GDPR access rights and professional emails: updates since January 2025

For employers, the impact is immediate and significant: processing such requests is costly, time-consuming, and raises practical challenges around feasibility. Many companies have struggled in practice to respond effectively, expressing their need for clear guidance and a structured approach.

It is against this background that the CNIL sought to provide clarity in January 2025, as discussed in our dedicated article published last year. 

According to the CNIL’s guidelines​, when responding to an employee’s access request concerning professional emails, the employer may first remind the employee that the right of access only applies to personal data contained in the emails and not to the emails themselves as documents. The employer must then assess the potential impact on third-party rights, trade secrets, intellectual property, or the confidentiality of correspondence, and distinguish between what can be communicated and what cannot. Information that should be disclosed can be deleted, anonymized, or pseudonymized before any communication to the employee. Only if these measures are insufficient may the employer refuse the access request, providing a reasoned and justified explanation to the employee. In this respect, the CNIL indicates that the mere fact that the request is made in parallel with ongoing litigation (for example, before an employment tribunal) cannot, in itself, justify a refusal to disclose the requested information. 

In practical terms, the CNIL’s position is this: when an employee requests access to professional emails, the employer must provide both metadata (dates, senders, and recipients) and the substantive information itself. Redaction or omission is only advised if the information could affect the rights or interests of third parties, such as trade secrets, confidential business information, intellectual property, or private correspondence. Most importantly, the CNIL clarified that employers are not obliged to provide full copies of the emails. They can either give redacted emails or present the information in a structured table summarizing the relevant personal data. The reason is simple: the email as a document is not, by itself, personal data.

Judicial decisions were expected to complement these CNIL guidelines and either confirm or further clarify these welcome practical indications.

The first such decision came from the French Supreme Court on June 18, 2025 (No. 23-19.022​), which drew significant attention. The Court held that emails sent or received by an employee using their professional email account constitute (in themselves) personal data under Article 4 of the GDPR. This formulation, which did not clearly distinguished between personal data contained in the email and the email as a document, surprised some commentators. Despite this, the Court reassuringly clarified, in line – this time – with the CNIL, that although employers must provide both the metadata and the content of emails, they are not required to disclose any information that could infringe the rights and freedoms of others. In the case at hand, the facts left little room for dispute: the employer had provided neither the metadata nor the content of the emails sent or received by the employee, and offered no justification for this omission. As a result, the Court upheld the Court of Appeal’s decision, including the 500 euros damages awarded to the employee. 

Subsequent rulings by the Paris Court of Appeal in October, November, and December 2025 again brought the right of access into focus.

On October 2, 2025 (RG n° 25/02502), the Paris Court of Appeal largely followed the reasoning of the French Supreme Court. It recognized that emails sent or received through a professional mailbox can be considered personal data under the GDPR, giving the employee a right to access both the content and relevant metadata, provided that doing so does not infringe on the rights of others. Importantly, the Court clarified that attachments, particularly those containing client information, may remain protected as business secrets. The Court also stressed that any information obtained by the employee must be used solely for the purposes of the ongoing legal proceedings.

Nevertheless, two decisions issued a few months later, on November 13 and December 18, 2025, departed from this paradigm and raised questions about the position of lower courts.

In its decision of December 18, 2025 (No. 25/04270), the Paris Court of Appeal examined a case involving an employee dismissed for professional inadequacy who notably sought access to all emails sent and received over a one-year period, relying on both the GDPR (right of access) and Article 145 CPC.

On the basis of the right of access, the Court dismissed the request, adopting both a narrower definition of personal data and a more contextual interpretation than that of the CNIL or the French Supreme Court. It held that, while the GDPR entitles an employee to obtain from their employer a copy of the personal data being processed (again, provided that such copy does not infringe the rights and freedoms of others), “the purpose of the GDPR is not [​however] to obtain a copy of professional email correspondence sent or received by the employee (…) of which, by definition, they have had full knowledge, and which, unless the employee demonstrates their personal nature, contains only personal data relating to their identification (in this case, [the employee’s] email address and name), which was not established in the present case.” In other words, this time, the Paris Court of Appeal treated personal data narrowly, as limited to identifying information, meaning that neither email metadata nor general content of the email falls within the scope of the right of access - contrary to the positions taken by the CNIL and the French Supreme Court.

On the basis of Article 145 CPC (evidentiary measures), the Court began by recalling the usual requirements (legitimate reason, necessity, and proportionality) but found that none were met in this case. The employee, who was seeking to challenge both their dismissal and alleged unpaid overtime, was therefore unsuccessful. Ordering disclosure of the entire mailbox was, in the Court’s view, manifestly disproportionate to the aim pursued. It noted, first, that such a measure would not meaningfully support the overtime claim, as the timing of emails is not sufficient to establish actual working time or to demonstrate a breach of working time limits. Nor would it assist in challenging the dismissal for professional inadequacy, which was based on specific identified cases rather than general considerations. The Court also pointed out the risks such disclosure would pose to business secrecy and the confidentiality of personal data, and that, in any case, the employee had retained access to their IT tools prior to the termination of their employment.

Similarly, in its November 13, 2025 decision (No. 25/03115), the Paris Court of Appeal faced an employee who notably requested full access to his professional mailbox. The Court reiterated that the GDPR does not grant a right to obtain copies of professional emails already known to the employee. However, unlike in the December case, it allowed a limited disclosure under Article 145 CPC, in light of the employee’s need to substantiate specific claims regarding working time arrangements and daily rest periods. The Court therefore permitted access to the professional mailbox, but only for a limited period, subject to anonymization, without attachments, and with the injunction that the data be used solely for the ongoing employment dispute.

Despite some apparent contradictions in the reasoning of the judges in these recent decisions, a coherent line of case law is nevertheless beginning to take shape, structured around several key points: