Email monitoring by your employer: when may it read your email?

Yes, your employer can read your work email in the Netherlands, but only within narrow limits and never simply because the company owns the mailbox. Reading content always needs its own justification: a legitimate interest under the GDPR, a search that is necessary and proportionate, a written policy you knew about in advance and, where there is a works council, its prior consent to the monitoring arrangement.

Business email is a company system, so your employer sets the rules for its use. Below we explain when reading your email is lawful, where the limits lie and what you can do if your employer went too far.

Can my employer read my emails?

Yes, for a concrete business reason and only as far as that reason reaches. Two sets of rules apply at the same time: Dutch employment law and the GDPR.

Under Article 7:660 of the Dutch Civil Code (Burgerlijk Wetboek, BW) your employer may give instructions about the use of company equipment and check whether you follow them. Under the General Data Protection Regulation (GDPR, in Dutch AVG), the content of your mailbox and its traffic data are your personal data, so every inspection needs a legal basis. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises that second layer.

Technical access is not permission. A system administrator can nearly always open a mailbox or restore a deleted message, but whether your employer may look is decided by the GDPR and the duty to act as a good employer (goed werkgeverschap, Article 7:611 BW). The heavier the intrusion, the stronger the reason must be: automated spam and malware filtering is easy to justify, a manager reading months of a colleague’s correspondence is not.

On what legal basis may your employer monitor you?

Almost always on legitimate interest under Article 6(1)(f) GDPR, not on your consent. Consent under Article 6(1)(a) GDPR is rarely freely given in an employment relationship.

Legitimate interest demands three things, assessed and recorded before the mailbox is opened: a real and present interest, processing that is necessary to serve it, and a balance with your rights that comes out in the employer’s favour. Interests that hold up are concrete: a security incident, a suspected leak of trade secrets, suspected fraud or a duty to investigate imposed by a regulator. A general wish to see how hard people work does not.

The principles of Article 5 GDPR apply in full. Material found while investigating a data leak cannot be reused as a performance file, searches must be limited to what is necessary, and a mailbox export must be deleted once the investigation and any procedure are closed. For systematic and extensive monitoring, a data protection impact assessment (DPIA) is required under Article 35 GDPR. A clause in your contract agreeing to monitoring shows you were informed, but does not replace the balancing test or the works council’s consent. Our overview of email and data protection under the GDPR explains how these obligations fit together.

How do necessity and proportionality limit a search?

Necessity asks whether the goal can be reached without reading the mailbox at all. Proportionality asks whether the intrusion is in scale with the problem.

The least intrusive route comes first (subsidiarity). In a suspected data leak, that means metadata before content: sender, recipient, timestamp and attachments are often enough to confirm or dispel a suspicion. If a manager needs one file from the mailbox of a colleague on sick leave, the colleague can forward it or an administrator can run a narrow search; a mailbox during sick leave is likely to contain medical data, a special category under Article 9 GDPR.

A proportionate search is limited in people, search terms and time: the team concerned, terms tied to the leaked material and a window of weeks around the incident. It is carried out by someone without a personal stake, such as the privacy officer or an external specialist, and everything is logged.

Are private messages in a business mailbox protected?

Yes. Article 8 of the European Convention on Human Rights (ECHR) protects private life and correspondence at the workplace too, and Dutch courts apply it directly.

In Bărbulescu v. Romania (5 September 2017) the Grand Chamber of the European Court of Human Rights set out the factors to weigh: whether the employee was told in advance, how far the monitoring went, whether there were legitimate reasons, whether a less intrusive method was available, the consequences for the employee and the safeguards offered. When your employer comes across a message that is obviously private, or reveals health, religion, union membership or political views, it must stop reading and leave it out of the file.

Keep personal correspondence out of your work account, and move anything personal that does arrive into a clearly named folder. Messaging apps on your own device shift the balance further; see our article on whether your employer can read your WhatsApp messages.

Why does the works council have to agree first?

Because Dutch law gives the works council (ondernemingsraad) a right of consent over monitoring arrangements. Introducing, changing or withdrawing an email or internet monitoring arrangement needs its prior consent.

Article 27(1)(k) of the Works Councils Act (Wet op de ondernemingsraden, WOR) covers the processing and protection of personal data of staff, and Article 27(1)(l) covers facilities suitable for checking attendance, conduct or performance. Email logging, internet filtering, camera surveillance and productivity software fall under one or both. Without consent, the works council can invoke the nullity of the decision in writing within one month (Article 27(5) WOR), and ask the subdistrict court (kantonrechter) to order compliance.

What needs consent is the arrangement, not each individual investigation within it. A works council is compulsory where at least 50 people work (Article 2 WOR); in smaller organisations the GDPR requirements still apply in full.

