Learn how companies can manage former employees' email accounts in a data-protection-compliant way, particularly in line with the GDPR. This guide outlines best practices for meeting legal requirements, protecting sensitive data, and avoiding risks like fines or data breaches. Discover practical measures for handling email data securely after an employee leaves the company.

Handling Former Employees' Email Accounts Under the GDPR

When an employee leaves a company, their email account holds valuable data such as communication history, contacts, and potentially sensitive information. While it may seem practical to keep this data for possible future use, it's important to know the legally correct approach: the solution is to delete the account or manage it properly.

A ruling by the Belgian Data Protection Authority (DPA) clarified this issue, defining the necessary measures regarding how long a former employee's email account may stay active and whether employers may continue to access its contents. In 2020, a company was hit with a €15,000 fine for failing to properly handle former employees' email accounts. Specifically, the company kept the email accounts (bearing the ex-employees' first and last names) active for 2.5 years before closing them.

According to the ruling and the Belgian DPA's guidelines, failing to deactivate such email accounts after an employee leaves violates key GDPR principles. The violations concerned:

  • Lawfulness: There was no valid legal basis for storing the email data for so long.
  • Purpose limitation: The data was retained beyond its original purpose.
  • Data minimization: Full access to the entire mailbox was disproportionate.
  • Storage limitation: The retention period was not appropriate.

This ruling provides important guidance for companies on how to handle former employees' data in a GDPR-compliant way. Proper management not only protects sensitive information but also facilitates a smooth handover of ongoing business processes and relationships.

Employers should therefore implement clear policies to deactivate and delete former employees' email accounts promptly after they leave, retaining data only as long as legally required and justified.

Best Practices for After an Employee Leaves

How an employer handles and supports an employee's departure can significantly affect the experience for both parties. Post-employment practices are crucial for maintaining a positive relationship between employers and former employees. Here are some best practices employers should keep in mind:

Immediate account deactivation Lock the former employee's email account immediately after they leave the company.
Notifying the departing employee Inform the departing employee before deactivating their account. This allows them to organize their private emails and forward them to their personal email address before leaving the company.
Implementing an auto-reply Set up an auto-reply that indicates the person has left and provides alternative contact details, instead of automatically forwarding emails. This method is preferred, as seen in the reviewed case handled by the data protection authority.
Flexible deactivation timing Deactivate the email address and the auto-reply after a reasonable period, usually one month. However, depending on the former employee's role and responsibilities, an extension of up to three months may be justified. Any extension should be discussed with, or at least communicated to, the former employee.
Temporary account retention Retain the email account temporarily based on the company's legitimate interests, particularly to ensure business continuity and proper operations.
Retrieving essential emails Retrieve essential emails needed for business operations or to comply with statutory retention periods from the account before the employee leaves and in their presence, to avoid ongoing access requests after departure.

Legal Considerations After Departure

Data protection laws and compliance
It's essential to comply with local and national data protection laws, including the GDPR (General Data Protection Regulation), which governs how personal data must be processed, stored, and handled. Organizations should know the specific requirements of these laws and assess how they apply to their data practices. In some cases, there are statutory retention obligations for certain emails.

Company policies and agreements
Clear company policies should govern the management of former employees' email accounts. Agreements made with employees regarding data access after their departure must be honored. It's important to review these policies regularly and adapt them to new legal requirements or organizational needs.

External Data Protection Officers
Companies should consider appointing a Data Protection Officer (DPO), whether internal or external, to ensure compliance with regulations like the GDPR. DPOs bring valuable expertise, help identify data protection risks, provide important training, and keep the company up to date on relevant legal changes.

Employee training and awareness
Data protection and awareness training is essential for helping employees understand the importance of protecting personal data, recognize the risks of data breaches, and learn how to handle data securely. For example, heyData offers a solid employee training program that covers the consequences of leaving sensitive information in email accounts, among other things. 

Final Thoughts

Managing and accessing former employees' email accounts is a delicate balance between data security, legal compliance, and ethical responsibility. Following clear policies, complying with data protection laws, and taking a structured approach ensure a smooth transition while protecting sensitive information.

With these strategies, companies can effectively manage employee departures while prioritizing data security and legal compliance, ensuring a seamless transition for both departing employees and the company.