A work WhatsApp group usually arrives disguised as admin. Someone adds you, the supervisor posts the roster, a colleague asks about a shift swap and, before long, the group has become part of how the job functions. Nobody necessarily sat down and decided that employees should hand their personal cellphone numbers to dozens of colleagues. The decision was made for them when WhatsApp became the easiest way to get everyone into the same room.
Merel van der Lei, CEO of frontline employee communications company Wyzetalk, describes the consequences more starkly: “A female security guard starts a new job, and before her first shift ends, a hundred people she’s never met have her cellphone number.”
That example works because there’s nothing unusual about it. No database has been breached and nobody has been tricked into revealing anything. The employee has simply been added to the place where her colleagues talk about work, and access to that workplace conversation comes with an unusually personal admission price.
South African employers have been able to live with this arrangement because WhatsApp is extraordinarily convenient. It works on phones people already own, employees already know how to use it and managers don’t need to persuade anyone to learn another system. That convenience has gradually turned a consumer messaging app into workplace infrastructure, particularly for frontline workers who may never be issued a laptop, corporate email address or company phone.
The awkward part is that the informality of the tool doesn’t make the conversation informal. South Africa’s Code of Good Practice on the Prevention and Elimination of Harassment in the Workplace specifically extends the workplace beyond an employer’s physical premises and covers work-related communications enabled by information and communication technologies. The Department of Employment and Labour has been equally explicit that harassment protections can apply to work-related digital communication.
A roster chat therefore doesn’t float in some convenient space between work and private life just because it happens on an employee’s own phone. If the manager created the group, if employees need it to receive instructions and if the conversation exists because of their employment, pretending the employer’s responsibility stops at the office door feels increasingly difficult to sustain.
That sits uncomfortably alongside South Africa’s decision to classify gender-based violence and femicide as a national disaster in November 2025. The classification puts responsibility for coordinating the national response with government, but government obviously can’t govern every shift group, depot chat or staff WhatsApp thread in the country. Those are spaces businesses have created for themselves, and the way they’re run is largely a decision made inside the organisation.
The state can acknowledge the scale of violence against women. It can strengthen policy and coordinate institutions. An employer still has to decide whether a woman starting a job really needs to reveal a personal identifier to everyone she works with before she can find out when her next shift starts.
WhatsApp is fixing one part of this
There’s a temptation to treat WhatsApp’s forthcoming usernames as the obvious solution, and they do address something that should have been fixed long ago. Meta says usernames will allow people to message or join conversations without automatically revealing their phone number to people who don’t already have it, including people encountered in group chats. The feature is being rolled out gradually, with Meta saying users will be notified when it becomes available in their country. WhatsApp’s own announcement makes the privacy case explicitly.
That’s a meaningful improvement. A colleague you’ve never met doesn’t need your cellphone number simply because you happen to work the same shift.
The wrinkle is that replacing a number with a username doesn’t make identity disappear. I made a similar argument when looking at what WhatsApp usernames change about online identity earlier this year. WhatsApp has historically made the phone number both the address of an account and one of the clearest ways of identifying the person behind it. Usernames split those functions apart, which gives people more control but also creates a new identifier they have to think about.
Meta even allows some users to claim the same Instagram or Facebook username on WhatsApp. That makes sense for creators, businesses and anyone who wants one recognisable identity across platforms. In a workplace context, though, the same convenience can make somebody easier to find outside work. There’s no public WhatsApp username directory, Meta says people need to know the exact username to make first contact, and an optional username key can add another barrier, so the risk shouldn’t be exaggerated.
But human beings reuse usernames. Someone who is @nomsa.m on WhatsApp may also be @nomsa.m on Instagram because remembering five different handles is tedious. A colleague who would previously have been handed her phone number may instead be handed a useful search term for the rest of her online life.
South African privacy law is broad enough to recognise why this deserves attention. POPIA’s definition of personal information includes telephone numbers as well as an “online identifier”, alongside other information capable of identifying a person. That definition is built into the Act’s treatment of personal information. A username doesn’t automatically create a POPIA violation, and an employer using WhatsApp isn’t automatically breaking the law, but changing the identifier doesn’t make questions about collection, disclosure and access evaporate.
Van der Lei’s more compelling point is about who ends up carrying the burden when an organisation wants the convenience of WhatsApp while an employee wants separation between work and private life. WhatsApp already supports multiple accounts on one phone, which sounds like a neat answer until you reach the requirement for a second phone number. WhatsApp requires a separate number for the second account, and Meta originally pitched the feature partly as a way to keep work and personal accounts apart. If an employer supplies that number, fine. If it doesn’t, the employee has to create and maintain the boundary herself.
Van der Lei argues that this lands hardest on “the person with the least power in that group chat”, who can end up paying for her own privacy. There’s an obvious commercial context to her argument. Wyzetalk sells software for frontline employee communication, so the company has something to gain when businesses decide WhatsApp isn’t an adequate workplace platform. That’s a reason to examine the argument carefully rather than accept every claim in the source material at face value. The underlying problem survives that scrutiny.
A workplace needs somebody responsible for it
One part of Van der Lei’s original argument goes too far when it describes WhatsApp groups as having no record of what’s said. WhatsApp conversations plainly leave records on participants’ devices, and Meta has spent years designing the product around private, encrypted conversations. The problem for an employer is control: who retains workplace communication, what happens when somebody reports harassment, whether relevant messages can be preserved and who is supposed to act when the conduct spills from the work group into a private message.
There’s an important tension here because the answer can’t simply be “monitor everything”. End-to-end encryption protects employees too, and nobody should want an HR department reading every informal exchange between colleagues just in case one eventually becomes relevant to a complaint. Moving work communication onto an employer-owned platform can solve some governance problems while creating a different kind of surveillance if it’s handled badly.
The sensible response starts further upstream. Employers should know which channels they expect employees to use, what personal information becomes visible when they use them and what route exists when someone uses information obtained through work to pursue a colleague privately. If a woman leaves a shift group only to start receiving unwanted messages from somebody who got her details because management put them in the same chat, the organisation shouldn’t suddenly discover that WhatsApp was “personal” after all.
Not every WhatsApp use case creates the same problem either. Broadcast lists allow an administrator to send the same update to several people without putting them into one shared conversation, which can make sense for simple notices, although WhatsApp imposes practical limits and recipients generally need to have saved the sender’s number. A supervisor who only needs to tell staff when a site is closing early doesn’t necessarily need a hundred-person group discussion to do it.
Two-way coordination is where the trade-offs become harder. Shifts change, people call in sick, someone needs cover and supervisors need answers quickly. Frontline employees shouldn’t have to wrestle with clumsy corporate software simply because it satisfies a procurement checklist, and banning WhatsApp without offering something equally usable would probably achieve little beyond pushing the real conversation into an unofficial group nobody acknowledges.
That’s why the most revealing part of all this has little to do with WhatsApp itself. Companies have benefited from the app occupying an ambiguous place in working life. It’s formal enough for managers to issue instructions through it and informal enough to be treated as somebody else’s problem when the same space creates exposure the employer didn’t think through.
WhatsApp usernames make one part of that arrangement safer. People will increasingly be able to enter a work conversation without handing a phone number to everyone already inside it, and that’s overdue. What usernames can’t decide is whether that conversation should expose any persnal identifier at all, who needs access to whom, how unwanted contact is dealt with or why an employee is expected to build her own privacy boundary around a system she didn’t choose.
Those decisions were never Meta’s to make for an employer. They’ve been sitting with management all along.