What to do with a departing employee's email: the law, the options and the policy we recommend

What people ask (and what the law answers)

“Can the company keep and access the email account of a terminated employee?” is one of the most repeated questions in HR and legal forums, and the short answer is: yes, with conditions. The account is a company resource; what the law protects is the person’s expectation of privacy. That expectation shrinks when there is a known, acknowledged use policy that says work email belongs to the company and may be managed when the relationship ends.

• Federal level. There is no federal law that stops a company from managing email on its own systems. The federal rules on electronic communications make exceptions for the provider of the system (the company, for its own accounts), for ordinary business use and for consent, which is where the acknowledged policy comes in.
• State level. Some states require employers to give notice of electronic monitoring: New York (written notice and acknowledgment at hire), Connecticut and Delaware. Others have broader privacy laws. A signed policy that announces monitoring covers most of this.
• If you have people abroad. In the European Union, the GDPR and the data protection authorities demand prior information, a legitimate purpose and a proportional review: forwarding and an auto-reply are accepted; reading the whole mailbox is not. The same logic is a safe standard everywhere.

This is not legal advice: it is a summary of what public sources say and of what we see working. Your attorney reviews your policy.

The three technical options in Google Workspace

1. Auto-reply + forwarding. The default option. Whoever writes gets a notice with the new contact and the message reaches that person. Nobody goes into the mailbox.
2. Mailbox delegation. The manager can open the mailbox from their own account, with no password, to close ongoing conversations. It is recorded who did it. This is the proportional choice when there are customers halfway through something.
3. Alias or shared account. If the person covered a function (sales, support), the address becomes an alias of their replacement, or a shared account with an owner. That way the email stops belonging to one person.

The policy we recommend (and that you can copy)

• Work email belongs to the company and is managed when employment ends; the person is informed and acknowledges it at hire.
• On the last day the account is suspended, the auto-reply is turned on and email is forwarded to the person the manager chooses.
• The manager can delegate the mailbox to themselves for 90 days to close what is pending; the password is never shared.
• After 90 days the account is deleted, or archived if there is an obligation to keep it; the files were already transferred.
• Everything is recorded: who requested, who approved, what was done and when.

How Mekovault does it

When an offboarding is scheduled, Mekovault asks the manager (not IT) what to do with the email and the files, with three options in one email: transfer to someone, recover information for a few days, or deactivate. It runs the auto-reply and the forwarding at the departure time, schedules the deletion and keeps the evidence for 365 days. If the person asks for a shared account for a function, that account is born with an owner and a review date. More detail in how to offboard an employee.