Can My Employer Read My Work Emails?

Yes, but only within limits. Your employer can monitor your work email for a clear and legitimate purpose, after telling you about it, and by the least intrusive method available. Reading the content of your messages is hard to justify, and secret monitoring is allowed only in exceptional cases.

The law that applies

Monitoring your emails involves your personal data, so the UK GDPR and the Data Protection Act 2018 apply. Article 5 of the UK GDPR requires personal data to be processed lawfully, fairly and transparently, and only for specified purposes. Article 6 requires your employer to have a lawful basis, such as legitimate interests.

The Information Commissioner's Office, the ICO, publishes guidance called Employment practices and data protection: monitoring workers. The ICO states that this guidance is under review following the Data (Use and Access) Act 2025, so check the current version.

What your employer must do first

The ICO guidance states that your employer must be clear about its purpose for monitoring emails, must tell you about the monitoring in advance, for example in a policy, and must not access the content of messages without a clear policy in place. You should be told what is monitored, how and why.

Monitoring must also be necessary and proportionate. Your employer should use the least intrusive method that achieves its purpose. Checking who sent emails and when is less intrusive than reading what they say. Where monitoring is likely to pose a high risk to workers, your employer must carry out a Data Protection Impact Assessment before it starts.

Secret monitoring

Covert monitoring means watching your emails without telling you. The ICO states that it is unlikely to be justified in most circumstances. It may be justified in exceptional cases, such as a suspicion of criminal activity or gross misconduct, where telling you would defeat the purpose. Even then, the ICO expects senior authorisation, an impact assessment and a strict time limit, and the monitoring should not capture messages you would reasonably expect to be private.

Personal messages on work systems

Your employer can ban or limit personal use of work email. A ban does not give your employer the right to read your personal messages. The ICO guidance states that, where a worker is suspected of breaking a ban, the employer should look at network data first rather than the content.

Article 8 of the European Convention on Human Rights, the right to respect for private life, forms part of UK law through the Human Rights Act 1998. Your expectation of privacy is lower on a work account than at home, but it does not disappear.

Your right to see what was collected

Under Article 15 of the UK GDPR, you can make a subject access request for the personal data your employer holds about you, including monitoring records and any emails it reviewed about you. Your employer must normally respond within one month. It can extend this by up to two further months for complex requests, and it must tell you why.

If you believe your employer has monitored you unlawfully, raise it with your employer first, then complain to the ICO. If monitoring evidence is used to discipline or dismiss you, the way it was gathered is relevant to whether the dismissal was fair under section 98 of the Employment Rights Act 1996. Acas states that time limits for employment tribunal claims increased from 3 months to 6 months on 1 October 2026. The 3 month limit may still apply to problems that started before 1 October 2026. Check your deadline early and seek advice.

An example

A recruitment consultant with two years of service was called to a disciplinary meeting where her manager quoted from personal emails she had sent to her partner from her work account. The company had no monitoring policy, and she had never been told her emails could be read. Reading the content of those messages without a policy or notice is contrary to the ICO guidance. She can make a subject access request to learn what was accessed, and she can raise the monitoring at the disciplinary hearing.

What to do next

1. Ask for your employer's IT, email and monitoring policies, and its privacy notice for staff.
2. Make a subject access request in writing and keep a copy.
3. Write down any occasion when your messages were quoted or referred to, with dates.
4. Keep personal messages off work systems from now on.
5. Raise a grievance if you believe the monitoring went beyond what you were told.

Request the monitoring policy in writing before your next meeting with HR.

Frances N.U