One of the most uncomfortable calls we receive as lawyers goes something like this:
"I think my employer has been reading my private WhatsApp messages… Is that even legal?"
On the other side of the spectrum, employers call with a different anxiety:
"We suspect an employee is leaking confidential information through WhatsApp. Can we check their work-issued phone?"
The digital workplace has redrawn traditional boundaries between private and professional life. Messaging platforms like WhatsApp, Telegram, and Signal are now default modes of business communication even when they were never intended to be.
But can an employer legally access or monitor messages sent by an employee via WhatsApp?
It depends.
What We Know
Under Kenya's Data Protection Act, 2019, every individual—including employees—has a constitutional right to privacy, including the privacy of communications. This right extends to digital messaging platforms.
However, this right is not absolute. It may be limited where:
- The employer provides the device or platform;
- The employee uses the platform for work-related communication;
- The employer has a clear and lawful monitoring policy;
- The monitoring is proportionate, transparent, and necessary for legitimate business interests (e.g., protecting company data, ensuring compliance, preventing misconduct).
Where employers rely on surveillance or monitoring, informed consent and purpose limitation are critical principles. Employers must clearly tell employees what is being monitored, how data is processed, and for what specific reason.
Covert surveillance—particularly of private, personal devices or apps—is likely to be unlawful.
What We See
We advised a former employee who was dismissed after his employer cited "unprofessional language" shared in a private WhatsApp group with colleagues. The group was not work-sanctioned, and the messages were shared from his personal phone, outside working hours.
How did the employer access those messages? Another employee had forwarded screenshots to HR.
While the content may have been inappropriate, the employer's use of this information raised serious data privacy concerns. The Employment and Labour Relations Court questioned the lawfulness of the dismissal, given the absence of a workplace monitoring policy and breach of the employee's legitimate expectation of privacy.
Contrast this with a case involving a corporate fraud investigation. The employer had issued official phones with WhatsApp Business installed and had an explicit policy stating that all communications on the devices were subject to monitoring. The court upheld the employer's right to rely on such evidence in disciplinary proceedings.
Mistakes Clients Make Before They Speak to Us
Employers:
- Monitoring without policy – Many employers monitor staff devices or social media without any internal policies, exposing themselves to liability.
- Assuming ownership equals access – Just because a device is company-issued does not mean the employer has unrestricted access to all its contents.
- Using illegally obtained data – Evidence gathered through invasive or deceptive means may be ruled inadmissible in court—and may breach the Data Protection Act.
Employees:
- Using personal WhatsApp for work – This blurs lines and creates legal ambiguity about what's private and what's professional.
- Sharing sensitive work material on private chats – Screenshots, files, or confidential discussions shared via personal WhatsApp can lead to disciplinary action.
- Assuming digital privacy is guaranteed – In a connected workplace, nothing shared digitally is entirely private—especially on employer-provided devices.
Ethical Grey Zones
Can an employer pressure an employee to hand over their phone? Can colleagues forward private group chat content to HR? Can a company monitor a WhatsApp group that includes clients or regulators?
These questions often fall into a murky space between what's legal, what's ethical, and what's culturally acceptable. Surveillance practices that may be lawful on paper can still erode trust and workplace morale when done without transparency or sensitivity.
Systemic Problems in the Digital Workplace
In many African workplaces, formal digital communication tools (like Slack, MS Teams, or enterprise email systems) are underutilised. Instead, WhatsApp becomes the default channel for announcements, performance feedback, and even disciplinary communication.
But WhatsApp was never designed as an HR tool. It lacks accountability structures, audit trails, and data protection safeguards expected in corporate communication.
Worse still, few employers have digital monitoring or acceptable use policies aligned with the Kenya Data Protection Act, the Employment Act, or international data privacy norms such as the GDPR.
What We Tell Our Clients
To employers:
- Create clear workplace communication and monitoring policies. Let employees know what platforms are monitored and why.
- Respect proportionality and necessity. Surveillance should be targeted and justified—not excessive or punitive.
- Train HR and IT teams to navigate privacy-sensitive investigations lawfully.
To employees:
- Use work devices for work. Keep personal messages and discussions on personal devices.
- Don't assume your messages are private just because they're encrypted. Other users can screenshot, forward, or share them.
- Understand your rights under the Data Protection Act—and don't hesitate to challenge unlawful surveillance.
Reflective Conclusion: Privacy is a Right, Not a Luxury
As the lines between work and life become increasingly blurred, both employers and employees must adapt to new realities. Surveillance without safeguards breeds distrust. Privacy without boundaries creates legal risk.
The future of work depends on transparency, fairness, and respect for dignity—both human and digital.
If you're not sure whether your company's practices are compliant—or whether your rights have been infringed—start the conversation early. Because once trust is lost, litigation often follows.
MEN Advocates LLP
Bridging Innovation and Legal Excellence.
Factual Note:
- WhatsApp's end-to-end encryption protects messages in transit but does not prevent recipients from sharing them.
- The Kenya Data Protection Act, 2019 regulates the collection, storage, and use of personal data, including workplace monitoring practices.
- Employers must obtain lawful basis (including consent or legitimate interest) and meet principles of necessity, transparency, and data minimisation.
Found this article helpful?
