How do we write rules for employees' use of work e-mail, computers and phones?

A check always comes from a specific situation: a file leaked, an employee is ill and a client is waiting for an answer, an employee has left. Without rules, the decision is made in a hurry, and later it is hard to explain why that particular mailbox was opened.

The Article 29 Working Party opinion WP 249 (2017, adopted before the GDPR applied; guidance on interpretation, not a binding rule), section 5.3, says that an employer can rely on legitimate interest only if, among other things, it implements and communicates acceptable use policies alongside privacy information, setting out the permitted use of the network and equipment. Article 88(2) GDPR requires Member States' rules on employee data to pay particular regard to transparency and monitoring systems at the work place; in Lithuania these include Article 27 of the Labour Code (DK) and Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ).

Eight parts are enough for a small or mid-size company:

For part 2 it helps to know what WP 249 says in section 6.4: "a blanket ban on communication for personal reasons is impractical", because enforcing it may require disproportionate monitoring. A clear limit on how much is allowed works better than a ban nobody follows.

Before you write any check into part 5, answer four questions and write the answers down:

1. For what specific purpose? For example, to protect client data against leaks. The data may not later be used for a purpose incompatible with it (Article 5(1)(b) GDPR).
2. Is there a less intrusive tool? WP 249, section 6.4: if misuse can be prevented, e.g. by web filters, "the employer has no general right to monitor". And in the same place: "Prevention should be given much more weight than detection".
3. What is the legal basis? Usually legitimate interest (Article 6(1)(f) GDPR) with a written balancing assessment. Employee consent usually does not work here: WP 249, section 6.2, says that because of the imbalance of power employees can give free consent only in exceptional circumstances.
4. How much data is really needed? Only what the purpose needs (Article 5(1)(c) GDPR). For example, search by sender and date rather than reading the whole mailbox.

If the rules provide for monitoring or control of employees' communications or behaviour, for example ongoing review of internet-use logs or checking employees' e-mails to investigate a leak, this processing falls under point 10 of the VDAI list (processing of employees' personal data for monitoring or control purposes), which requires a data protection impact assessment (point 10 of the list approved by VDAI order No 1T-35). The assessment is carried out before the processing starts (Article 35(1) GDPR).

Our recommendation is to set out this procedure in part 5 of the rules:

1. The manager writes down the reason, e.g. "the client is waiting for a contract, the employee is off sick for two weeks".
2. First ask the employee to forward the e-mail needed or switch on an automatic reply, if possible.
3. If not possible, the mailbox is opened by an IT employee together with the manager. The search is only by a specific sender, subject or date.
4. E-mails and folders marked "Personal" are not opened.
5. Record who reviewed what and when. The employee is told when they return.

This puts Article 27(2) of the Labour Code (DK) into practice: when the employer exercises its rights over technologies used at the workplace, the secrecy of employees' personal correspondence may not be breached.

Our recommendation is for the rules to say:

• before leaving, the employee hands work e-mails over to a colleague and deletes personal ones;
• on the last working day an automatic reply with the new contact is switched on;
• forwarding to a colleague, if needed, runs for a limited period that you set yourselves;
• after that the mailbox is closed and work documents are moved to a shared system.

You set yourselves how long the mailbox stays open and write down the reason.

1. Write them with IT. IT knows what actually runs: which logs are kept and for how long.
2. Work council, if you employ 20 or more on average. Before approving the rules on the use of information and communication technologies and on monitoring and control of employees at the workplace, the work council is informed and consulted (Article 206(1) of the Labour Code (DK), point 5). It is informed ten working days before the decision (Article 206(2) of the Labour Code), may request consultations within three working days (Article 206(3) of the Labour Code), and consultations last at least five working days unless the employee representatives agree to a different period (Article 206(5) of the Labour Code). If there is no work council or employee trustee, the information goes to a trade union acting at employer level (Article 206(4) of the Labour Code). The same applies to the policy on storing employees' data (Article 206(1) of the Labour Code, point 7).
3. Approve them by the manager's order with a start date.
4. Acquaint each employee. If the rules cover monitoring of employees' behaviour, Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ) requires employees to be informed against signature or in another way that proves they were informed, giving all the information in Article 13(1) and 13(2) GDPR. Keep the signatures or the electronic confirmation.
5. Enter checks and logs in the record, most conveniently as a separate activity (Article 30(1) GDPR). The exemption for companies with fewer than 250 employees does not apply where the processing is not occasional (Article 30(5) GDPR), and continuously kept logs usually are not occasional.
6. Review them every year. WP 249, section 5.3, calls this good practice: assess each year whether the chosen tool delivers results and whether less intrusive ones exist. If the review leads to an amendment, the work council is informed and consulted again (Article 206(1) of the Labour Code).

Fill in the eight-part table with your IT employee or provider – they know half the answers. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities, and which of your processes are risky. If the rules provide for monitoring or control of communications, an impact assessment can be ordered as a one-off procedure – €95 excl. VAT per process.

Does the employee have to agree to the rules?
No. The employee's signature means they have been made aware of the rules, not that they agreed. The basis for checks is usually legitimate interest.

May we ban all personal use of work computers?
You may, but WP 249 calls such a ban impractical, because enforcing it may require disproportionate monitoring. A clear and reasonable limit usually works better.

Must the rules be part of the work regulations?
Not necessarily. They can be a separate internal document. Article 206(1) of the Labour Code lists these rules as separate points.

May we check a personal phone the employee uses for work?
A personal device holds even more personal data. WP 249, section 6.1, recommends that where personal devices are used, employees can protect their private communications from work-related monitoring, so check only a separated work account or app.

• Employee privacy notice: how to prepare it
• Security measures description for a small company in one table
• Who in the company may see employee data? (in Lithuanian)
• How to carry out a legitimate interest balancing test? (in Lithuanian)

The law and the risk: Employee monitoring: cameras, GPS, call recording and e-mail – dat.lt

• Secrecy of personal correspondence on work equipment – Article 27(2) of the Labour Code (DK).
• Informing and consulting the work council – Article 206(1) of the Labour Code (DK), points 5, 6 and 7; time limits – Article 206(2) of the Labour Code, 206(3) and 206(5); trade union – Article 206(4) of the Labour Code.
• Informing against signature about monitoring – Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ).
• Information to employees – Article 13(1) and 13(2) GDPR.
• Purpose limitation and data minimisation – Article 5(1)(b) and 5(1)(c) GDPR.
• Legitimate interest – Article 6(1)(f) GDPR.
• Member States' rules on monitoring systems at the work place – Article 88(2) GDPR.
• Impact assessment – Article 35(1) GDPR; point 10 of the list approved by VDAI order No 1T-35.
• Record of processing activities – Article 30(1) GDPR; the exemption and its limits – Article 30(5) GDPR.
• Acceptable use policies, consent, proportionality – WP 249, sections 5.3, 6.1, 6.2 and 6.4 (Article 29 Working Party opinion, 2017).

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (02016R0679) with corrigenda; ADTAĮ – e-tar.lt edition in force from 2026-06-30; Labour Code – e-tar.lt edition in force from 2026-06-07 (Articles 27 and 206 unchanged in the 2026-11-01 and 2027-01-01 editions). This text is general information and is not individual legal advice.