A salesperson leaves the company on a Friday. On Monday, management asks for their account, pepe.perez@company.com, to stay live “so we don’t lose clients”, and for someone to read whatever comes in. HR departments get this question every week. And it is usually handled badly.
What to do with a former employee’s email account now has a fairly clear answer. European data protection authorities have decided many such cases, and their criteria match: block access on the last day and set an automatic reply with another contact for a limited time. Then delete the mailbox. Keeping the account open indefinitely, simply forwarding it or reading it “just in case” are not options. The most recent fine, from May 2026, was €176,000.
In this article we will discuss...
First distinction: named account or generic account
Before deciding anything, look at the address.
An account such as pepe.perez@ or pperez@ identifies a person. It is personal data under Article 4(1) GDPR. Whoever writes to it also believes they are talking to that person. Keeping it live after the departure means continuing to process data about someone you no longer have a relationship with. It also misleads clients and suppliers, who do not know that someone else is reading their messages.
A generic or functional account, such as info@, sales@ or accounts@, is not tied to anyone. It can stay live and pass to another employee, because its purpose does not end when someone leaves. It does contain third-party data, though, and needs access controls.
This leads to the first practical recommendation. In client-facing roles, the commercial relationship should run through generic or shared addresses. That way, the problem of a former employee’s email account almost disappears.
A former employee’s email account in nine sanctioned cases
| Authority | Year | What happened | Sanction |
|---|---|---|---|
| Belgium | 2026 | Mailbox live for over a year | €176,000 |
| Belgium | 2020 | Former director’s mailboxes live for years | €15,000 |
| Belgium | 2021 | Mailbox linked to a colleague’s | Reprimand |
| Italy | 2019 | Forwarded to IT for 1 year 7 months | Reprimand |
| Italy | 2023 | 120 days of forwarding | €5,000 |
| Italy | 2024 | Content kept for 6 months | €40,000 |
| Italy | 2026 | Accounts live for 6 months | €5,000 |
| Norway | 2021 | Daily logins to the mailbox | ≈€15,000 |
| Spain | 2022 | Former teacher kept access | Warning |
Belgium, 2026: €176,000 for a mailbox kept live over a year
What happened. An employee of a large technology company discovered, six months after leaving, that her mailbox was still active. She asked for access and erasure. By the time the authority stepped in, the mailbox had been open for more than a year.
Why it was sanctioned. The Belgian Data Protection Authority (Decision 101/2026) accepted that legitimate interest covers keeping the mailbox for about a month, to tell contacts who is taking over. After that, the justification runs out. It imposed just over €160,000 for processing without a legal basis and about €16,000 for lack of transparency. Neither the employee nor her contacts knew the mailbox was still active. The company also had no measures to ensure deletion and did not properly handle the access request.
The lesson. Blocking access is not enough if the mailbox still exists: as long as it is kept, personal data is still being processed.
Belgium, 2020: the case that set the one-month rule
What happened. The mailboxes of a former managing director, some bearing the names of his relatives, stayed active for years after he left.
Why it was sanctioned. Decision 64/2020 found breaches of purpose limitation, data minimisation and storage limitation, and a lack of legal basis. It also sanctioned the failure to answer his erasure request within a month. The fine was €15,000, plus an order to adopt a mailbox-closure policy.
The lesson. The authority described good practice:
- Block the mailbox no later than the last day.
- Warn the person beforehand and set an automatic reply with another contact.
- Keep it for about a month. At most around three months for senior roles, always justified and communicated.
- Avoid automatic forwarding.
- Let the employee retrieve private messages before leaving.
- Delete the mailbox when the period ends.
Belgium, 2021: the mailbox linked to a colleague’s
What happened. When a person’s collaboration ended in late 2019, the IT manager linked their mailbox to a colleague’s. That colleague could read messages addressed to the person and replied to at least one from their address. Two weeks after the departure, the account was still active.
Why it was sanctioned. Decision 133/2021 noted that legitimate interest can cover an automatic reply for a limited period. It does not cover someone else reading the mailbox. And since the person was not told about that interest, the organisation could not rely on it. A reprimand was issued without a fine, partly because the account had already been closed.
The lesson. It is not only about time. Handing the mailbox to a colleague is the problem in itself.
Italy, 2019: forwarded to IT for a year and a half
What happened. A company kept a former employee’s account for a year and seven months, forwarded to the IT manager. One of those emails ended up being filed in a lawsuit against the employee himself.
Why it was sanctioned. The Italian Garante found such prolonged forwarding unlawful, as neither necessary nor proportionate. There was also no policy known to staff. It issued a reprimand.
The lesson. Telling the employee verbally is not enough. What will happen to the account must be set out in a written policy.
Italy, 2023: 120 days of forwarding when 30 were enough
What happened. An insurance agency forwarded the email of two former collaborators for 120 days to reassign their client portfolio. The messages were read by a distribution manager who was not authorised to do so. And there was no proof of an automatic reply.
Why it was sanctioned. The Garante found that reassigning the clients had taken about 30 days, so 120 was excessive. It also found that keeping mailbox content without a time limit was excessive. It imposed a €5,000 fine and ordered a review of the internal policy.
The lesson. If business continuity is the argument, the period must match how long the handover actually takes.
Italy, 2024: €40,000 for keeping mailboxes six months
What happened. A company’s policy kept the content of leavers’ mailboxes for six months. It also refused a former executive access to his emails.
Why it was sanctioned. The Garante’s decision rejected legitimate interest. Email is not a document management system, and there are less intrusive means of ensuring business continuity. The policy also promised deactivation and an automatic reply, which were not delivered. The right of access had been breached too.
The lesson. Whatever must be kept belongs in the document management system or the CRM, not in the leaver’s mailbox.
