In short
With decision no. 165 of 12 March 2026 the Garante confirmed that the emails in an individual mailbox are the assigned user's personal data, which a former employee can also access under Article 15.
With decision no. 278 of 17 April 2026 the Garante reiterated that the mailbox must be deactivated and removed within a reasonable time, with an automatic reply giving alternative addresses.
Reading or forwarding a former employee's email to ensure continuity was found neither necessary nor proportionate: continuity comes from shared addresses and document management.
A backup is also processing: keeping the entire content of mailboxes for years breaches the principles of Article 5 of the GDPR.
Policy, privacy notice and actual settings must match, and those who manage accounts need written instructions.
On 12 March 2026 the Italian Data Protection Authority (Garante per la protezione dei dati personali) adopted decision no. 165, an injunction order against a company that had not given a former employee the full contents of his named business mailbox. On 17 April 2026, with decision no. 278, the Garante acted against another company that had kept former employees' email accounts active for around six months. Both texts are published on the Garante's website and confirm a line the Authority has followed for years: an individual mailbox is not a company archive.
In this article we look at what the two decisions established, what a company can do with the mailbox of someone who leaves (deactivate it, set an automatic reply, keep it, read it or forward it) and what HR and IT should sort out straight away. This is not legal advice: every case should be assessed with your DPO or privacy adviser. If you need a refresher on principles and legal bases first, start with our guide on what the GDPR is.
What the Garante decided in 2026
The two decisions concern situations that are very common in SMEs: a former employee asking for their email back, and a mailbox left switched on "just in case" after someone leaves. In both cases the Garante found GDPR infringements and required the companies to revise policies and privacy notices.
Decision no. 165 of 12 March 2026: the former employee's access
A former employee had asked, under Article 15 of the GDPR, for a copy of the email in his individual business mailbox. The company handed over the correspondence after reviewing it and partly redacting it, to protect third-party data and business information. According to the Garante, the emails in an individual account are the assigned user's personal data, and the right of access can be restricted only in the cases provided for by the GDPR (Articles 12(5) and 15(4)). A generic fear of disclosing trade secrets is not enough.
The decision goes beyond the right of access. The company kept the content of mailboxes in backup for five years: for the Garante this breaches the principles of purpose limitation, data minimisation and storage limitation (Article 5(1)(b), (c) and (e)). The email backup was also not mentioned in the privacy notices, which gave retention periods that did not match each other. The Garante also found the twelve-month retention of browsing logs excessive.
Another passage concerns remote monitoring. According to the Garante, a policy that allows access to email and logs can fall under Article 4 of the Italian Workers' Statute (Law 300/1970) even if no monitoring was actually carried out. As well as an administrative fine, the Authority ordered the company to give the former employee full access to the correspondence and to bring its policies and processing into line within 90 days.
Decision no. 278 of 17 April 2026: the mailbox left active
In the second case a company had kept two former employees' email accounts active for around six months after they left, citing the handover of clients, the recovery of information and possible litigation that was never started. The Garante reiterated that the account must be removed within a reasonable time, after deactivating it and activating automatic systems that inform third parties and give alternative addresses.
The decision found several infringements: of the principles of fairness, data minimisation and storage limitation; of Article 6, because the legitimate interest relied on was not supported by a balancing test carried out beforehand; of Article 13, for an inadequate privacy notice; of Articles 12 and 17, for failing to reply in time to an erasure request; and of Article 29, because the IT staff managing the accounts had no written instructions. The Garante ordered the company to draw up a complete privacy notice and to instruct its IT department within 60 days.
Why a named mailbox does not belong only to the company
The domain is the company's, so is the server, and the mailbox is there for work. Yet the Garante, as far back as its 2007 guidelines on email and internet use, pointed out that the content of messages and the external data of communications are protected by confidentiality safeguards. In decision no. 165 the Authority also refers to Article 8 of the European Convention on Human Rights: correspondence in the workplace falls within private life.
Two practical consequences follow. First, an address such as firstname.lastname@company.com identifies a person, and everything that passes through it is processing of personal data that needs a specific purpose and a legal basis (Articles 5 and 6 of the GDPR). Second, if email is kept for a long time or made accessible to others, it can become a tool for indirectly monitoring the employee, and then Article 4 of Law 300/1970 comes into play.
Article 4 allows tools that also make remote monitoring possible only for organisational and production needs, workplace safety or protection of company assets, and subject to a trade union agreement or authorisation from the Labour Inspectorate. For tools used to perform the work, such as email, no agreement is needed, but the information collected can be used only if the employee has been given adequate information and in compliance with privacy law. According to the Garante, however, prolonged collection of logs or a policy that allows access to email and logs may amount to remote monitoring that requires the safeguards of paragraph 1.
