The lawyer's 5-point checklist for a successfully GDPR compliant email policy

Define a company-wide email policy, and remember to motivate it — not everyone knows about GDPR

Why do you suddenly want to have a systematic approach to how you handle emails within the company? How is this going to happen? Automatic processes or manual procedures? What is the actual plan? Starting when? What is captured? What is not?

"Start with a why"

Remeber to distinguish between private and business emails

Maybe you don't even allow private emails in the company email system. If you do, you must take great care. You need specific procedures for handling private emails. And no matter what, you must inform your employees.

"Private vs business"

Define who can access a business email — besides the sender and recipient

A shared email archive offers many advantages. Letting everyone access any e-mail in the company is uncomfortable for the people involved, and also illegal. Emails potentially contain personal data, and you must limit access to a 'need to know basis'.

"Protect sensitive information"

Describe how business emails are treated when people leave your company

A company mailbox cannot be left unattended, when someone leaves the company. What happens to emails already in the mailbox? And new ones? Probably you don't want the now former employee to communicate their departure with an 'emotional' out of office.

"When people move on"

Make the email policy an incorporated part of your employment setup

All of the above must be made an integrated part of your employment setup. Your employee handbook, and your employment contracts. And don't forget to communicate this update to your employees — starting with a why.

"Integrate the policy"

I hope I inspired you to plan for a successful implementation of GDPR compliant email policy.
If you need legal assistance or more inspiration, we are happy to help.

Torsten Hylleberg
Attorney at Law, Head of IT Law at Lund Elmer Sandager

Get in contact with the lawyer