WhatsApp for Australian Migration Agents in 2026: MARA Code of Conduct, Privacy Act, and Document Security

Australia's Migration Agent Sector: Scope and Client Communication Volume

The Migration Agents Registration Authority (MARA) registers and regulates migration agents in Australia. As of 2025, approximately 6,500 migration agents are registered with MARA, providing immigration advice and assistance to a substantial portion of Australia's visa applicant population.

Australia processes millions of visa applications annually. The Department of Home Affairs (DHA) reports over 9.5 million visa decisions in 2023–24, spanning visitor visas, student visas, skilled migration, partner visas, and humanitarian programs. Migration agents assist applicants across all visa categories, with the most common caseloads in student, skilled, and partner visa streams.

The client base for Australian migration agents is inherently multicultural and multinational: applicants from India, China, the Philippines, Vietnam, Nepal, Bangladesh, and dozens of other countries. WhatsApp is the dominant messaging platform in many of these countries and the primary communication channel for many visa applicants communicating with their Australian migration agent. This creates a natural demand for WhatsApp-based communication in migration agencies — but the regulatory context is stricter than in most other small business verticals.

MARA Code of Conduct: Professional Obligations for Client Communication

Migration agents registered with MARA are bound by the Code of Conduct for Registered Migration Agents (the Code), set out in the Migration Agents Regulations 1998. The Code sets standards for professional conduct that apply to all client communications, including digital and messaging channels.

Key Code obligations relevant to WhatsApp use:

Duty of confidentiality (Clause 2.1): Migration agents must not disclose confidential client information without the client's consent. This applies regardless of the communication channel. Sharing a client's visa status, application details, or personal circumstances in any WhatsApp chat — including group chats with other clients, colleagues not involved in the matter, or family members of the agent — is a Code breach.

Duty to keep records (Clause 2.9): Agents must maintain a file for each client that includes all written communications. Correspondence relevant to the migration matter — instructions received from the client, advice given, significant representations made — must be documented. A WhatsApp conversation in which a client provides instructions or an agent provides advice is correspondence that should be captured in the client file, not left only on a personal device.

Duty to provide a written service agreement (Division 4): Agents must provide clients with a written service agreement before providing immigration assistance. A WhatsApp conversation agreeing to provide services does not satisfy this requirement.

Obligation to refer to DHA and the Administrative Appeals Tribunal: Significant communications about visa decisions, review rights, or DHA correspondence should be documented formally, not conveyed solely through WhatsApp.

Privacy Act 1988: Immigration Records as Sensitive Personal Information

Immigration records contain extensive personal information that qualifies as sensitive under the Privacy Act 1988. This includes:

• Passport and national ID details
• Health assessment results (required for many visa subclasses)
• Police clearance certificates (character requirements)
• Financial records and bank statements
• Family relationship documents (birth certificates, marriage certificates)
• Employment and education history
• Biometric information in some cases

Under Australian Privacy Principle 3, sensitive information can only be collected if the individual consents and it is reasonably necessary for the agent's functions. Under APP 11, it must be protected from misuse and unauthorised access.

The critical WhatsApp concern for migration agents: clients routinely share these documents informally via WhatsApp — a passport photo sent via messaging to speed up an application. Once in WhatsApp, this sensitive document is:
- Stored on Meta's infrastructure (cross-border disclosure under APP 8)
- On the agent's personal device without institutional access controls
- Potentially accessible if the agent's WhatsApp account is compromised
- Not easily exportable to a secure client records system with an audit trail

Migration agents should establish a clear protocol: for correspondence and logistics, WhatsApp is acceptable; for document transfer, direct clients to a secure client portal (many practice management tools for migration agents include document vaults). Communicate this policy to clients at the outset of the engagement.

Document Security: The WhatsApp Risk for Visa Applications

The most significant practical risk for migration agents using WhatsApp is document handling. Visa applications require certified copies of identity documents, government-issued certificates, and health and character assessments. Clients who are accustomed to using WhatsApp in their home country naturally default to sending documents this way.

When a client sends a copy of their passport, visa application form, or police clearance via WhatsApp:

The document is not end-to-end encrypted at rest on Meta's servers. WhatsApp's end-to-end encryption protects messages in transit between sender and recipient. However, media files stored in WhatsApp's backup systems (Google Drive or iCloud backups) are not necessarily encrypted to the same standard.

The agent's personal device becomes a single point of failure. A lost or stolen phone holding WhatsApp conversations with passport photos and police clearances exposes significant personal data belonging to potentially dozens of clients.

The document is not automatically in the client file. A compliant client record requires a systematic file. Documents buried in WhatsApp chats are difficult to locate, version-control, or transfer to another agent if the original agent is unavailable.

Practical protocol:
1. Establish a secure document portal at onboarding
2. Explain to clients (in their preferred language if needed) why documents must go through the portal
3. For urgent matters where a client sends a document via WhatsApp, acknowledge receipt and request the client upload the official version to the portal
4. Never forward client documents between WhatsApp accounts or to third parties via WhatsApp

Where WhatsApp Works Well for Migration Agents

Given the regulatory constraints, here is where WhatsApp genuinely adds value for migration agents:

Client engagement and logistics: WhatsApp is appropriate for scheduling consultations, sending appointment reminders, providing status updates ('Your application was submitted to DHA today — we expect a decision in approximately 8 weeks'), and answering simple factual questions that do not involve sensitive information.

Multilingual communication: WhatsApp's international reach is a practical advantage. For clients whose primary language is not English, WhatsApp allows agents or bilingual staff to communicate in the client's language more naturally than formal letter exchanges.

Initial enquiry handling: Before engagement, WhatsApp can manage prospective client enquiries, provide general information about visa categories, and schedule consultations. This is appropriate because no sensitive personal information has been collected yet.

Progress notifications: 'Your visa grant has arrived — please check your email for the formal notification and grant letter' is an ideal WhatsApp use: brief, non-sensitive, and actionable.

What to keep out of WhatsApp:
- Document transfers (passports, certificates, health assessments)
- Specific advice about visa strategy or legal compliance risk
- DHA correspondence content
- Fee agreements and service terms
- Client instructions that would form part of the agency authority record