In short
Monitoring emails at work means recording details of staff email, such as senders, recipients, attachments and sometimes content, usually to protect sensitive data and investigate misuse. Teramind's email channel, from the UAM plan, captures email in supported clients and can keep only sender, recipient and attachment details. UK employers need a lawful basis, a clear policy and usually a DPIA.
Get a quote for email monitoring software
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why employers monitor email
Email in the workplace carries contracts, customer data, financial information and intellectual property, so it is a common route for data to leave, whether through a misaddressed message, a file forwarded to a personal account before someone resigns, or a phishing reply. Employers monitor email to:
- Spot sensitive attachments going to personal or unknown external addresses
- Detect mass forwarding or unusual volumes of external email
- Support investigations into a specific incident, with the evidence in context
- Meet regulatory record-keeping or oversight duties in some sectors
There are two broad ways to do it. Server-side tools work from the mailbox or mail flow, so they see every message that passes through the email service. Endpoint tools such as Teramind work from the agent on the user's computer, so they see email in the context of everything else the user was doing at the time, such as the file they opened before attaching it or the screen they were on when they pressed send. Many organisations use both, for different purposes.
Email monitoring in the workplace can be lawful in the UK, but work email inevitably contains personal and sometimes sensitive messages, and the ICO uses email monitoring as its example of monitoring that can capture special category data. The approach on this page starts from the least intrusive option and adds depth only where you can justify it.
What Teramind's email channel captures
In Teramind, the email channel is included from the UAM plan; it is not part of Starter. The agent on the computer captures incoming and outgoing email in the clients you select, which include desktop Outlook, Outlook on the web, Outlook.com and Thunderbird among others.
You control the depth of capture:
- Email content on or off: with content monitoring switched off, Teramind clears the subject and body before the email reaches the server, keeping the sender, recipients and attachment details.
- Direction: capture incoming email, outgoing email or both.
- Attachments: capture incoming, outgoing or both (outgoing only by default), skip attachments by file-name pattern, and delete stored attachments after a set number of days.
- Internal email: ignore email where the sender and every recipient are within your own domains, so internal conversations are left out.
- Older email: stop capturing email older than a set number of days, which avoids sweeping up archives when mail is moved.
- Meeting invitations: optionally capture invitations sent from desktop Outlook on Windows.
The Emails dashboard shows activity by employee, attachment, destination and source, and a reviewer can open an email, download its attachments or jump to the screen recording from the moment it was sent.
Platform coverage varies: email is fully supported on Windows; on macOS it is limited to web mail and the new Outlook desktop app (not classic Outlook); on Linux it covers web mail. See the Teramind agent for the wider picture.
Email rules and data loss prevention
Most email monitoring value comes from rules that look at email automatically, so people only review what matters:
| Rule type | Example | Plan |
|---|---|---|
| Activity rule on email | Alert when an email with an attachment goes to a personal webmail domain or to an address outside your approved domains | UAM |
| Content-sharing rule on email | Detect personal data, card numbers or tagged documents in an email or attachment, and warn, block or notify | DLP |
| Screen context | Save video around the moment a rule fires, for review | UAM (Record Video action) |
Content-sharing rules on email are supported on Windows and, for web mail, on Linux; they are not supported on macOS. The Teramind DLP page covers content rules, fingerprinting and Microsoft Purview label integration in detail. For the wider category of tools that stop sensitive data leaving, see our sister site's guide to data loss prevention.
Organisations on Microsoft 365 may also be weighing Microsoft's own tools; our comparison of Teramind vs Microsoft Purview Insider Risk Management explains how they differ and why some organisations use both.
Not sure which plan fits? Ask us
Tell us what you need and we will recommend the right plan for your organisation, with a quote.
The ICO's rules on monitoring email
The ICO's guidance on monitoring workers has several points that bear directly on email:
- Purpose first: you must be clear why you are monitoring; the ICO gives monitoring email traffic for security purposes as an example of a defined purpose, and says you should not monitor workers "just in case".
