the device before they leave the site.
- Remove the business from the device, or export what is a business record through an agreed process first. Decide which, and write that process down.
- Revoke linked devices from the business account while you still have access to it.
- Export the conversations that are genuine business records into your business system, then delete the chats from the personal phone.
- Check for screenshots and forwarded threads: ask directly, look at their own chats to themselves, and check any personal number they habitually used.
- Delete the whole personal chat list from the device if the device stays with them.
- Keep a one-page record of what was taken, what was deleted and who checked, signed and dated.
- Hand the device back, or wipe it, and record which happened.
One trap: do not wipe a phone before you have taken what belongs to the business. Job history, measurements, photographs of site conditions and the customer's own instructions are all things you will want, and they only exist on that handset.
What about the messages themselves and the backups?
Messages are where the retention trap is. Nobody deletes chat history, because it is genuinely useful, and because nobody can delete all of it anyway.
A workable rule:
- Keep the conversation for as long as the job is live and any dispute or warranty period is open.
- Delete the conversation once it is closed and the period has passed.
- Export anything you need to keep into your own system, where you control it and can search it.
- Set a firm rule for how long a closed conversation stays on a device, and apply it rather than leaving it open-ended.
- Check whether chat backup is switched on, and decide deliberately whether it should be. Backup you cannot reach is not a safety net, it is an extra copy.
And the two rules that remove most of the exposure in an afternoon:
- Nothing customer-related lives only in a personal account. If it is not in the business system, it does not exist as far as the business is concerned.
- Nobody forwards a thread to their own number. Not "just the address", not "just for the weekend". The address, in the wrong hands, is the personal information.
When is it time to stop using WhatsApp for customer records entirely?
For some businesses, sooner than others. WhatsApp is fine as a conversation channel. It is not a customer record system, and pretending otherwise is what creates the exposure.
Consider moving properly if any of these are true:
- You need to look up a customer from two years ago and their job history.
- More than one person needs the same customer conversation, reliably.
- You have customers who expect records, statements or a service history.
- Your staff turnover is regular, so access needs to start and stop often.
- You are losing data — phones, chats, photographs — and treating it as normal.
In that case WhatsApp becomes a notification channel: a message tells you a customer has arrived, and the record lives in your system. That is a bigger change than a migration, and it is worth doing once, properly.
The goal is not to stop using WhatsApp. It is for every customer conversation to exist in a place the business owns, controls, can search, and can delete.
What can you do this week?
- Write down who currently has customer conversations and on which devices.
- Decide the business number. Register WhatsApp Business on it this week, with your trading name and hours.
- Migrate the active customers first — the ones with a job in progress — and leave closed history behind rather than exporting years of it.
- Publish the channel access rule as a one-page table, with names on it.
- Set the rule for what happens to a phone when someone leaves, and run it once on somebody who has already left.
The companion checklist is a same-week version of this you can work through with your office person. The templates include a channel access register, a staff offboarding data step you can follow on the day, a migration tracker, and a written retention rule for chat history.
Not sure where to start? Book a free 30-minute strategy session and we will name the one gap worth fixing first: https://agentcy.co.za/#book-audit