Can my employer read my email? Work vs personal accounts

Most people asking this have a work account and a personal account, and the answer is very different for each.

Short answer: yes, your employer can read email in a work account. Microsoft 365 and Google Workspace both give administrators tools to open a mailbox, search every mailbox in the company, keep deleted mail and export it, and US law generally allows it. A personal Gmail or Outlook.com account is a different matter: your employer has no admin access to it.

Work account or personal account: who can read what

The rest of this post covers the first two rows. The last row is about the device, and we cover it in detail in what your employer can see on a work computer.

Can my employer read my work emails?

Yes, and they do not need your password to do it. The company is the customer of Microsoft or Google, and the admin console comes with the subscription. Here is what each tool actually does, from the vendors' own documentation.

Microsoft 365. An Exchange admin can grant Full Access to someone else's mailbox. Microsoft's permissions guide describes it plainly: the delegate can "open the mailbox, and view, add and remove the contents of the mailbox." For investigations, Microsoft Purview eDiscovery searches content "stored in Exchange mailboxes, OneDrive accounts, SharePoint sites, Microsoft Teams," and more, and exports the results to a computer in the organization. On premium plans it also decrypts mail protected by Microsoft's own encryption: messages and attachments sent with Microsoft Purview Message Encryption "are automatically decrypted when added to search results or review sets." The Encrypt button in work Outlook keeps outsiders out. It does not keep your employer out.

Google Workspace. Google is more explicit about the split between details and content. Email log search gives an admin the sender, recipient, subject line and delivery status of any message, and Google says outright that "you can't view message contents using ELS." Content comes from Google Vault, which covers Gmail messages, Drive files, Calendar, Chat (when history is on), Meet recordings and more. Vault is included in Business Plus, Enterprise, Frontline Standard and Plus, and all Education editions, and other editions can buy it as an add-on. So even a company without Vault sees who you wrote to and what the subject lines said.

Chat runs on the same rails. Teams chats and Google Chat are in scope of the same tools, and Slack has its own export system, which we cover in whether your boss can read your Slack messages.

Can my employer see deleted emails and drafts?

Often, yes. Deleting a message in your inbox does not reach the copy the company has chosen to keep.

• Google: Vault says "data remains available to Vault even when users delete it and empty their trash," as long as a retention rule or hold covers it.
• Microsoft: eDiscovery holds exist to protect content from "inadvertent (or intentional) deletion during your investigation."

Drafts are items in your mailbox like any other, so anyone with access to the mailbox, or a search across it, can see them. Typing a message and never sending it does not keep it out of a work account.

Can my employer read my emails without my knowledge?

In the US, usually yes. In the UK and Europe, it is much harder to justify.

Neither Microsoft's nor Google's documentation for these tools describes any notice sent to the person whose mailbox is opened or searched. They are admin features, run from the company's side rather than from your mailbox. Whether you are told is a legal and policy question, not a technical one.

United States. The Electronic Communications Privacy Act has three exceptions that cover most employers running their own email:

• Provider exception for stored mail. 18 U.S.C. 2701 bans unauthorized access to stored communications, but subsection (c)(1) says the ban does not apply to conduct authorized "by the person or entity providing a wire or electronic communications service." When the company provides the email account, it is that entity.
• Provider exception for interception. Section 2511(2)(a)(i) lets a provider's employees intercept communications "in the normal course of his employment" when it is "a necessary incident to the rendition of his service or to the protection of the rights or property of the provider."
• Ordinary course of business. Section 2510(5)(a) leaves equipment "being used by the subscriber or user in the ordinary course of its business" out of the definition of an intercepting device. Courts call this the business-use exception.

On top of that, the email or IT policy you accepted when you joined usually counts as consent. Federal law does not require a separate warning. A few states do: New York's Civil Rights Law section 52-c requires employers to give written notice on hiring that "electronic mail or transmissions" may be monitored, and to post it where staff can see it. Connecticut and Delaware have similar rules, listed in our browsing history post. If you work in one of those states, the notice is probably in your onboarding paperwork.

This is general information, not legal advice.

Can my employer read my emails under UK GDPR?

Yes, within limits. The Information Commissioner's Office says in its guidance on monitoring workers that employers "must make sure workers are aware of how and what personal information you are collecting during any monitoring."

