In short: using WhatsApp with a client is not formally prohibited for a lawyer, but this channel only covers transmission. Storage, professional-personal separation, enforceable traceability, and GDPR remain the responsibility of the firm — and the standard version of WhatsApp does not provide any of these elements.
“I’ll send it to you via WhatsApp, it’s easier.” How many times have you heard this phrase from a client this year? The reflex has become universal. For a short message, it is of no consequence. For a photo of a legal document, a scan of an agreement, or the PDF of an expert report, it is a different story — and Article 66-5 of the Law of 31 December 1971 does not sleep.
End-to-end encryption is a virtue, not proof
WhatsApp has used a robust end-to-end encryption protocol, derived from Signal Protocol, since 2016. During transit, the message is encrypted between your phone and your client’s phone. Meta — which has owned WhatsApp since 2014 — claims it cannot read the content. This claim is technically defensible.
However, end-to-end encryption covers only one of the three states of data. Transmission is protected. Storage, on the other hand, depends on your phone: unencrypted at rest on most entry-level Android devices, backed up in plaintext on iCloud by default on iPhones, and exposed to anyone who has your unlock code. Furthermore, metadata — who speaks to whom, when, and for how long — remains accessible to Meta, and therefore, via request, to US authorities under the CLOUD Act.
What the RIN expects from a communication channel
Article 4 of the National Internal Regulations of the Bar states that professional secrecy is a matter of public policy. It applies to all correspondence and documents within a case file. Beyond this principle, professional practice imposes several requirements on the channel used to transmit these documents: transmission confidentiality, receipt traceability, secure storage, and the possibility of retrieval at the end of the mandate.
WhatsApp covers the first requirement—transmission confidentiality—through its encryption. It fails on the other three. Receipt traceability is limited to blue ticks, which have no legal enforceability. Storage depends on the phone, which is inherently a personal device. And retrieval requires manual exportation of conversations, with no separation by file or standardized format.
The gray areas that no one addresses
Beyond the principles, several practical situations raise issues that many firms ignore. When you change phones, does your history go with you, or does it stay with Meta? When an associate leaves the firm, do their client conversations go with them? When your phone is stolen while traveling, are the documents from the most recently opened cases accessible? When a client requests the permanent deletion of their exchanges, can you guarantee it?
These questions do not have satisfactory answers with standard WhatsApp. They do not have them with Signal either, despite its stricter architecture regarding metadata. Telegram is even less suitable because encryption is not enabled by default for standard chats. iMessage suffers from the same storage limitations as WhatsApp, with the exception of cleaner integration via encrypted iCloud — but this moves your data outside the French perimeter.
The cost of ambiguity
As long as your clients do not ask questions, ambiguity costs nothing. The day a client disputes the completeness of the file delivered at the end of a mandate, or an opposing party raises a claim of negligence, or a fellow receiver becomes curious, the absence of a traceable channel becomes a liability. The RIN (Internal National Regulations) does not mandate a specific tool, but it does mandate diligence — and it is this diligence that you must be able to document.
The cost is also visible in daily operations. A document received via WhatsApp, then forwarded by email to a colleague, then downloaded again for validation, ends up existing in five copies across three different channels. When the time comes to compile the final file, you spend more time reconstructing the thread than pleading your case.
Criteria for a sustainable client communication channel
Before looking at any solution, here is the framework to apply. Confidentiality of transmission via recognized encryption. Encrypted storage at rest on media under your control. Siloing by client — not a single global thread. Enforceable traceability of shipments and access. Possibility of restitution in an exploitable format at the end of the mandate. Permanent deletion upon client request. Independence from any actor whose jurisdiction exposes them to the CLOUD Act.
With this framework, standard WhatsApp fails on storage, siloing, and traceability. Signal scores better on confidentiality but remains limited regarding enforceable traceability and structured restitution. Professional messaging hosted by a French provider — such as Tutanota, ProtonMail Business, or even a self-hosted mail server — checks more boxes but still does not provide folder-based siloing or structured requests.
How Client Vault responds
Client Vault replaces the email-WhatsApp channel for document collection, not for conversation. The idea is not for you to stop writing to your client via quick messages for open questions — it is that no case files transit through anything other than your vault. The client has their private space, you request a document, they upload it, it is timestamped, and you validate it. The conversation can continue elsewhere; documents have their own dedicated channel.
