Your Employer Is Monitoring Your Emails
Workplace email monitoring is lawful if it has a valid legal basis under UK GDPR, is proportionate, and employees have been told. Covert monitoring has a much higher threshold. You have data subject rights including the right of access.
Quick Answer
Employers can monitor work emails if they have a lawful basis under UK GDPR Article 6 (typically legitimate interests), have carried out a Data Protection Impact Assessment, and have told employees in a monitoring policy. Covert monitoring is only lawful in exceptional circumstances. You can submit a Subject Access Request to see what data has been collected about you, and complain to the ICO if you believe the monitoring is disproportionate.
Full Explanation
UK GDPR (as retained in domestic law post-Brexit) and the Data Protection Act 2018 apply to the processing of employees' personal data, including the contents and metadata of work emails. An employer cannot monitor emails without a lawful basis under UK GDPR Article 6. In practice, employers usually rely on Article 6(1)(f) โ legitimate interests โ but must demonstrate that the monitoring is necessary, proportionate, and does not override employees' fundamental rights.
The Privacy and Electronic Communications Regulations 2003 (PECR) are also relevant where monitoring involves interception of electronic communications. Under the Investigatory Powers Act 2016 and the Lawful Business Practice Regulations 2000, employers may monitor communications (including emails) for specified business purposes โ such as recording transactions, monitoring standards, or preventing crime โ provided employees have been informed that monitoring may occur.
The ICO's Employment Practices Guidance (and the newer ICO Employment Guidance on monitoring at work) makes clear that employers should carry out a Data Protection Impact Assessment (DPIA) before implementing monitoring, should have a transparent monitoring policy communicated to workers, and should only monitor to the extent necessary for the stated business purpose. Blanket, indiscriminate monitoring is unlikely to satisfy the proportionality requirement.
Covert monitoring โ monitoring without telling employees โ is only lawful in very limited circumstances, such as investigating a specific, well-founded suspicion of serious wrongdoing where notifying the employee would prejudice the investigation. Even then, the monitoring must be targeted, time-limited, and reviewed regularly.
You have the right under UK GDPR Article 15 to submit a Subject Access Request (SAR) to your employer, requiring them to disclose all personal data held about you โ including emails and any monitoring records. The employer must respond within one calendar month. If you believe the monitoring is unlawful, disproportionate, or that the employer has failed to respond to a SAR, you can complain to the Information Commissioner's Office (ICO). If you are dismissed based on evidence obtained through unlawful monitoring, this may also give rise to unfair dismissal and potentially privacy-related Employment Tribunal claims.
Legal Basis
- ยงUK GDPR Art 6 โ Lawfulness of processing
- ยงUK GDPR Art 15 โ Right of access
- ยงData Protection Act 2018
- ยงPrivacy and Electronic Communications Regulations 2003 (SI 2003/2426)
- ยงLawful Business Practice Regulations 2000 (SI 2000/2699)
- ยงInvestigatory Powers Act 2016
What To Do
Request the Employer's Monitoring Policy and DPIA
Ask HR for a copy of the employer's monitoring policy and, if one exists, the Data Protection Impact Assessment. You are entitled to see these under UK GDPR transparency requirements. The policy should state what is monitored, why, how long data is retained, and who can access it.
Submit a Subject Access Request
Submit a written SAR to your employer under UK GDPR Article 15, requesting all personal data held about you, including email content and metadata, monitoring logs, and any reports generated from monitoring activity. The employer must respond within one calendar month.
Complain to the ICO if the Monitoring Is Disproportionate
If the monitoring appears to be excessive, covert without justification, or in breach of UK GDPR, submit a complaint to the ICO. The ICO can investigate the employer and issue enforcement notices or fines for serious breaches.
Consider an ET Claim if Dismissed on Monitored Evidence
If you have been disciplined or dismissed on the basis of evidence obtained through monitoring, and you believe the monitoring was unlawful, take legal advice on whether an unfair dismissal or privacy claim can be brought. The Employment Tribunal can consider the lawfulness of evidence gathering in the context of a dismissal.
Important Deadlines
Important Warnings
The fact that you used a work device or work email does not automatically make all monitoring lawful โ proportionality and transparency obligations still apply.
If you are using personal email on a work device, the employer's monitoring policy may still capture it โ check what is stated in the policy.
Do not delete or alter emails or files once you are aware of monitoring or an investigation โ this can constitute misconduct and may damage any legal claim you bring.