WhatsApp and email as evidence: how to preserve digital proof

A great deal of commercial, employment and civil dealing now happens in WhatsApp messages and email: a quotation, an acceptance, a change of quantity, an acknowledgement of receipt, an apology for a delay. When things go wrong, one side opens their phone and says: “I have all of it in the chat.”

The difficulty is that what is on the phone is not always what will work as evidence. The Law of Evidence is the reference on the means of proof and their weight, and it gives proof by digital evidence the same standing as proof in writing — so the question is not whether the medium is admissible in principle, but what condition your evidence is in. This article sets out how to preserve digital evidence in a form that survives a challenge.

What makes digital evidence usable?

The Law of Evidence treats as digital evidence anything derived from data created, issued, delivered, stored or communicated by a digital means and retrievable in an intelligible form, and it expressly includes digital correspondence — email among it — means of communication, and digital media. A chat thread and an email are therefore inside the scope by text, not by analogy.

The weight attaching to it varies by category. Non-official digital evidence is evidence against the parties to the dealing — unless the contrary is proved — where it was issued under the Electronic Transactions Law or the E-Commerce Law, or derived from a digital means stipulated in the contract in dispute, or derived from a digital means that is authenticated or publicly accessible. In those cases the burden of proving invalidity falls on the party alleging it. Otherwise digital evidence carries the weight of an ordinary instrument.

That contains a practical drafting point worth putting into contracts: naming the agreed channel of correspondence — a specific number or a specific mailbox — moves the thread from ordinary evidence to evidence against the parties unless the contrary is proved.

Digital evidence is usually attacked from three directions. Anyone preparing a file is better off asking these questions before the other side does:

• Attribution: can the message genuinely be attributed to its author? The number registered in their name, an email on the company’s domain, a signature at the foot of the message, or a later acknowledgement of its content.
• Integrity: is the content as it was sent, unaltered? This is about how it was preserved and exported rather than about what it says.
• Completeness: is the context whole? An extract weakens the party who produced it, because the other side will supply what came before and after.

A screenshot is not the original

A screenshot is the easiest method and the weakest. It is a picture of what appeared on a device at a moment in time, it is easy to crop, and it carries no source data of its own.

Exporting from the application itself preserves the conversation with its sequence, dates and attachments. With email, saving the message in its original form with its full headers is stronger than printing the text, because the headers carry the message’s routing and technical data.

The Law of Evidence requires digital evidence to be produced in its original form or by another digital means, and allows the court to require its content in writing where its nature permits. Extracts from digital evidence carry the same weight as the evidence itself, to the extent they match their digital record. And a party who refuses, without acceptable excuse, to produce what the court asks for in order to verify the evidence forfeits the right to rely on it, or it is treated as evidence against him, as the case may be.

None of which means a screenshot is worthless; it may be perfectly sufficient where the content is not disputed. But building a file on screenshots alone against a party who denies everything puts you in a weak position that one simple step would have avoided.

A hypothetical: two parties agreed a price reduction in a chat. One produces a screenshot of the message granting the reduction. The other produces a full export showing that the reduction was conditional on payment within a week, which never came. The screenshot did not lie. It excerpted, and it damaged the person who produced it.

How to preserve it, in practice

• Export the whole conversation from the application, with attachments, not a portion of it, and save the file under the export date.
• Keep the original on the device. Do not delete the conversation after exporting; the export is a copy and the original is stronger.
• Do not change device or number before a reliable copy exists. A lot of evidence disappears during a phone upgrade.
• For email, save the message in its original format rather than copying the text into a document.
• Save attachments separately under their original file names; the attachment is often more important than the message.
• Record the context: who the other party is, in what capacity, from which number or address, and when the dealing began.

Attributing a conversation to its author

This is the most heavily contested point. The practical ways to strengthen it:

Tie the number to the person or the business: the number written into the contract, on the invoice, in an email signature, on a business card, or in earlier correspondence they never disputed.

A later acknowledgement: if the other side refers in a message or a formal letter to what was said in the chat, they have attributed it to themselves by their own conduct.