On secret monitoring it is blunt: "It is unlikely that you will be able to justify covert monitoring in most usual circumstances." The exceptions it gives are things like suspected criminal activity or gross misconduct, and even then employers "should not use covert monitoring to capture communications that workers would reasonably expect to be private, such as personal emails."

You also have a way to find out. The ICO says employers must make personal information collected through monitoring available to workers who make a subject access request, unless an exemption applies.

Can my employer read my emails after I leave?

Yes, and for longer than most people expect. Leaving the company does not delete the mailbox. The company decides what happens to it.

Microsoft 365. When an account is removed, Microsoft keeps the mailbox for 30 days, during which the company can restore it. If the mailbox was under a retention policy or hold before the account was deleted, it becomes an inactive mailbox instead, and Microsoft's page says its contents are "retained for the duration of the retention period." If the retention settings never delete anything, items are "retained indefinitely." A mailbox kept under an eDiscovery hold "remains searchable and exportable in eDiscovery for as long as the hold or associated case remains active."

Google Workspace. Google's guide to removing a user gives the admin two options for a departing person's Gmail: "Migrate email to another account" or "Redirect incoming messages to another email address." That means your manager or a colleague can end up with your old mail in their own account, and with new mail sent to your old address. Instead of deleting the account, the company can also assign an Archived User license, which keeps the data at a lower cost, and a deleted account can be restored for up to 20 days.

So assume anything in a work mailbox outlives your job there. If you forwarded personal mail to your work address, or used it for a bank or a doctor, that mail stays behind with the company.

Can my employer read my personal Gmail or Outlook.com?

Not through the account. Your personal Gmail is between you and Google, and your employer is not an admin of it. No console lets them search it.

Three things can still expose personal mail at work:

1. Using your work address for personal things. Replies from your landlord, your doctor or a recruiter land in the work mailbox, where every tool above applies.
2. Opening personal mail on a work device. The company cannot log in to your Gmail, but software on a managed laptop can record what is on screen. The device rules are in our browsing history guide.
3. Forwarding rules. A rule that forwards your work mail to a personal address can break company policy. One that forwards personal mail to work puts it in reach of the company.

How to keep personal email out of your employer's reach

• Never use your work address for anything personal. Banks, healthcare, job hunting, family, online accounts. If you already have, change the address on those accounts before you leave.
• Keep personal mail on a personal device. Your own phone on mobile data is outside the company's view.
• Read the policy once. Your IT or acceptable use policy usually says what is monitored and when. It is also the document that counts as your consent in the US.
• If you are in the UK or EU and suspect monitoring, a subject access request is your right, and it covers what monitoring collected about you.

For the personal side, a mailbox the company has no relationship with is the cleanest fix. Secria Mail is one option: sign-up asks for a name, an address and a password, with no phone number and no card, your stored mail is under zero-access encryption, and tracking pixels are removed automatically and senders never see your IP address. The free plan includes 2 aliases, so you can give recruiters one address and everything else another.

Work email belongs to work. Keep everything else in an account that is yours alone.

FAQ

Can my employer see my emails on Outlook? On a work Outlook account, yes. The mailbox lives in your company's Microsoft 365 tenant, where admins can grant Full Access to it or search it with eDiscovery. A personal Outlook.com account added to the Outlook app is a separate account that your employer does not administer.

Can my employer read my emails without telling me? Technically, yes: the admin tools do not notify you. Legally it depends on where you work. US federal law does not require notice, though New York, Connecticut and Delaware do. In the UK, the ICO says covert monitoring is unlikely to be justified in most circumstances.

Does deleting an email stop my employer from seeing it? Not if the company keeps a copy. Google Vault keeps data "even when users delete it and empty their trash," and Microsoft eDiscovery holds exist to stop deletion during an investigation.

Can my employer read my emails after I quit? Yes, if the company keeps the mailbox. Microsoft keeps a deleted account's mailbox for 30 days, or for the full retention period if it was under retention. Google lets admins move your Gmail to another account when your account is removed.

Can my employer read my Teams or Slack messages too? Usually. Teams chats are in scope of Microsoft eDiscovery, and Slack's paid plans have their own export tools, explained in our Slack post.