- A DPIA: you must carry out a DPIA before monitoring that is likely to result in high risk, and the ICO says you should carry one out even where there is no specific high risk. For email, we treat a DPIA as the starting point.
- Special category data: the ICO's example is a bank monitoring all email traffic, which should identify a special category condition because monitoring could pick up emails to union representatives or occupational health.
- Collect no more than you need: data minimisation means capturing only what your purpose requires, so if details about an email (sender, recipients, attachments) meet your aim, there is no need to capture what it says.
- Policy must match practice: the ICO's example is an employer that bans personal calls but tolerates some; it cannot rely on the ban to justify monitoring. The same applies to personal email.
- Blocking can beat monitoring: the ICO gives the example of blocking personal email and similar sites to reduce misuse rather than monitoring for it.
- Covert monitoring should not, in most circumstances, capture communications workers would reasonably expect to be private, such as personal emails.
UK law also includes the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-Keeping Purposes) Regulations 2018, which the ICO mentions alongside data protection law; take advice on how it applies to you. The ICO says its guidance is under review following the Data (Use and Access) Act. This is general information, not legal advice.
Mapping the ICO's rules to Teramind settings
The ICO's distinctions translate into concrete settings:
| ICO principle | Teramind setting |
|---|---|
| Collect no more than you need | Switch email content monitoring off; keep sender, recipient and attachment details |
| Least intrusive means | Use content-sharing rules to flag specific sensitive data, so people review matches rather than reading mailboxes, and restrict who can open emails through role-based access |
| Special category data | Ignore email between your own domains, leave out mail clients you do not need, and keep content capture narrow |
| No longer than necessary | Set an email age cut-off, delete stored attachments after a set period and agree a retention period in your policy |
| Tell workers in advance | Describe email monitoring in your monitoring policy; consider the visible Revealed agent |
| Accountability | Teramind's Audit dashboard records what dashboard users view, edit and export |
We help you work out which of these fits your purpose, record the technical details for your DPIA and set the configuration to match.
Is email monitoring software the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Forever Systems helps
We supply, set up and support Teramind and can help you introduce email monitoring carefully:
- Purpose first: data leak prevention, a regulatory duty or investigation support. Each leads to a different depth of capture.
- Choose the plan: UAM for email activity and activity rules; DLP if you need content inspection, fingerprinting or automatic blocking.
- Configure capture: clients, direction, content on or off, attachments, internal domains and age cut-off.
- Write the rules: alerts for the patterns that matter, with warnings to users where a nudge works better than an investigation.
- Control access: decide who can open email content and review the Audit log.
Ask us for a quote. See Teramind pricing and plans for what each plan includes.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
Can my employer read my work emails in the UK?
An employer can monitor work email if it has a lawful basis, a clear purpose, uses the least intrusive means and has told staff about it in advance, normally in a monitoring policy. The ICO expects employers to consider special category data, such as emails to union representatives or occupational health, and says that in most circumstances covert monitoring should not capture personal emails. This is general information, not legal advice.
Can Teramind monitor emails without reading the content?
Yes. Teramind's email settings let you switch content monitoring off, in which case the subject and body are cleared before reaching the server, while the sender, recipients and attachment details are kept. That matches the ICO's distinction between information about an email and its content.
Which email clients does Teramind monitor?
On Windows, Teramind can capture email from desktop Outlook, Outlook on the web, Outlook.com, Thunderbird and other supported clients. On macOS it is limited to web mail and the new Outlook desktop app, not classic Outlook, and on Linux it covers web mail.
Which Teramind plan includes email monitoring?
Email capture and email activity rules start on the Teramind UAM plan. Content-sharing rules that inspect email and attachments for sensitive data, and block or warn automatically, need the DLP plan or Enterprise.
Do I need a DPIA to monitor staff emails?
In practice, yes. The ICO says you must carry out a DPIA before monitoring that is likely to result in high risk, and should carry one out even where no specific high risk is identified. Email monitoring can capture special category data, such as emails to union representatives or occupational health, which the DPIA should address. This is general information, not legal advice.
Still have a question about email monitoring software?
Ask us and a member of our team will reply by email.