Italy, 2026: six months live and no prior assessment
What happened. A company kept a former employee’s accounts for six months. It said it wanted to hand over clients and feared litigation. It also failed to answer his erasure request.
Why it was sanctioned. The decision of 17 April 2026 criticised the absence of a legitimate interest assessment before deciding. The one produced later set three months, not six. A lawsuit that never came did not justify refusing erasure. Fine of €5,000.
The lesson. The assessment is done beforehand, in writing, and then followed.
Norway, 2021: logging into the mailbox every day
What happened. A manager changed a former employee’s password and logged into the mailbox every day for weeks. In total, the access went on for more than five months.
Why it was sanctioned. The Norwegian authority found no legal basis for that access, which bordered on monitoring the employee. There was no internal procedure, and the content was not deleted. Fine of NOK 150,000, about €15,000.
The lesson. Accessing a former employee’s mailbox without a procedure is one of the worst things a company can do.
Spain, 2022: the former employee could still log in
What happened. A teacher at a public secondary school left at the end of the school year, but nobody removed his access to the corporate email. Months later he received a login alert for that account and filed a complaint.
Why it was sanctioned. In decision PS/00447/2022, the Spanish Data Protection Agency (AEPD) found a breach of Article 32 GDPR for lack of security measures. As a public body, the authority received a warning. A private company is subject to the ordinary fines regime.
The lesson. The risk is not only the company reading the mailbox. It is also the former employee keeping access to information that is no longer theirs.
What the AEPD says, and what it does not
The AEPD’s guide on employment relationships notes that when employment ends, the legal basis disappears and the data must be blocked. It accepts continued processing if the employer shows a specific legitimate interest. We have not found any AEPD decision or guidance setting a period for automatic replies or sanctioning forwarding. That is why the Belgian and Italian criteria, which apply the same GDPR, are currently the best reference.
Forward a former employee’s email or set an automatic reply?
The automatic reply is the safe option. It tells the sender the person has left and who to write to instead. The client is not lost, and nobody reads messages not addressed to them.
Forwarding is something else. Messages addressed to one person reach another without the sender knowing. They may include emails from a doctor, a bank or another employer. That is why authorities discourage it and have sanctioned it when prolonged.
If it is essential in a specific case, for example to hand over a key client, our view is clear. It must be very short, known to the employee in advance and combined with the automatic reply.
Is there a legitimate interest in keeping the account?
Yes, but briefly. Business continuity is a legitimate interest under Article 6(1)(f) GDPR. However, if an automatic reply achieves the same with less intrusion, keeping the account open for months will not pass the balancing test. And that assessment must be documented before deciding.
How long?
- One month of automatic reply as a general rule.
- Up to three months for roles with heavy external contact, justified and communicated to the employee.
- Then delete the mailbox, except for anything that must be kept blocked because of a legal obligation or a foreseeable claim.
Won’t we lose clients?
It is the usual argument, and it is worth turning around. Clients are not lost because an account is deactivated. They are lost when nobody handed over the open matters before the person left. An automatic reply with a clear contact retains clients better than a mailbox that keeps receiving messages nobody answers.
Can the company read a former employee’s email?
In Spain, Article 87 of the LOPDGDD allows employers to access the digital tools they provide to monitor compliance with employment obligations. But it requires prior usage criteria, drawn up with workers’ representatives and communicated to staff.
Once employment ends, that monitoring no longer makes sense. Business content should therefore be recovered before the departure, in an orderly way and, ideally, in the person’s presence. And if the former employee asks for access or erasure, you must reply within a month. Failing to do so has been sanctioned in Belgium and Italy.
Exit protocol for a former employee’s email account
- Email use policy in line with Article 87(3) LOPDGDD, explaining what will happen to the account after departure.
- Before the last day: hand over open matters and recover business information. The employee can take or delete private messages.
- Last day: block access and change credentials, including on mobile devices and connected apps.
- Automatic reply with another contact for one month, or up to three if justified.
- No reading the mailbox and no indefinite forwarding.
- Keep what matters in the CRM or document management system, not in the mailbox.
- Delete the mailbox when the period ends, blocking only what is strictly necessary (Article 32 LOPDGDD).
- Documentation: legitimate interest assessment and entry in the record of processing activities.
An example automatic reply:
Pepe Pérez is no longer with [company]. Your message will not be read or forwarded. For any enquiry, please write to sales@company.com or call +34 900 000 000. Thank you.
How we can help
As external data protection officers, at Auratech Legal Solutions we draft email and device use policies, employee exit protocols and legitimate interest assessments. We also prepare the automatic reply and the information for staff, so that every departure is handled the same way. Tell us about your case.
Frequently asked questions
Can I keep the firstname.lastname account live so as not to lose clients?
Not indefinitely. The recommended approach is to block it on the last day and set an automatic reply with another contact for one month, or up to three if justified. After that, delete it.
Can I read a former employee’s email that keeps arriving in their account?
Not as a rule. Matters should be handed over before the departure. Accessing the mailbox afterwards requires a specific legal basis and a procedure, and authorities have sanctioned it even when it lasted only a short time.
Is it lawful to forward the former employee’s email to a colleague?
It is the riskiest option. If used, it must be very short, known to the employee and combined with an automatic reply. In Italy, 120 days of forwarding was sanctioned when the handover had taken 30.
What about generic accounts such as info@ or sales@?
They are not tied to a person, so they can stay live and pass to another employee. Even so, they contain third-party data and need access controls.
What should I do if the former employee asks us to delete their account?
Reply within one month. If something must be kept, block it and explain why. Failing to reply has led to sanctions in Belgium and Italy.
This article provides general information and is not a substitute for legal advice on a specific case.
