In a decision of 7 October 2025, the Litigation Chamber of the Belgian Data Protection Authority (DPA) reiterated its strict guidelines regarding the deactivation of a professional mailbox and the corresponding e-mail account following an employee’s departure. The DPA held that the same principles also apply to the further use of the mobile phone number made available to the employee during the employment relationship.
Facts
The decision followed a complaint filed by a former managing director with the DPA. The company had failed to deactivate the professional e-mail account and the mobile phone number after the end of the employment relationship.
Several months after his departure, the former managing director requested that the company close the e-mail account and phone number and delete personal messages. The company replied that the mailbox would soon be deactivated but claimed ownership of the phone number.
It was established that the e-mail address remained active for five months after the termination of employment, and the mobile phone number was still in use by the company eight months after the employee’s departure.
Decision
The DPA reiterated that the principles of purpose limitation, data minimisation and storage limitation are not respected if an organisation retains access to an employee’s mailbox after their departure, or if the professional e-mail address remains active and in use. Such processing lacks any valid legal basis.
Mailbox
According to the DPA’s established practice, an employer must deactivate the employee’s mailbox no later than the effective date of departure and set up an automatic reply. This message must inform correspondents that the employee has left the organisation and provide the contact details of the person (or general e-mail address) who can now be contacted instead. The departing employee must be informed of this deactivation.
After a reasonable period (in principle one month), the mailbox and the automatic reply must be permanently deleted. This period may be extended up to a maximum of three months, depending on the context and the level of responsibility exercised by the employee. Any extension must be duly justified and take place with the employee’s consent or, at the very least, after having informed them.
Mobile phone number
The DPA confirmed that these same guidelines also apply to the further use of the mobile phone number provided during employment. The company argued that the number belonged to the company, as it had subscribed to the service, and therefore no privacy violation could exist. The DPA disagreed, holding that the phone number – and the communications linked to it – are inherently associated with the employee. Processing this data by the company therefore constitutes processing the employee’s personal data.
Unlawful processing
The DPA found a breach of the principles of purpose limitation, data minimisation and storage limitation.
The purpose limitation principle requires that personal data be processed only for legitimate purposes. In addition, the lawfulness principle provides that any processing of personal data must be based on a legal ground, such as the performance of a contract. During employment, managing and using the e-mail account and phone number is necessary for the performance of the employment contract between the employee and the company (i.e., to enable professional communication). However, this legal basis ceases to exist upon termination of employment.
Keeping the mailbox or phone number active after the employee’s departure must therefore rely on a new legal basis. In principle, the DPA accepts that a company may rely on its legitimate interest to ensure business continuity and the proper functioning of its operations.
In this case, however, the DPA held that no valid legal basis justified keeping the e-mail address active or continuing to use the phone number and the messages linked to it. The indicative one-month period after termination had clearly been exceeded.
Finally, the company had also failed to comply with the employee’s request to erase data. Retaining communications – whether professional or private – indefinitely after the end of employment was deemed to breach the purpose limitation principle. In this respect, the DPA took into account that the complainant had worked for the company for more than 10 years. Moreover, the company had allowed the director to use the mobile phone for personal purposes as well. As a result, personal communications were also stored after termination, without any purpose or time limitation, aggravating the breach.
Sanction
At the time of the decision, the company was in liquidation and no longer operational. The DPA therefore considered it appropriate to limit the sanction to a reprimand, without imposing a financial penalty.
Key message
In its decision of 7 October 2025, the DPA reaffirmed its position on the deactivation of e-mail accounts after termination of employment– regardless of whether the person concerned is an employee or a self-employed worker. Clarifying that the same principles apply to mobile phone numbers made available during employment.
Companies are advised to implement a clear and transparent policy on the deactivation of e-mail accounts and mobile phone numbers upon termination. So, set up automatic replies in due time, inform the departing employee, and delete accounts and communications within a reasonable period.
The Claeys & Engels Data Protection team remains available for further assistance this subject.
