WhatsApp Business for law firms: a legal and practical guide

Your firm may not have a WhatsApp policy, but it has WhatsApp. It has it because your clients use it for everything else and see no reason not to use it with you. They send an “any news?” on a Sunday afternoon, photograph an official notice instead of scanning it, confirm with a three-word message a decision that shapes the entire matter. The question is not whether the firm will communicate over WhatsApp — that has already been decided, and the client decided it. The question is whether it will do so properly or haphazardly.

And “haphazardly” has a very specific shape today: a partner’s personal phone, with the firm’s matters mixed in among the family group chat and the holiday photos. It’s worth understanding why that is a legal problem, not merely an untidy one, and what the alternatives are.

Three ways to be on WhatsApp

The first step is to distinguish, because “WhatsApp” is really three different products with very different implications for a firm.

The first is each lawyer’s personal WhatsApp. It’s the default option and the worst of the three: personal number, personal handset, personal backup, zero visibility for anyone else at the firm. The client conversation belongs, in practice, to the lawyer rather than to the firm.

The second is the WhatsApp Business app, designed for small businesses. It offers a business profile, quick replies and a number separate from the personal one. It’s a step up, but it remains tied to a phone: one primary session, one handset that takes the whole channel with it if it’s lost or goes on holiday, and no real integration with the firm’s tools.

The third is the WhatsApp Business Platform — the official API — contracted through an authorised provider. Here the number belongs to the company, not to a person; several users can handle the same number from their computers; and conversations can be integrated with the firm’s practice management system. It’s the professional route, the one banks, insurers and airlines use, and the only one of the three that treats the channel as what it is: a channel of the firm.

The legal problem with the personal phone

Client messages living on a lawyer’s personal phone is not just untidy. It is hard to reconcile with the firm’s obligations as data controller under the GDPR — Regulation (EU) 2016/679 — and Spain’s LOPDGDD, Organic Law 3/2018.

Think about it through a data-protection lens. The firm is accountable for its clients’ personal data: it must know where the data is, protect it, limit it to its purpose and be able to erase it. On a personal phone it controls none of that. It doesn’t control the backup, which may be syncing to the lawyer’s personal cloud account. It doesn’t control access, which depends on the lock screen of a private device. It cannot seriously honour an erasure request, because it doesn’t even know what’s in that thread. And the client’s data shares an app with someone’s private life.

Add to that the duty to inform: Articles 13 and 14 of the GDPR require the firm to tell the client, in its privacy information, which channels it uses to communicate and how that data is handled. A channel that exists in practice but appears in no privacy notice is exactly the kind of inconsistency that surfaces at the worst possible moment.

Professional secrecy: the same duty, another channel

Professional ethics does not distinguish by channel. The professional secrecy that protects what a client confides in their lawyer — set out in Article 5 of the Código Deontológico de la Abogacía Española, the Spanish Bar’s code of conduct — covers a letter, an email and a WhatsApp message alike. The duty of secrecy is not relaxed because the message arrives in a green bubble.

What does change by channel is the firm’s ability to honour that duty. A firm can reasonably safeguard its mail server; it can hardly safeguard every lawyer’s private handset. If the client’s confidence lives on a device the firm doesn’t manage, that gets shared at home, replaced every couple of years and backed up to a personal account, the duty of secrecy is resting on infrastructure nobody designed to carry it.

There’s a second face to this: evidence. Clients give instructions over WhatsApp — they accept a settlement, authorise a filing, drop an appeal — and those instructions must be preserved and provable years later. A thread on a lawyer’s phone is fragile as evidence and fragile as an archive: it can be deleted, it can vanish with the handset, and it never makes it into the matter file where it belongs.

And then there’s the scenario almost no firm has planned for in writing: the lawyer leaves. If the channel was their personal number, they walk out with the complete threads of dozens of clients. The firm loses the history, the continuity of the channel and the control over data it still answers for — all at once. With a company number managed through the API, one person leaving is a change of user, not an amputation.

Doing it properly: the practical part

None of the above requires giving up WhatsApp; it requires professionalising it. In practice, that comes down to a handful of decisions.

A firm number, not personal ones. A WhatsApp Business number onboarded through an official API provider, with the firm’s verified name and profile. Clients write to the firm; who answers internally is an organisational decision, not a property of the number.

Explicit expectations. WhatsApp creates an expectation of immediacy, and a firm cannot — and should not — reply within minutes at all hours. Defining response hours and an indicative response time, and communicating them, protects the team and orders the relationship. Immediacy is not an ethical duty; diligence is.

Every conversation on its matter. A client message that doesn’t end up linked to its matter is a message that sooner or later gets lost. The rule is the same as for email: the unit of organisation is the matter, not the channel.

Surgical care with the recipient. The channel’s most frightening error isn’t technological; it’s human. Sending a sensitive document to the wrong chat is a security incident — and, depending on the content, potentially a breach that must be reported. Checking the recipient before attaching should be a reflex, and delicate documents travel better through a secure portal than as a chat attachment.

Understanding the API’s rules. The official platform distinguishes between a conversation the client opens — within which the firm can reply freely during a 24-hour window — and messages the business initiates outside that window, which require pre-approved templates. There’s no need to master the technical detail; it’s enough to know the system is designed so a business can respond promptly to whoever writes to it, but cannot send unsolicited messages without passing through a filter.

Informing the client. The channel goes into the privacy information and the engagement letter: which channels the firm uses, for what purpose, and how messages are kept. It’s one paragraph, and it stops the most-used channel from also being the only undocumented one.

How Mandato solves it

In Mandato, the firm’s WhatsApp works exactly on that model: a WhatsApp Business number owned by the firm, onboarded through an official API provider. Client messages don’t land on a phone — they land in the firm’s inbox, where they join the same matter thread as email: one conversation per matter, visible to the team handling it, kept where it belongs.

For the client, nothing changes — they keep writing on WhatsApp as they always have. For the firm, everything does: the channel belongs to the firm, the history stays on the matter, and a lawyer’s departure stops putting years of conversations at risk.

The channel was never the problem

WhatsApp is not an unserious channel; used haphazardly, it is. The difference between the two lies not in the app but in three decisions no firm should keep postponing: a company number, conversations on the matter, and informed clients. Your clients have already chosen the channel. What remains to be chosen — and that part is up to the firm — is to handle it with the same rigour demanded of everything else.