WhatsApp records for insurance brokers: chats and consent on file

, Editorial Team

Advice happens in the chat more and more, but the record often sits on a personal phone. What the demands and needs rules expect, and how consent and chat history reach the client file.

TL;DR

A demands and needs statement records what a client asks for and needs, and ICOBS 5.2 is where the FCA Handbook covers it. A WhatsApp chat is not that statement by itself, but it is valuable supporting evidence: what the client asked, sent and received. For that evidence to reach the client file instead of sitting on a personal phone, WhatsApp belongs in a team inbox.

What gets recorded: consent for WhatsApp with its date and source, and every chat history with photos and files. How it reaches the file: as a PDF or ZIP, by hand, automatically when you close a chat, or through the API. What it costs: SendSeven from the Basic plan at €49/month, with unlimited retention, cancellable monthly.

What belongs in a demands and needs statement?

A demands and needs statement sets out what the client wants and needs from a policy, so the policy proposed can be checked against it. ICOBS 5.2.2R says a firm specifies the client's demands and needs “on the basis of information obtained from the customer”, and that a statement of them “must be communicated to the customer” before the contract is concluded. ICOBS 5.2.2BR adds that the contract proposed has to be “consistent with the customer's insurance demands and needs”.

How much detail the statement carries depends on the contract: ICOBS 5.2.2R says it is “modulated” according to the complexity of the contract and the type of client. Where no personal recommendation is given, ICOBS 5.2.4G says “the format of a statement of demands and needs is flexible”. More in our glossary entry on the demands and needs statement.

Many brokerages produce the statement in their broker management system (BMS) or from their own template, and this article doesn't change that. What is new is that part of the conversation with clients now happens in the chat, and what is said there often never reaches the client file.

This is general information, not legal advice. Check the details with your compliance consultant or data protection lead.

How many of your clients are on WhatsApp?

Most of them, very likely. Ofcom's Online Nation 2025 report says 90% of UK adults online used WhatsApp in May 2025, up from 87% a year earlier, and 74% used it daily, as reported by ISPreview.

That doesn't mean clients want to give up the phone. Wavestone's Customer Centricity 2026 study shows UK after-sales support split as phone 43%, live chat 27% and WhatsApp or text message 24%. The study asked insurance customers about their insurer, not their broker, so read it as a hint: the chat sits next to the phone. More in our guide to customer communication for insurance brokers.

What lands in the chat is exactly what's missing from the file later: the photo of the damage, the question about the excess, the go-ahead to switch. On a personal phone it all stays on one device. If the colleague who handled it is on holiday, or leaves the firm, nobody else sees the history.

SendSeven team inbox: a client reports car park damage on WhatsApp with photos, an automatic acknowledgement before the office opens, the broker's reply and a status update on the motor claim
Source: SendSeven, mockup with sample data

Is a WhatsApp chat a demands and needs statement?

Not by itself. The statement sums up what the client wants and needs, and the client receives it before the contract is concluded. The chat holds part of the information obtained from the client, and its history is the supporting record next to the statement. It adds four things to the file:

  • The client's own words, with date and time.
  • Their documents: photos, policy schedules and forms.
  • Your replies, each with a time.
  • Who replied. Every message shows the real name, whether it was you, a colleague or an AI agent for insurance brokers, whose replies are labelled as AI.

Then there is the medium. ICOBS 4.1A.2R lists paper, “a durable medium other than paper” or a website that meets the website conditions. Whether a WhatsApp message counts as a durable medium is a question for your compliance consultant, not a messaging provider.

For records in general, SYSC 9.1.1R says a firm “must arrange for orderly records to be kept of its business and internal organisation”, and SYSC 9.1.5G says they should be “retained for as long as is relevant for the purposes for which they are made”. Under SYSC 9.1.4G a record in another language can stay in the original if a translation can be provided on request. For a client who writes in Polish, the transcript PDF can show each message in the original and in a translation (from the Professional plan).

For the evidence to reach the file in full, you need three things: the client's consent for WhatsApp, a history the whole team can see, and an export to the client file.

SendSeven mockup in three steps from the WhatsApp chat to the client file: consent with date for the Winter cover check list, chat history with claim photos in the team inbox, transcript as a PDF in the client file of Claire Whitmore
Source: SendSeven, mockup with sample data

Again, this is general information, not legal advice. Your compliance consultant can tell you what applies to your firm.

A broker proves consent for WhatsApp with a record of when and how the client agreed. If you message clients first on WhatsApp, say with an invitation to a winter cover check, PECR and UK GDPR apply. The ICO's guidance on electronic mail marketing says PECR covers “emails, texts, picture messages, video messages, voicemails” and “direct messages via social media or any similar message that is stored electronically”.

PECR has a “soft opt-in” for existing clients of similar products, as long as every message offers an opt-out. Meta's WhatsApp Business Messaging Policy asks for opt-in before a business messages someone first, so for WhatsApp we recommend an explicit opt-in.

UK GDPR Article 7(1) says the controller “shall be able to demonstrate that the data subject has consented”. The ICO's guidance on recording consent lists what to keep: who consented, when, what they were told, how, and whether and when they withdrew.

In SendSeven a consent is a subscription: the client sits on a list such as “Annual review” or “Winter cover check” for a channel such as WhatsApp or email. Each subscription stores since when it exists and how it came about: a keyword such as START in the chat, a sign-up form on your website, double opt-in (for email only), the API or by hand. The Subscriptions tab in the contact profile shows each one as Subscribed with its date.