These decisions are Italian, but the GDPR principles they apply are the same across the EU. If you operate in another country, also check the national employment rules on workplace monitoring.
What a company can do with a former employee's mailbox
Here is a summary of what the Garante's decisions say about the most common actions. No decision sets a number of days that applies to everyone: they set out principles, and it is up to the controller to define and justify the timescales in its own policy.
Action | Garante's position | How to set it up |
|---|---|---|
Deactivate the mailbox | To be done on termination; the account must then be removed within a reasonable time (decisions no. 278/2026, no. 53/2018) | Deactivation date tied to the leaving date, in the offboarding procedure |
Automatic reply | Automatic systems that inform third parties and give alternative addresses | Neutral message with an office or team address, for a defined short period |
Read or forward email | Access to the content of a former collaborator's mailbox neither necessary nor proportionate for continuity (decision no. 732/2024) | Avoid it; ensure continuity through shared addresses and document management |
Keep the content | Blanket retention, including in backups, contrary to Articles 5 and 6 (decisions no. 165/2026, no. 732/2024) | Short, justified timescales, with deletion checked in backups too |
Reply to the former employee's access request | Full access, restricted only in the cases provided for by the GDPR (decision no. 165/2026) | Procedure for replying on time, with the DPO |
Deactivate and reply automatically
The starting point has been clear for years: on termination the named mailbox must be deactivated and then removed, with an automatic system that tells senders whom to contact. It is the same principle set out in decision no. 53 of 1 February 2018 and repeated in 2026. In that 2018 case the Garante also pointed out the need to permanently block the receipt and storage of messages on the company's servers.
The automatic reply should serve third parties, not hold on to email. A simple text works: the person is no longer with the organisation; for communications, write to a team address such as sales@ or accounts@. The message should stay active for a short, predefined period written into the policy, after which the address is removed. In decision no. 278 an actual six months was considered excessive.
Reading or forwarding email: the most sensitive point
The most common temptation is to forward the former employee's email to the colleague who takes over, or to give someone access to the mailbox "so nothing gets lost". In decision no. 732 of 27 November 2024 the Garante held that access to the content of a former collaborator's mailbox by their successor is neither necessary nor proportionate, and that keeping the mailbox for mere business continuity purposes has no legal basis under Article 6.
Continuity is ensured beforehand, not afterwards. The Garante points to document management systems as the right tool for keeping work documents, because email, by its nature, does not provide the features of an archive. In practice: contracts, orders and relevant communications should be saved in company folders or systems during employment, and contacts with clients and suppliers should go through shared addresses.
Retention: content, metadata and backups
Mailbox content and metadata are two different things. For metadata, that is the server logs with sender, recipient, times and sizes, the Garante's guidance document of 6 June 2024 indicates that retention should not exceed 21 days, unless there are documented special needs. Prolonged log collection may amount to remote monitoring and require the safeguards of Article 4 of the Workers' Statute. The same document states that these indications do not concern the content of messages.
On content, decision no. 165 says something many companies underestimate: a backup is also processing. Deleting the mailbox from the server is not enough if a full copy remains in backups for years. Retention periods should therefore be set for the active mailbox, the deactivated one and the backups, and must match what the privacy notice says.
There is a narrow exception: in the 2018 case the Garante allowed data already collected to be kept for the defence of legal claims, where there was a dispute. A generic, future defensive purpose, however, does not justify keeping everything. If there is a concrete dispute, the decision should be taken case by case with the DPO and documented.
Replying to the former employee's access request
After decision no. 165 it is clear that a request for access to one's own mailbox must be handled like any Article 15 request: with a procedure, within the GDPR deadlines and without upfront filtering not provided for by the law. Restrictions are possible only in the cases set out in the Regulation, and must be justified. In decision no. 732 of 2024 the Garante had also ordered the company to give the former collaborator access to his correspondence.
And during employment?
Many problems at the exit stem from how email was handled before. Since 2007 the guidelines have suggested three measures: providing shared addresses for offices and teams alongside individual ones, letting everyone set an automatic reply when absent, and adopting clear internal rules on email use.
For sudden absences, the same guidelines allow the employee to name a trusted colleague who, if needed, checks the messages and forwards those relevant to the work. The operation should be recorded in a written report and the employee informed at the first opportunity. It is a solution designed for an emergency, not for routine access to someone else's mailbox.
Checklist for HR and IT: what to do now
These are the checks to make now, before the next person leaves. Involve your DPO, if you have appointed one, and whoever administers the email system: many of the answers are technical settings, not just documents.
