In Brief: Are internal emails private? No. Any email your business sends, even one between two colleagues, can be requested by the person it mentions, disclosed in a legal dispute, demanded by HMRC or exposed in a data breach. UK SMEs should write every internal email as if the person it is about will one day read it, because they might.
The hacker, the football club and your inbox
This week, European Business Magazine reported that Manchester City had been found guilty on 114 of 115 Premier League charges. According to the report, much of the case traced back to Rui Pinto, the Portuguese hacker behind Football Leaks, who obtained the club’s internal emails and financial records illegally and was later convicted for it.
City maintain their innocence and are expected to appeal, and we have not independently verified the details.
But the lesson does not depend on the outcome. One of the most powerful organisations in world sport was not undone by its press releases or its published accounts. It was undone by what its own people wrote to each other, in messages they assumed would never leave the building.
You do not need to be a Premier League club or be targeted by a hacker for the same thing to happen to you.
An internal email is not a private conversation. It is a written record that can be requested, disclosed, hacked, forwarded or read out in a tribunal, and most small business owners only find that out when it is too late.
In a small firm, email feels informal. You know everyone, you’re busy, and a quick note to a colleague about a difficult client or a struggling employee feels no different from a word in the corridor. The law does not see it that way. Once something is written down, it exists independently of you, and you lose control over who eventually reads it.
Five ways your internal emails reach other people
1. Subject access requests
This is the one that catches out most SMEs. Under UK GDPR, anyone can ask for a copy of the personal data you hold about them, and that includes emails in which they are named or discussed. Employees and former employees use this right regularly, often in the early stages of a grievance or an employment claim.
That means a frustrated line between two managers about a member of staff can end up in that person’s hands. “Internal” is not an exemption.
2. Disputes, courts and employment tribunals
If a disagreement with a customer, supplier, partner or employee turns into a legal claim, relevant documents must usually be disclosed to the other side. Emails are documents. Only a narrow category of material is protected, mainly confidential communications with your legal advisers, and many business owners overestimate what that protection covers.
Adding “private and confidential” to a subject line does not change any of this.
3. HMRC and regulators
Tax inspectors and sector regulators have powers to require businesses to hand over records. Email is usually one of the first places they look, because it shows what people actually knew and intended, not just what the formal paperwork says.
4. Breaches and human error
Not every leak involves a court. A phishing attack that compromises one mailbox exposes years of correspondence. An autocomplete slip sends a message to the wrong “Sarah”. An email forwarded three or four times eventually reaches someone it was never meant for. Small businesses are frequent targets precisely because their defences are often thinner.
5. Where your email actually lives
Your email is stored on someone else’s servers, usually a large cloud provider and very often a US-owned one. As we covered earlier in this series, that can bring your data within the reach of foreign laws such as the US CLOUD Act, regardless of where the servers physically sit. Few SMEs have ever checked what their provider can access or who else could compel it to.
Deleted isn’t gone, and chat apps count too
Pressing delete removes a message from your view, not from the world. The recipient still has their copy, and so may anyone they forwarded it to. Your provider may hold it in backups or archives for months, and your own IT setup may keep copies you have forgotten about.
The same applies to Teams, Slack and WhatsApp. People treat these as even more casual than email, but messages on them are records just the same. In disputes and tribunals, chat logs are increasingly where the most damaging comments are found, because that is where people stop choosing their words.
What SMEs should do about it
None of this means you should stop using email. It means writing with the right reader in mind: assume that anything you put in writing could one day be read by the person it is about, a judge, or a stranger.
- Write as if the subject will read it. Keep comments about staff, customers and suppliers factual and professional. Describe what happened, not what you think of the person.
- Use the phone for genuinely sensitive conversations. The aim is to avoid careless written remarks, not to hide anything. Decisions still need a proper written record.
- Set a sensible retention policy. Decide how long different types of email are kept, apply it consistently, and write it down. Keeping everything forever increases your exposure; deleting at random looks worse.
- Know how to handle a subject access request. You generally have one month to respond. Knowing the process in advance saves a scramble later.
- Check your email provider. Find out where your data is stored, who owns the provider, and what security settings (such as two-factor authentication) are switched on.
- Brief your team. A short, plain-English note on email and messaging conduct protects the business far more than a policy nobody reads.
An important warning about deleting
Once a dispute, claim or investigation is likely, you must not delete messages that could be relevant, even under a routine retention policy. Destroying potential evidence at that stage can be treated very seriously by courts and tribunals and will almost always do more damage than the original email would have. The lesson is to write carefully from the start, never to delete quickly when trouble arrives.
The bottom line
Your emails are business records, not private chats. Treat them that way and most of the risk disappears.
If you’d like a second pair of eyes on how your business handles email, data retention or subject access requests, G&G Worldwide can help you put simple, proportionate measures in place. Get in touch for a no-nonsense conversation.
This article is general guidance, not legal advice. For specific situations, speak to a qualified solicitor.
