When an Employee Leaves: What Should You Do With Their Email Account?

When a member of staff leaves your organisation, there is a lot to think about, handovers, access permissions, and farewells. But one thing that often gets overlooked is the departing employee's email account. Under GDPR and data protection law, how you manage that inbox matters more than you might think.

Here is what good practice looks like and what the rules actually require.

Close the Account Promptly

The first step is straightforward, close the employee’s work email account at the time of their departure. Leaving an account open and unmonitored creates real risks. Emails containing personal data, sometimes sensitive personal data, continue to arrive and sit in an inbox that the organisation has no clear lawful basis to access.

The departing employee should be told that their account is being closed. This is not just courtesy, it is a transparency requirement under GDPR. People are entitled to know what is happening with their personal data, and a work email address is closely linked to their professional identity.

Set Up an Automatic Reply, Not a Forwarding Rule

For a period after departure, it is reasonable and good practice to set up an automatic reply on the closed account. Anyone who emails the former employee should receive a message letting them know that the person has left the company, along with the contact details of a relevant colleague or team they can reach instead.

This matters because of what it avoids. Automatically forwarding incoming emails to another employee is a much riskier approach. Whoever sent that email did not consent to their message, which could contain confidential, sensitive, or simply private information, being read by someone else. The same concern applies to the former employee, their correspondence is being redirected without their knowledge or agreement. An autoreply sidesteps this problem entirely.

The legal basis for keeping the email account live, even just to send an automatic response, is the company’s legitimate interest in maintaining organisational continuity. But that interest only stretches so far.

Time Limits Apply and They’re Short

The automatic reply should not run indefinitely. The expectation from data protection authorities is that both the email account and the auto-reply message should be deleted within a reasonable period, and that means within one month of the employee’s departure in most cases.

One month is not long. But it reflects the reality that the legitimate interest in continuity diminishes quickly. After a few weeks, anyone who regularly corresponded with that person will have updated their contacts. The need for the autoreply fades, and with it, the lawful basis for keeping the account running.

Extensions: Possible, But Justified and Time-Bound

There are situations where a longer period might be warranted, for example, if the departing employee held a senior or client-facing role with a wide external network. In those cases, an extension beyond one month can be considered, but it should not exceed three months.

Any extension needs to be justified, not just assumed to be convenient. And critically, the former employee should either agree to the extension or, at a minimum, be notified that it is happening. Keeping someone’s professional email address active without their knowledge is problematic from a GDPR perspective.  It could also be expensive as several large fines have been handed out by EU data protection authorities, to companies that kept former employee emails active.

After three months, there is no legal basis to continue operating the account in any form. The autoreply and the email address itself should be fully deleted.

The Bottom Line for Businesses

To summarise what good practice, and GDPR compliance looks like in this area:

• Close the email account on the employee’s last day and inform them.

• Set up an auto-reply (not a forwarding rule) with alternative contact details.

• Delete the account and autoreply within one month.

• If an extension is genuinely needed, cap it at three months and notify the former employee.

• •  Never use automatic forwarding, it creates consent issues for both the sender and the ex-employee.

These steps are simple to implement, and getting them right protects your organisation, your former employees, and the people who contact you.

Not sure if your offboarding process is GDPR-compliant?

 Privacy Path offers a free initial consultation to help Irish and UK businesses identify and fix data protection gaps. Get in touch today at privacypath.ie