Can Your Employer Check Your Work Email and Computer?

If you are concerned about whether your employer can check your work email and computer, this case will interest you. And if you have already been disciplined or dismissed because of a review of your devices, speak as soon as possible with Fernanda Vargas, employment lawyer in Madrid, on WhatsApp or book an appointment on Calendly.

“We Have Checked Your Email and Your Phone”: Mateo’s Dismissal

Mateo is 30 years old. He is Argentine, has a residence and work permit, and works as an administrative employee at an administrative services firm in Bilbao. The company gave him a laptop and a company phone. Nothing unusual.

What does matter is this: no one ever explained a usage policy to him. No one told him whether he could use those devices for personal matters. No one informed him whether the company could check them, or how, or in what situations.

Like many people, Mateo sometimes used the laptop to write to his partner and the company phone for the occasional personal errand. One day, a client list disappears. Management suspects that someone leaked it to a competitor. Without informing him, an IT technician checks all his corporate email, accesses WhatsApp on the company phone, and reads personal conversations.

He finds nothing about the leak. But he does find messages in which Mateo criticizes his boss while talking to his partner. One week later, Mateo receives a disciplinary dismissal letter for “breach of good faith.”

This is where the question usually comes up: if the computer and the phone belong to the company, can it do whatever it wants with them? The short answer is no. But the opposite is not true either: the company can monitor compliance with work obligations. What it cannot do is monitor in just any way.

Who Owns the Computer, and Who Owns Your Messages? What Article 20 bis Says

“Workers have the right to privacy in the use of digital devices made available to them by the employer, to digital disconnection, and to privacy against the use of video surveillance and geolocation devices under the terms established in the current legislation on personal data protection and the guarantee of digital rights.”

That is what Article 20 bis literally says. Put into plain language: even if the laptop, email, or phone belongs to the company, you still have a right to privacy. It does not disappear just because you work with company tools.

That same article also recognizes your right to digital disconnection. In other words, work cannot systematically invade everything. If you want to explore that point further, you can read this article on the right to digital disconnection.

In addition, Article 20 bis mentions two issues that are separate from devices: video surveillance and geolocation. They are not the same as checking your email or your computer. That is why it is important to keep them clearly separate. On cameras at work, here is a specific guide on workplace video surveillance.

“The employer may adopt whatever monitoring and control measures it considers most appropriate to verify the worker’s compliance with his or her work obligations and duties, while in their adoption and implementation observing due consideration for his or her dignity […].”

That excerpt from Article 20.3 explains the other half of the issue. The company can monitor and supervise. But it must do so to check whether you are complying with your work duties and while respecting your dignity. The law does not give it a free hand. What it does is seek a balance.

In Mateo’s case, that balance is broken when the company goes from investigating a specific suspicion to carrying out a total review of his email and reading personal conversations that had no connection to the leak.

The Company Can Monitor, but With Rules: Usage Policy, Prior Notice, and Proportionality

Imagine two situations.

• In the first, the company provides a laptop, approves a usage policy, informs the whole workforce, explains whether limited personal use is allowed, and warns that checks may take place in certain situations.
• In the second, it explains nothing, informs no one of anything, and one day it goes in and checks everything.

They are not the same. The difference is crucial.

First Rule: There Must Be a Usage Policy

Data protection law recognizes your privacy in the use of company digital devices, but it also allows the employer to access their content for two specific purposes: monitoring compliance with work obligations and ensuring the integrity of the devices.

That said, to do so it is not enough to say “the computer is mine.” The company must first establish usage criteria. Those criteria must respect minimum standards for protecting privacy. In addition, they must be defined with the participation of workers’ representatives and communicated to the workforce.

If some personal use is also allowed, the policy must specify which uses are authorized and what safeguards exist to preserve privacy.

In Mateo’s case, all of that was missing. There was no policy. There were no criteria. There was no prior information.

Second Rule: You Must Be Informed in Advance

The courts require prior information about the possibility of monitoring and about its scope. Put simply: it is not enough to check first and explain afterward. You must know beforehand that this monitoring may exist and how far it may go.

That does not mean the company has to warn you every time it is going to check something specific. It means the workforce must know the rules of the game in advance.

Third Rule: The Monitoring Must Be Proportionate

Proportionality is a very practical idea. The measure must have a legitimate purpose, there must be no less intrusive way to achieve it, and it must be limited to what is necessary.

If a client list disappears, investigating that leak may be a legitimate purpose. But it does not follow from that that the company can go through all your history, open all your personal conversations, and read messages that have nothing to do with the suspicion.

That is precisely what happened with Mateo. The review was total. And it reached private conversations with his partner that were unrelated to the leak being investigated. At that point, the monitoring stops being properly tailored and becomes excessive.