What must a lawful monitoring policy contain?

A clear, written explanation of what is monitored, why and how, given to you before any monitoring starts. A general clause that “the employer may monitor communications” is not enough.

• the purposes of monitoring, described concretely;
• what is processed and by which means, including whether content can be read or only traffic data;
• who may authorise an inspection, who carries it out, and how the four-eyes principle applies;
• how long monitoring data and investigation results are kept;
• whether private use of company systems is allowed, and within what limits;
• employees’ rights, including access to their data and the right to complain to the AP.

An employer that promised keyword searches and then exports a full mailbox breaches its own published rules. Our note on understanding employer and employee obligations and our wider insights on the legal obligations of Dutch employers explain how these documents interact with the employment relationship.

How far may your employer go when it suspects misconduct?

Only as far as the documented suspicion reaches. A written decision at the start records the suspicion, the facts behind it, the purpose and why lighter means are not enough; widening the search because the first round found nothing is a fishing expedition.

Covert monitoring is only defensible where informing you would frustrate the investigation, for example because evidence would be destroyed, and must be temporary, narrow and disclosed afterwards. You have the right to be heard on the findings before conclusions are drawn.

Unlawfully obtained email evidence is usually still admitted in Dutch civil proceedings, because the interest of establishing the truth generally prevails. But the breach is not costless: it supports a claim for damages, a complaint to the AP, and a claim for fair compensation (billijke vergoeding) in a dismissal case. In a summary dismissal (ontslag op staande voet) the employer must show an urgent cause under Article 7:678 BW and act without delay, which an investigation dragging on for months undermines. Our guide on how to handle employee dismissal legally sets out that sequence.

Does the same apply to logging, chat, remote work and former employees?

Yes. Internet logs, VPN records, chat platforms such as Teams or Slack, access passes, mobile device management and productivity dashboards all need a specified purpose, necessity, proportionality, transparency and, where applicable, works council consent.

Continuous tools such as keystroke logging, interval screenshots and a webcam requirement for the whole working day are extremely difficult to justify; a Dutch court has held that requiring an employee to keep a camera on all day was an unacceptable intrusion into private life. Working from home raises the threshold, because the home is the core of the private sphere under Article 8 ECHR.

After you leave, your employer may not keep reading your mailbox. The account should be deactivated promptly, with an automatic reply naming a colleague, any forwarding limited to an announced period, and personal messages you flag handed over or deleted. You keep your right of access and can ask for erasure of data no longer needed (Article 17 GDPR).

What should you check as an employee?

If you think your employer read your email unlawfully, start with a written access request and keep a factual record. Act quickly if a dismissal is involved.

• Whether a written monitoring policy existed and was given to you before the monitoring.
• Whether the works council consented to the arrangement.
• Which data your employer processed, via an access request under Article 15 GDPR, which must be answered within one month.
• Whether private messages or medical data were read.
• Whether you were heard before conclusions were drawn.
• The deadlines if a dismissal follows, such as two months to challenge a summary dismissal.

What should you check as an employer?

Document your reasoning before you open a mailbox. An employer that cannot reconstruct its investigation is in a weak position before the AP or a court.

• A recorded legitimate interest and balancing test under Article 6(1)(f) GDPR.
• A written, communicated monitoring policy and, where required, a DPIA.
• Prior works council consent under Article 27(1)(k) and (l) WOR.
• A search limited in people, terms and time, run by an independent person and logged.
• A procedure for private messages and special categories of data found during a search.
• Retention and deletion of investigation data once the matter is closed.

What can we do for you with email monitoring at work?

Our employment lawyers advise employees and employers on monitoring, privacy and the dismissal disputes that follow.

• We draft your access request under Article 15 GDPR and assess the employer’s answer.
• We assess whether an investigation behind a warning, suspension or dismissal was lawful.
• We claim damages or fair compensation, or defend against such a claim, before the subdistrict court.
• We draft a complaint to the Autoriteit Persoonsgegevens.
• For employers, we draft the monitoring policy and the request for works council consent.
• We set up the investigation protocol: scope, search terms, independent investigator and logging.

Summary

• Your employer may read your work email only for a concrete, recorded business interest, and only as far as that interest reaches (Article 6(1)(f) GDPR).
• The search must be necessary and proportionate: metadata before content, limited in people, search terms and time, carried out independently and logged.
• You must know the monitoring policy in advance, and where there is a works council, it must have consented to the arrangement (Article 27 WOR).
• Clearly private messages and special categories of data stay out of the file, also during a lawful search.
• If you suspect the monitoring went too far, start with an access request under Article 15 GDPR and act quickly if a dismissal is involved.

Frequently asked questions