Data licensing guide
Data licensing guide

Can a company license its employees' emails and chats?

By Ade Molajo · Updated · How we check figures · Not legal advice · Not reviewed by a lawyer

Quick answer

Possibly, but it's the hardest data to license. Employee email and chat is personal data under UK GDPR, and in California under the CCPA. You'd need a lawful basis, to tell staff, and proper anonymisation, and Slack's API terms bar third-party apps from using Slack data to train AI. The Spirit Airlines data sale drew objections over employee data. Shared mailboxes and work channels, with people removed, are the realistic scope.

Personal data
under UK GDPR and the CCPA
Tell staff
privacy information must cover it
Slack
API terms bar AI training by third-party apps
Shared
mailboxes and channels first

01Why it's the hardest data to license

Email and chat are full of people: senders, recipients and everyone they mention, plus the odd personal message. That makes them personal data under UK GDPR, and in California, the CCPA has covered employee data since 2023.

In the Spirit Airlines data sale (Google won the auction with a $10M bid in August 2026; court approval was pending at the time of writing), unions and more than 120 US lawmakers objected specifically over employee information in the dataset.

02What the law asks

  • A lawful basis. Usually legitimate interests, with a written assessment. See the ICO on lawful basis.
  • Tell staff. Privacy information must say if data is shared or sold (ICO). Staff can object to legitimate-interests processing.
  • Proper anonymisation. Pseudonymising names isn't enough (ICO).
  • Platform terms. Slack's API terms bar third-party apps from using Slack API data to train large language models.

03Email: what's realistic

Email archives: usually licensable (Shared mailboxes for support, ops, projects; Process threads: approvals, handovers; Templates and standard replies; Internal-only threads, people removed) versus check first or leave out (Client email covered by contracts or NDAs; Personal and HR correspondence; Legal advice (privilege); Anything with health or financial account data).Usually licensableShared mailboxes for support, ops, projectsProcess threads: approvals, handoversTemplates and standard repliesInternal-only threads, people removedCheck first, or leave outClient email covered by contracts or NDAsPersonal and HR correspondenceLegal advice (privilege)Anything with health or financial accountdata
A starting point for scoping, not a legal test.

04Chat: what's realistic

Slack: usually licensable (Project and ops channels; Incident and support channels; How-to and process threads; Your own workspace export) versus check first or leave out (DMs and private personal chat; Shared channels with other companies; HR, health or disciplinary threads; Data pulled through a third-party app (API terms)).Usually licensableProject and ops channelsIncident and support channelsHow-to and process threadsYour own workspace exportCheck first, or leave outDMs and private personal chatShared channels with other companiesHR, health or disciplinary threadsData pulled through a third-party app (APIterms)
A starting point for scoping, not a legal test.

05The realistic scope

Shared mailboxes and work channels, with people removed, after staff have been told. Individual inboxes, DMs and HR conversations stay out. See email, Slack and UK GDPR.

This is general information, not legal advice, and it hasn't been reviewed by a lawyer.

06Check whether you're likely to match

Our free fit check asks about your size, location, records and tools, then shows which programmes you're likely to match. The programme decides.

07Questions people ask

Can a company sell its employees' emails?

Employee email is personal data. Licensing it needs a lawful basis, staff told, and proper anonymisation. Shared mailboxes with people removed are far more realistic than individual inboxes.

Do employees have to consent?

Not necessarily, but they must be told, and under UK GDPR they can object to processing based on legitimate interests.

Sources

Check which programmes you’re likely to matchA few short questions, about a minute. Free, no sign-up. The programme decides who qualifies.trackimpact.io/data →