Email policy: there are internal rules stating what happens to the mailbox on termination, with precise timescales for deactivation, automatic reply and deletion.
Employee privacy notice: it states purposes and retention periods for mailbox, logs and backups, and matches the policy and the actual settings.
Offboarding procedure: HR tells IT the leaving date, and IT deactivates the account and sets the automatic reply with a team address.
No automatic forwarding: incoming email is not passed on to colleagues or read by the successor.
Backups and logs: retention periods are defined, short and justified, and deletion reaches the backup copies too.
Written instructions for IT: those who manage accounts have documented instructions on what they may and may not do, as Article 29 requires.
Data subject requests: there is a procedure for access and erasure requests from employees and former employees, with deadlines and owners.
Shared addresses: relationships with clients and suppliers go through team mailboxes, not only named ones.
Common mistakes
The decisions reveal recurring mistakes, often made in good faith. The first is keeping the mailbox open for weeks or months "until all the clients have been handed over": exactly the case in decision no. 278.
The second is using email as an archive, with multi-year backups of the entire content of mailboxes, as in decision no. 165. The third is relying on legitimate interest without having carried out and documented the balancing test before starting the processing.
Other frequent mistakes are privacy notices that say one thing and the policy another, an automatic reply that holds on to email instead of redirecting it, IT staff without written instructions and access requests answered late or with correspondence filtered in advance. Finally, a policy that allows access to email and logs without assessing Article 4 of the Workers' Statute can cause problems even if no monitoring is ever carried out.
What to do in the medium term
Once the urgent work is done, it makes sense to treat email as a separate processing activity in the record of processing: purposes, data categories, retention periods for content, metadata and backups, security measures. If you rely on legitimate interest for any purpose, document the balancing test before you start, as decision no. 278 requires.
The second step is organisational: move work documents out of mailboxes into a document management system with shared folders and filing rules. It is the solution the Garante points to, and it reduces the temptation to look into the email of someone who is leaving. Then review the policy at least once a year and whenever you change email provider or backup tools.
Finally, think about security. A mailbox forgotten and left active keeps receiving messages, perhaps containing client data, and is one more entry point to protect. If personal data ends up with someone who should not have it, for example through a wrong forward, assess whether it is a breach to be handled as we explain in our guide on a data breach in the first 72 hours.
How Complaion helps with GDPR and data protection
Complaion supports companies with GDPR compliance and with certifications on information management. A dedicated Lead Auditor starts from where you are, checks what you already have and what is missing, and proposes the route that suits you best among GDPR compliance, ISO 27701 and ISO 27001.
The platform gathers the evidence, manages policies, privacy notices and the record of processing, keeps the review schedule and gets you ready for the audit. The Lead Auditor also conducts the internal audit, so you know whether your procedures really work. If you need a data protection officer, there is the outsourced DPO service.
More than 1,000 clients have already chosen Complaion. If you want to work out where to start, get in touch.
Frequently asked questions about a former employee's mailbox
Can I read a former employee's email so as not to lose work information?
According to the Garante, accessing the content of a former collaborator's mailbox to ensure continuity is neither necessary nor proportionate. Continuity should be ensured through shared addresses and document management systems during employment. For special situations, such as an ongoing dispute, assess case by case with the DPO.
Can I forward their email to a colleague?
Forwarding incoming email to the successor is, in practice, a form of access to the content, and the Garante has found access for continuity purposes not proportionate. The solution it points to is an automatic reply that informs senders and gives an alternative address.
How long should the automatic reply stay active?
No decision sets a number of days that applies to everyone. The Garante asks for the account to be removed within a reasonable time, and in decision no. 278 of 2026 it found around six months excessive. Set a short period in the policy, justify it and stick to it.
How long can I keep mailbox content and backups?
The period must be set by the controller on the basis of a specific purpose and stated in the privacy notice. The Garante found the five-year retention of the entire content of mailboxes in backup unlawful, because a backup is also processing. For metadata, the 2024 guidance document indicates not exceeding 21 days unless there are documented needs.
Can a former employee ask for a copy of their business emails?
Yes. With decision no. 165 of 12 March 2026 the Garante confirmed that the emails in an individual mailbox are the assigned user's personal data, accessible under Article 15 of the GDPR. Access can be restricted only in the cases provided for by the GDPR, not because of a generic fear of disclosing business information.
Is a trade union agreement needed to manage business email?
Under Italian law, for normal use of email as a work tool Article 4 of the Workers' Statute does not require an agreement, but employees must be given adequate information. If the policy provides for prolonged retention or access to content and logs, however, it may amount to remote monitoring: in that case check with the DPO whether a union agreement or Labour Inspectorate authorisation is needed.
