What public bodies should understand about auto-deletion policies

A recent High Court judgment involving the Metropolitan Police Service (MPS) offers important guidance for all public bodies who operate auto deletion policies on messaging systems such as Teams, Slack or WhatsApp. Auto-deletion policies aren’t inherently unlawful but the High Court made it clear they must not undermine your legal and statutory obligations.

In R (BB) v Commissioner of Police of the Metropolis [2026] EWHC 1986 (Admin), the court examined MPS guidance requiring officers to enable WhatsApp’s “disappearing messages” function with a 90-day timer. The claimant, facing criminal charges, argued this policy was unlawful because it led to the deletion of communications between the investigating officer and a complainant.

The court dismissed the challenge on all four grounds. But the judgment still carries a clear message: auto-deletion is only defensible when organisations can demonstrate they’re still meeting their underlying duties.

The Key Principle

Public bodies can adopt auto-deletion policies for legitimate reasons such as data minimisation, storage management, security. However, these policies cannot be used as a shield against accountability. You must still:

Preserve material relevant to legal proceedings: Disclosure obligations don’t disappear because your messaging app has a timer. If communications may become evidence, they must be captured before deletion occurs.

Comply with statutory record-keeping duties : Many public bodies have specific retention requirements under sector regulations, freedom of information legislation, or their own governance frameworks. Auto-deletion must work around these, not override them.

Maintain audit trails for decision-making: Accountability requires being able to demonstrate how and why decisions were made. If key communications vanish automatically, that ability is compromised.

Practical Implications

The MPS guidance included a mechanism for exporting chats to a central system before deletion. This was critical to the court’s finding that the policy was lawful. The lesson: auto-deletion is acceptable only when paired with reliable, operationally embedded preservation processes.

A policy on paper isn’t enough. Staff must understand when to export, how to do it, and be held accountable for compliance.

The Broader Point

This case confirms that convenience and data hygiene cannot trump legal obligations. Public bodies adopting auto-deletion must ask: Can we still perform our statutory functions? Can we still meet disclosure duties? Can we still demonstrate accountability?

If the answer to any of these is uncertain, your policy needs revisiting - before a court does it for you.