It is also useful to distinguish between two things that are often mixed together: one thing is checking whether you are using the computer for personal purposes; quite another is reading the content of your personal messages. The second interferes much more intensely with your privacy and requires much stronger justification.

Personal Use of Company Devices: What Is Allowed

This question cannot be answered with a yes or no for every case. It depends on your company’s usage policy.

If the company allows personal use, it must say which uses are authorized and what safeguards will exist to protect your privacy. If it does not allow it, that must also be clear. What should not happen is what happened to Mateo: working for months with no known rules and discovering them all at once on the day of dismissal.

That is why, although in practice sending a personal message or handling a one-off personal matter may sometimes be tolerated, the prudent course is to keep personal matters as separate as possible from work matters. Not because the company can read everything without limits, but because any later dispute always makes things more complicated.

Think about the difference compared with Mateo’s case. The company may have wanted to find out whether the laptop or phone had been used for a leak. But that did not automatically make it legitimate to read private conversations with his partner about his boss. Investigating possible improper use of the device is not the same as opening the content of personal messages unrelated to that suspicion.

If you do not know what the rule is in your company, ask for it in writing. It is one of the most useful steps for workers and also for companies that want to act correctly.

Your Personal Phone: A Line the Company Cannot Cross

Here the answer is much clearer. The company cannot access your personal phone.

It does not matter if that phone has work email, messaging apps, or client contacts installed on it. One thing is the device the company makes available to you for work. Quite another is your personal phone.

If a disciplinary measure or a dismissal is based on information obtained from your personal phone, the case should be reviewed immediately. The way that information was obtained may be decisive.

What Happens to Evidence Obtained by Violating Your Privacy

Let us go back to Mateo. The company suspected a leak. But it found nothing about that. What it did find was personal messages in which he criticized his boss. And it built the dismissal around those messages.

If the review violated your right to privacy, the judge may consider that evidence unlawful. In simple terms, that means it may not be admitted or taken into account at trial.

What happens then? The dismissal may be left without a basis. In that scenario, it may be declared unfair. And if a violation of a fundamental right is also found, it may also be declared null and void. There is no automatic answer for every case: it depends on how the monitoring was carried out, what was reviewed, what prior information existed, and how important that evidence was in the employer’s decision.

In Mateo’s case, there are several serious problems for the company: there was no usage policy, there was no prior information for the workforce, and the review was total, going so far as to read personal conversations unrelated to the initial suspicion. In that context, the violation of privacy carries significant weight.

That is why, in a situation like this, you should not assume that “because they caught me on the company phone, there is nothing that can be done.” Sometimes the main issue is not the content that was found, but whether the company was allowed to go that far in the way it did.

What Mateo Can Do Now

If you see yourself in Mateo’s case, the important thing is to move quickly. Time limits for challenging a dismissal or a disciplinary measure are short.

• Keep the dismissal or disciplinary letter.
• Write down what the company reviewed, when it did so, and how you found out.
• Ask in writing for the device usage policy, if they have not given it to you.
• Do not delete messages, emails, or documents that may help reconstruct what happened.
• Seek legal advice as soon as possible.

If you need to review a dismissal, a disciplinary measure, or your company’s internal policy, you can consult Fernanda Vargas, employment lawyer in Madrid. In cases like Mateo’s, carefully analyzing how the evidence was obtained can completely change the strategy.

And for the future, the practical lesson is clear: keep your personal matters as separate as possible from company devices. Not because you give up your privacy, but because that reduces risk and helps prevent a review from ending up mixing work and private life.

Summary: Can the Company…? Quick Table

Can the company…?	Answer	Condition
Check corporate email	Yes, but not in just any way	There must be a legitimate purpose, usage criteria established in advance, information for the workforce, and proportionate monitoring.
Read personal chats on the work computer	Only in very justified situations	It is not enough for the device to belong to the company. Reading the content of personal communications requires much stronger justification and cannot be done indiscriminately.
Look at the company phone	Yes, with limits	Only to monitor work obligations or ensure the integrity of the device, with prior rules, information, and proportionality.
Look at your personal phone	No	The company cannot access your personal phone.
Know where you are through the car’s GPS	Yes, but with limits	Privacy against geolocation must be respected under the terms of data protection rules; it is not unlimited tracking.

If you apply this table to Mateo’s case, the conclusion is quite clear: the company could investigate a suspicion, but not do so without a prior policy, without information, and while reading personal conversations unrelated to that investigation. That is why the dismissal may be left without valid evidence and be declared unfair or, depending on the case, null and void.

Frequently Asked Questions

If you do not know what those rules are, ask for them in writing. And if they have already checked your computer and that ended in a disciplinary measure or dismissal, contact Fernanda Vargas, employment lawyer in Madrid as soon as possible, on WhatsApp or book an appointment on Calendly.