Drafting an email and internet protocol: this is what belongs in it

Drafting an email and internet protocol involves establishing what employees are permitted to do with business email and the internet, the extent of private use allowed, and the conditions under which you, as an employer, may monitor. The protocol must comply with the GDPR, Article 8 of the ECHR (privacy), and, in the case of a Works Council, the right of consent under Article 27 of the Works Councils Act (WOR). A well-drafted protocol provides clarity to employees and offers the employer a valid basis for monitoring. Below are the components it should contain and the legal requirements it must meet.

The short answer

1. the permitted and prohibited use of email and the internet.
2. Private use: permitted or not and under what conditions.
3. Control: whether, when, how and by whom, with a legitimate interest (Article 6 GDPR).
4. Purpose and proportionality: why you inspect and why it is necessary.
5. Retention periods and consequences for violation.
6. Works Council consent (Article 27 Works Councils Act) and communicate the protocol.

Drafting an email and internet protocol: the components

A useful protocol first describes the permitted use. What is allowed for business purposes, and to what extent is private use accepted? A realistic policy permits limited private use under conditions, because a complete ban is difficult to enforce in practice. This is followed by the prohibited use: illegal downloads, visiting or distributing offensive or discriminatory content, and sharing trade secrets or personal data outside the organization.

Next, document the inspection. This is the most legally sensitive part. Describe whether, when, and how you conduct the inspection, who is authorized to do so, and for what purpose. Link the inspection to a legitimate interest (Article 6(1)(f) GDPR), such as security or investigation based on a concrete suspicion, and make it clear that the inspection is proportionate.

The legal requirements

Monitoring employees affects their right to privacy (Article 8 ECHR) and falls under the GDPR. Three requirements are central. First, transparency: employees must know in advance that and how they are being monitored (Article 5 GDPR). Second, necessity and proportionality: you use the least intrusive means that serves the purpose. Permanent monitoring is rarely proportionate; targeted monitoring in response to a concrete suspicion often is. Third, purpose limitation: you only monitor for the purpose that you have established in advance.

In addition, good employership applies (Article 7:611 of the Dutch Civil Code). Secretly and without cause searching employees' communications is contrary to this, even if there appears to be a formal basis. A protocol that disregards these requirements offers no protection: inspection based on it will not stand up in court.

Consent of the Works Council

If your company has a Works Council, you must request consent pursuant to Article 27 of the Works Councils Act (WOR) before implementing the protocol. An email and internet protocol is typically an employee tracking system and a regulation regarding the processing of employee data, and this falls under the right of consent. If you implement the protocol without that consent, the implementation is void, and the Works Council can invoke this. If you do not have a Works Council, this right of consent lapses, but the GDPR requirements and good employership continue to apply.

Finally, you actively communicate the protocol to all employees, for example via the employee handbook and a confirmation of acknowledgment. Only then is the requirement of prior transparency met.

A practical example: an SME draws up a protocol that permits limited private use and enables targeted monitoring in the event of a concrete suspicion of misuse. The Works Council approves, and the protocol is included in the employee handbook. When a data leak later threatens due to careless email usage, the company can take targeted action based on the protocol without violating privacy regulations.

Honest recommendation

You do not always need a lawyer. If you are a small employer with no need for control and only want a guideline for normal use, a simple template will suffice. However, if you require actual inspection, process sensitive data, or have a works council, legal support is advisable. The control aspect and alignment with the GDPR, Article 8 of the ECHR, and Article 27 of the Works Councils Act require careful attention, and this is precisely where things go wrong in practice.

Want to read more? View the email and internet protocol, the explanation of what an email and internet protocol is , and about having an email and internet protocol drawn up.

Frequently Asked Questions