Personal emails in work mailboxes: excluding them before licensing

How do you remove personal emails from a mailbox archive?

Remove them in layers before the archive is scoped: confirm what the company's policy says about personal use, exclude whole categories of correspondent and topic, run keyword and pattern filters on what remains, then sample-review the result. No filter set is complete, so the last layer is always human review by someone who knows the business. The goal is a working set of business communications, not a perfect mailbox.

Policy comes first, but it is not a shield. An acceptable-use policy that says employees should expect no privacy in work email helps the company explain why it holds the messages. It does not make a family member's private message or a medical email a good candidate for licensing. The rules on message contents vary by state; the CPRA explainer on emails and Slack messages covers California's list of sensitive categories, and the primary text is in the California Civil Code CCPA title.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Prerequisites

• A written acceptable-use or electronic-communications policy, with the date each employee acknowledged it.
• A named owner for the mailbox project, usually IT or the privacy lead, with counsel on call.
• A list of mail systems and archives, including legacy ones, journaling and backup copies.
• A decision on date range and which departments are in scope. Executive and HR mailboxes often come out entirely.
• A working copy of the data. Filters are never run against the live mailbox.

Step by step

1. Read the policy and the handbook. Note what it says about personal use, monitoring and retention. If it says nothing, flag that to counsel and assume more employees treated the system as semi-private.
2. Exclude by mailbox. Drop the mailboxes most likely to hold personal or privileged content: legal, HR, executives, and any shared mailboxes for benefits or medical leave.
3. Exclude by correspondent domain. Remove threads where the other party is on a consumer mail domain, a school, a healthcare provider or a bank, unless the thread is business correspondence. Keep a reviewed allow-list for legitimate consumer-domain business contacts.
4. Exclude by relationship. Build a list of family and personal contacts from address-book fields, repeated signatures and the subject lines employees themselves flagged. Remove whole threads, not single messages.
5. Exclude by topic keywords. Flag terms tied to health, family events, personal finance, job searches, housing, immigration and legal disputes. Keywords produce false positives and false negatives, so treat hits as a review queue rather than automatic deletion where volume allows.
6. Mask what remains. Identifiers in business threads, such as names, phone numbers and account numbers, are detected and replaced consistently.
7. Review a stratified sample. Pull samples from each department and each year, and score how many personal messages slipped through. Agree the acceptable rate with counsel up front.
8. Re-run and freeze. Fix the rules that missed, re-run, and keep a log of the final rule set and sample results.

The same discipline applies to chat and to source code history, where scanning git history for secrets is the equivalent exercise.

Filter design table

Common mistakes

Illustrative example

Illustrative: a fictional 120-person logistics software company wants to scope eight years of email. IT excludes legal, HR and the CEO's mailbox, drops threads whose only external party is a consumer webmail or school domain, flags 40 keywords across health, family and housing for review, and samples 300 threads per department. The first sample finds that the finance team's mail still contains personal tax correspondence, so the rules gain a domain list of tax preparers, and the sample is repeated. The company's counsel signs off on the final rule set before any discussion of terms.

How does licensing treat what is left?

Even a well-filtered mailbox is licensed only under terms. A field-of-use restriction limits what the buyer may do with the data, and SourceX agrees de-identification and redaction requirements with the company before any work begins. Data is delivered only after an executed agreement and the company's authorization. Nothing is binding until the company agrees price and terms and signs. For a CPA or accounting-services company, the FTC Safeguards Rule for CPA firms is the companion read on client records.

Health content is a different regime again. If medical messages turn up, the HIPAA question belongs to the company and its counsel; see how HIPAA expert determination works.

What should a referral partner do?

Partners make introductions and give basic fit information only. You never open, export or describe a mailbox. The useful thing to ask an owner is whether someone in the company could own the filtering project, and how many years of mail exist. Companies where nobody can export the data, or where archives were deleted, are red flags.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.

Next step

Use the company fit checker to screen the company, read how it works, and register as a partner to make the introduction. Owners can apply directly at sourcex.si/apply.