My employer monitors my work emails. Is this allowed under EU privacy law?

What the Law Says

EU privacy law — primarily the General Data Protection Regulation (GDPR) — governs workplace email monitoring. Employers must comply with core principles: lawfulness, fairness, transparency, purpose limitation, data minimisation, and accountability.

Monitoring work emails involves processing personal data (e.g., names, content, timestamps), so it falls squarely under the GDPR. To be lawful, the employer must rely on a valid legal basis under Article 6 — most commonly 'legitimate interests' (Art. 6(1)(f)), though consent is rarely appropriate in employment due to imbalance of power.

Transparency is mandatory: under Article 13, employers must inform employees before monitoring begins — specifying the purposes, categories of data, recipients, retention periods, and rights (e.g., access, erasure). A vague or generic privacy notice is insufficient.

The monitoring must also be proportionate and necessary. For example, blanket scanning of all emails for keywords without justification violates data minimisation (Art. 5(1)(c)). A Data Protection Impact Assessment (DPIA) is required under Article 35 if monitoring is 'likely to result in a high risk to the rights and freedoms of natural persons' — such as continuous, automated, or intrusive surveillance.

Statutory Text

Processing shall be lawful only if and to the extent that at least one of the following applies: … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller…

— Regulation (EU) 2016/679, Art. 6(1)(f) — Lawfulness of processing

Statutory Text

Where personal data are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with… information on the identity of the controller, the purposes… and the existence of the right to request… erasure…

— Regulation (EU) 2016/679, Art. 13(1) — Information to be provided where personal data are collected from the data subject

Statutory Text

The controller shall, prior to processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data… where a type of processing… is likely to result in a high risk to the rights and freedoms of natural persons.

— Regulation (EU) 2016/679, Art. 35(1) — Data protection impact assessment

Sources