This separation seems restrictive at first; in practice, it is liberating. You regain mental bandwidth — you no longer have to wonder if Mr. X’s document is in your inbox, your WhatsApp, or last week’s SMS. It is in its dedicated space, two clicks away. You also regain professional peace of mind: at any time, you can export the complete file in a usable format.
For WordPress agencies equipping professional firms: this is precisely the type of benefit that sells well to a lawyer. The time savings are measurable, the professional peace of mind is reassuring, and the technical mediation — installation, hosting, training, support — belongs to you.
Honest limitations
Client Vault does not replace WhatsApp for conversation. If your client wants to ask you a question while on the move, they will continue to do so via quick message — that is healthy. The promise is not the elimination of messaging, but the separation of uses: a discussion is a message; a document is for the vault.
Client Vault also does not cover qualified electronic signatures. For an act that must be signed with eIDAS value, you should stick with Yousign or Universign. The complementarity works well: the document travels through your vault, and the signature goes through your signature provider.
Let’s get acquainted
If you are a lawyer or a notary, and the drift of WhatsApp in your firm concerns you — or if your WordPress agency is asking the question for you — let’s chat via video call. Twenty to thirty minutes to understand your situation and decide together if a sovereign path aligns with your constraints.
Frequently asked questions
Is using WhatsApp with a client compliant with Art. 66-5?
Not fully. Encryption covers transmission, but retention, traceability, and compartmentalization fail to provide the guarantees required by the National Internal Regulations (RIN) for case files.
Is end-to-end encryption sufficient to comply with professional secrecy?
No. It only covers one of the three stages of data handling. You must also account for retention, professional-personal separation, enforceable traceability, and the ability to retrieve data.
Is Signal a good alternative to WhatsApp for a lawyer?
Better regarding metadata, but limited in terms of enforceable traceability and structured retrieval. For sensitive conversations, yes. For formal case documents, a dedicated channel remains preferable.
Should client conversations be archived?
The RIN requires the retention of case documents and their return at the end of a mandate. Purely operational conversations may not need to be kept, but any substantive discussion on the merits should be, in a structured format.
What does the CNIL say about messaging apps for liberal professionals?
The CNIL recommends the separation of professional and personal data, encryption at rest, limiting retention periods, and conducting impact assessments for tools that process sensitive data. No consumer messaging service provides all these safeguards by default.
What should be done with client messages in the event of a firm closing?
The RIN (Internal Regulations) requires the return of the file to the client at the end of the mandate. If part of the documents was shared via WhatsApp, extracting and returning them in an exploitable format becomes a complex exercise. Using a dedicated channel from the start avoids this issue.
{“@context”:”https://schema.org”,”@type”:”Article”,”headline”:”Le secret professionnel à l’ère de WhatsApp : ce que dit l’art. 66-5″,”author”:{“@type”:”Person”,”name”:”Dragan Stamenkovic”},”datePublished”:”2026-05-10″,”dateModified”:”2026-05-10″,”publisher”:{“@type”:”Organization”,”name”:”Client Vault”},”mainEntityOfPage”:”https://clientvault.pro/blog/secret-professionnel-avocat-whatsapp”}{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[ {“@type”:”Question”,”name”:”WhatsApp avec un client est-il conforme à l’art. 66-5 ?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Pas pleinement. Le chiffrement couvre la transmission mais pas la conservation, la traçabilité ni le cloisonnement.”}}, {“@type”:”Question”,”name”:”Le chiffrement de bout en bout suffit-il pour respecter le secret pro ?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Non. Il couvre la transmission. Conservation, séparation pro-perso et traçabilité restent à organiser.”}}, {“@type”:”Question”,”name”:”Signal est-il une bonne alternative à WhatsApp pour un avocat ?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Mieux côté métadonnées mais limité pour la restitution structurée des pièces de dossier.”}}, {“@type”:”Question”,”name”:”Faut-il conserver les conversations clients ?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Le RIN impose la conservation des pièces du dossier. Les échanges substantiels méritent une conservation structurée.”}}, {“@type”:”Question”,”name”:”Que dit la CNIL sur les messageries pro libérales ?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Séparation pro-perso, chiffrement au repos, limitation des durées, analyse d’impact pour les outils sensibles.”}}, {“@type”:”Question”,”name”:”Que faire des messages clients en cas de cessation de cabinet ?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Le RIN impose la restitution. Un canal dédié dès le départ évite l’extraction complexe d’un historique WhatsApp.”}} ]}
