It's a familiar story. A social worker gets a message from a client on a Saturday. A family needs to move a home visit. A colleague forwards a photo of a document that has to be dealt with before Monday. None of it goes through an official system. All of it goes through WhatsApp, because that is where the client already is, and because it works.
If you lead an IT or data protection team at a social care organization, you already know this is happening. You may have even tried to stop it. And you have likely found that stopping it is much harder than it sounds. But this isn't a story about careless staff. It's a story about a tool that solves a real, time-sensitive problem, and the gap it creates when the only tool that meets the need is one your organization cannot legally control.
Social care runs on relationships, and relationships run on communication that is fast, personal, and low-friction. When a client is more likely to answer a WhatsApp message than a phone call or a letter, staff use WhatsApp. And care rarely happens one person at a time. A shift handover, a case discussion, a team covering a group of clients across several sites: this is continuous group communication, by its nature.
Ask why they use it, and the answer is almost always the same: it's where people already are. WhatsApp has more than two billion users. It is fast, familiar, and free. For a frontline worker trying to connect with someone who is hard to reach, while at the same time keeping a whole team informed, it's the path of least resistance.
So the people using it aren't the problem. They're just getting their jobs done as best they can by using the tool that works. The problem is that the tool was built for planning weekend trips and bachelor parties. It was never meant for handling case information about vulnerable people, shared across a team, every day.
Every organization that uses consumer messaging for work takes on some risk. In social care, the risk is sharper, for two reasons. The first is the data. Conversations between care workers and the people they support touch some of the most sensitive information there is: health, family circumstances, financial hardship, legal status, children. Consumer messaging apps protect a one-to-one chat well enough. Protecting a group is a harder problem, and group is exactly what social care runs on: teams, shift handovers, coordination across multiple facilities. The security that covers a private message between two people is not automatically the security that holds when forty people across several sites are exchanging case information all day. At this scale, the encryption model itself starts to matter.
The second is the regulation, which in this sector runs deeper than general data protection. Across the EU, the GDPR already sets strict rules for handling health and personal data, and newer frameworks are raising the bar: NIS2 extends security and resilience obligations to many health and care providers, and the EU Data Act tightens control over where data can be accessed and by whom. In Germany the duty goes further still. Many care professionals are personally bound by confidentiality under Section 203 of the Criminal Code, where a breach is not a policy failure but a criminal offense. Church-affiliated providers answer to their own recognized data protection frameworks on top of that, the KDG for Catholic organizations such as Caritas and the DSG-EKD for Protestant organizations such as Diakonie. A WhatsApp message about a client is not only a governance gap. In this sector it can be a compliance breach, and for the professional who sent it, a personal legal exposure.
Most social care organizations have tried the obvious fix. They ban consumer messaging, issue a policy, and move on. It fails for a simple reason: a ban removes the tool without removing the need. Staff still have to reach clients who are only reachable on WhatsApp. They still have to coordinate quickly across shifts and sites. If the only sanctioned alternative is slower, more complicated, or does not work on the phone in their hand, they quietly go back to what works. The behavior does not stop. It moves out of sight, which is worse, because now it is happening against policy and with no visibility at all.
There's another reason bans fail that often gets missed: most of these workers don't have a company phone. They're using their own, the same device their family and friends are contacting. So any solution that depends on a managed corporate device, or asks someone to hand their personal phone over to IT, is dead before it starts. Whatever replaces WhatsApp has to work on the phone that's already in their pocket.
The organizations that actually close this gap do not do it through enforcement. They do it through replacement: giving staff something that is as easy as WhatsApp, but built to be governed and compliant.
This is the part that sounds harder than it is, and the clearest way to show it is with an organization that has already done it. The Dr. Georg Haar Foundation is a German nonprofit working in family and social services. Like most organizations its size, it had no large IT department and no budget for a multi-year technology project. What it had was a clear problem: staff were communicating with clients and families, and WhatsApp was no longer defensible under GDPR.
Its response was fast and led from the top. Rather than run a lengthy evaluation, the foundation piloted Wire with a small group, confirmed that staff could actually use it, and rolled it out across the organization. The deciding factors include: works on any device without tying communication to personal phone numbers, keeps work and private life separate, and simple enough that employees with no technical background could start immediately. The foundation especially appreciated that Wire separates private and professional data perfectly on a single personal device without requiring complex Mobile Device Management (MDM) profiles that may scare staff. Compliance stopped being something the organization hoped it had covered, and became something it could point to.
The same conclusion gets reached at the other end of the size spectrum, and it leads to the same place. IPW, a Swiss psychiatric provider, spent roughly two years formally evaluating its collaboration tools before concluding that a mainstream platform couldn't meet its obligations for patient data under Swiss law, even with the resources to make it work. It moved to Wire. Different organization, different scale, different process: same verdict, same choice. Tools that weren't built for the compliance reality of care can't be retrofitted into it.
Between these two sits the largest part of the sector: the regional networks and associations affiliated with Caritas and Diakonie, which face the same pressure with lean IT teams and centralized oversight from their own data protection offices. For them the question is not whether the WhatsApp gap needs closing. It is how to close it in a way that staff will accept.
The fix was never a stricter policy, it was giving them a governed tool that works the way WhatsApp does, on the personal phones they already carry. It also has to reach the families and outside professionals the work depends on, and Wire does that through a secure guest link or the web, with no app to install, no account to create, and no personal numbers exchanged.
Easy is only half of it, though. Any vendor can write "compliant" on a website; far fewer can point to an independent authority that has inspected the platform and cleared it for sensitive use. Wire is certified by the BSI, Germany's federal cybersecurity agency, for handling classified government information at the VS-NfD level. For a managing director or a data protection officer, that settles a question a vendor's word never can, and it's far easier to put in front of an auditor or a board. And because care is group communication, not one-to-one chat, Wire runs on Messaging Layer Security (MLS), the encryption standard built to hold at organizational scale rather than just between two people.
That's the whole point. Staff keep the fast, familiar experience they'd choose anyway, and the organization stops hoping it's compliant and starts being able to prove it. See how the Dr. Georg Haar Foundation made the switch, or explore Wire as a WhatsApp and Signal alternative.