SendSeven contact profile of Claire Whitmore on the Subscriptions tab: the Annual review and Winter cover check lists on WhatsApp and the newsletter on email, each Subscribed with the date it began
Source: SendSeven, mockup with sample data

Two details to watch:

  • An import is not proof. It only records consent that already exists, so keep the actual evidence, such as a signed form or the sign-up record, where you collected it.
  • STOP unsubscribes. A client who writes STOP is unsubscribed automatically.

How to collect consent without annoying clients is in our WhatsApp opt-in strategies. This is general information, not legal advice. Ask your compliance consultant or data protection lead what applies to your firm.

How do you export a WhatsApp chat for the client file?

In the WhatsApp app you export a chat with “Export chat”, one chat at a time, as a text file that exists only on that phone. In a team inbox like SendSeven you download each conversation as a PDF or ZIP, with photos, files and the names of everyone who replied. There are four routes:

  • PDF for the file. The whole history, with embedded images, links to voice notes and files, and the real names of the senders. From the Professional plan an AI summary sits at the top.
  • ZIP for archiving. History and all attachments in one file, readable offline.
  • Automatic when you close a chat. Under Settings → Conversations you choose Off, PDF, ZIP or Both.
  • A copy for the client. By email the client gets only the conversation itself, without internal notes. Your own export includes the notes.
SendSeven team inbox with a closed WhatsApp conversation with Claire Whitmore and the transcript options PDF, ZIP and email to the client, below it the first page of the PDF transcript with AI summary, sender names and a photo of the damage
Source: SendSeven, mockup with sample data

Can you show later what was said, and when?

Yes, as long as the chat sits in a team inbox and not on one phone. In SendSeven, opt-ins and chat histories are documented with date and time, kept with no time limit on every plan with the team inbox, and exportable as a PDF or ZIP. Whether that fits a particular record-keeping standard is a question for your compliance consultant.

Can WhatsApp chats go into a broker management system?

Yes, through an interface, but not at the press of a button. SendSeven has no ready-made connection to a particular BMS. When a transcript is ready, SendSeven announces it by webhook (conversation.transcript.created), and in n8n, Make or Zapier you can start from the Transcript Created trigger and pass the file on to a document archive, a cloud folder or an email. Filing it straight into your BMS takes some development work with the REST API. Without any technology, you download the PDF and file it by hand, which is often enough for a small brokerage.

Are replies sent from the phone saved too?

Yes, if you connect the WhatsApp Business app with Coexistence. You carry on typing on your phone as usual, and every reply also appears in the team inbox, and so in the transcript. When you connect, chats from up to the last 180 days come across, plus photos and files from the last 14 days. More in WhatsApp for insurance brokers: keep the app, bring in the team.

What doesn't belong in the WhatsApp chat?

Health details and full card, account or ID numbers don't belong in the chat. Health data is special category data under UK GDPR Article 9, and the ICO quotes the definition as “personal data related to the physical or mental health of a natural person”. WhatsApp's Business Messaging Policy also rules out asking for full card, account or ID numbers.

  • Health details for income protection, private medical cover or life cover are for the meeting or the insurer's application form.
  • Card, account and ID numbers you never ask for in full in the chat.
  • Passwords and log-ins, for example for client portals, don't belong in any chat.

If a client sends a medical report anyway, ask them for another route. This goes for every chat, including those in SendSeven. Write the rules down for the team, and put them into the instructions of your AI agent if you use one.

Checklist: documenting advice in the chat

Most of this you set up once, and after that the records build up on their own.

Documenting advice in the chat: the checklist
  1. Bring WhatsApp into the team inbox
    Connect your office number with Coexistence. The app stays on the phone, and the team sees every chat.
  2. Record consents
    Create lists, for example for annual reviews or a winter cover check. Consent comes in by keyword, sign-up form or by hand, each with a date.
  3. Set the rules for the chat
    No health details, no full card, account or ID numbers, no passwords. In writing, for everyone on the team.
  4. Create the transcript when you close a chat
    Under Settings → Conversations, choose whether closing a conversation creates a PDF, a ZIP or both.
  5. Put the transcript in the client file
    Download the PDF by hand, or send it to your archive with a webhook and n8n, Make or Zapier. Filing into a BMS takes the REST API.
  6. Agree retention and filing with your compliance consultant
    Keep writing your demands and needs statement as you do today, with the chat history next to it. What you keep, where and for how long is for your compliance consultant.

SendSeven is an AI-powered platform for marketing and customer communication. From the Basic plan at €49/month you get all eight channels, any number of users, WhatsApp Coexistence and unlimited retention of chat histories, and you can cancel monthly. SendSeven is GDPR-compliant and hosted in the EU (Frankfurt), and a data processing agreement (DPA) is available on request. For WhatsApp, Meta's fees come on top, as explained in our guide to WhatsApp pricing in 2026. All plans are on the pricing page.

Chats and consent on file, not on a phone
Opt-ins and chat histories documented with date and time, export as PDF or ZIP, and WhatsApp on your usual number, with the whole team.
See the solution for brokerages →

Frequently asked questions

Is SendSeven GDPR-compliant?

Yes, SendSeven is GDPR-compliant and hosted in the EU, in Frankfurt. A data processing agreement (DPA) is available on request.

What happens to the chats when a member of staff leaves?

The chats stay with the firm: conversations belong to your firm's account, not to an employee's phone. You remove the person's access, and the histories and notes stay visible to the team.

Does the client get a copy of the chat history?

If you like, you can email the client the transcript of their conversation, without internal notes and system messages. That can also help with a subject access request, which the ICO explains under the right of access. This is general information, not legal advice. Check the details with your compliance consultant or data protection lead.

How long does SendSeven keep chats?

On every plan with the team inbox, from Basic to Enterprise, with no time limit. Only on the API Only plan for developers it is 90 days. Which retention periods apply to your firm is a question for your compliance consultant.

Sources

Further reading