Consistency with performance: where the conversation records an agreement that was actually performed — a transfer made, a consignment shipped — the performance itself is an indication that what was said in it is accurate.

A domain email: a message from an address on the company’s own domain is stronger on attribution than one from a free personal account.

What weakens digital evidence

• Producing images that have been resized or cropped at the edges for no reason.
• Messages missing from the sequence between two dates, with no explanation.
• Relying on a group chat that includes people with no role in the dealing.
• Citing a voice note with no transcript and no preserved original file.
• Forwarding the conversation through an intermediary that re-compressed it and changed its data.

Other people’s privacy

Digital evidence usually carries more than the file needs: numbers belonging to people with no involvement, photographs, personal matters. Producing what does not serve the remedy is not a neutral addition; it intrudes on other people’s privacy and may expose the producing party to a complaint from another direction.

The rule: produce what relates to the matter in dispute. If a full conversation has to go in to show the context, flag what is unrelated and confine the argument to the relevant passage.

Recording calls and publishing conversations also have their own rules. The Anti-Cyber Crime Law penalises intercepting, capturing or eavesdropping on what is transmitted over an information network or a computer without a valid statutory justification; it penalises infringement of private life through the misuse of camera-equipped mobile phones or the like; and it penalises defaming others and causing them harm through information technology.

On the data-protection side, the Personal Data Protection Law excludes from its scope an individual’s processing of personal data for purposes no wider than personal or family use — but it qualifies that with a decisive condition: “so long as he has not published it or disclosed it to others.” The exemption falls away on publication or disclosure. So it should not be assumed that everything on a person’s device is theirs to publish or produce as they see fit.

Challenging the other side’s digital evidence

The other half of the question: what if the opponent produces a conversation that hurts you?

It is examined from the same three angles. Is it genuinely attributable to you? Is it complete or extracted? Is it in its original form, or in a form that could have been altered? Then its content is read: does it carry the meaning the other side has built on, or does the context allow another reading?

Very often the strongest answer to an extracted conversation is to produce the whole of it, rather than to deny it.

A conversation as a contract

A question that comes up often: can an agreement be concluded in a WhatsApp conversation? The practical answer is that what matters is whether the elements of an agreement are present and clear, not the medium on its own. Where a conversation contains a defined offer and an express acceptance by someone with authority, and performance then follows, there is a dealing that can be relied on even without a signed page.

But conversations are by nature fragmented and overlapping, so ambiguity is common: a quantity mentioned and then amended, a price quoted without saying whether it is inclusive, an approval given in a single word that could mean more than one thing. That ambiguity is resolved by what was actually performed and by the later correspondence.

A useful habit is to follow an agreement reached in a chat with a summary message: “Confirming what we agreed today: quantity x, price y inclusive of z, delivery on [date].” If the other side does not object, the file now contains a clear document instead of a conversation that needs interpreting.

What the employer should collect before someone leaves

In a business, much of the digital evidence sits with an employee: their email, their work phone, their conversations with suppliers and customers. When they leave, it leaves with them.

A standing procedure helps: redirect a departing employee’s email to a successor mailbox, export work-related conversations from company devices, and collect whatever documents they hold. It is a preventive administrative step whose cost does not compare to that of losing evidence in a later dispute.

When technical expertise is needed

In some files, producing the conversation is not enough because the integrity of the file itself is challenged: has it been altered, and is the date shown the real one? In such cases a technical expert may be asked to examine the file and its metadata.

That assumes one thing: that the original has been preserved. An expert examines an original or a sound copy of it, and can say nothing useful about an image that has been re-photographed and moved between several devices. Which is one more reason to preserve the original early.

In short

Digital evidence is neither conclusive in itself nor worthless. Its strength comes from three things: clear attribution, sound preservation, and complete context. Most of what is lost in this area is not lost in the hearing but months earlier — when a device is changed, a conversation deleted, or a screenshot treated as enough.

The single most useful step is simple: preserve the complete original at the first sign of a dispute, not when you decide to litigate.