I work for a large company and use the Gmail set up for my account. As a senior manager, I have many confidential conversations internally and externally via email.

I have found out that one of the tech guys accesses employee’s emails when requested to carry out checks by the CEO. Do they have the right to do this? I think it creates a feeling of mistrust and insecurity. Can I lock my account so only I can access it? Martin

Historically, the assumption has always been that companies own and can access mail used for company business. When I was a manager, I dictated letters to a secretary who typed them and filed copies. I never reached a level where these filing cabinets were locked and inaccessible, but they contained nothing of personal interest.

Email has blurred the lines between corporate and private uses. People usually type their own emails, and even business emails tend to be informal. Convenience plus the illusion of privacy has led more people to use company email addresses for personal emails.

None the less, emails do sometimes lead to contract disputes and lawsuits, and email records can be subpoenaed by courts. They are part of the audit trail for many negotiations, and as a matter of principle, companies should back them up and archive them.

It’s therefore better to avoid using corporate email addresses for personal emails – or, indeed, anything you don’t want archived.

Email isn’t private

Email seems to be more private than the letters we dictated to secretaries, but probably isn’t.

Very few people actually trawled through filing cabinets and photocopied things they found. Emails are, by contrast, extremely easy to forward to others, including – by mistake – the wrong people. Something juicy can soon reach an audience of thousands.

Further, standard emails are not encrypted and are usually passed on by numerous routers where they could, in theory, be read by anybody who can access them. The new GDPR (General Data Protection Regulation) is encouraging companies to adopt secure, encrypted email services, but that won’t happen overnight.

And if encryption makes email less convenient, people will use WhatsApp, Signal and other messaging services that are beyond the reach of the company email administrators and auditors. There’s a version of WhatsApp for Windows and MacOS, so you could consider that.

Business v privacy

I am not a lawyer so I don’t want to get into legal issues, especially as these vary by country. However, there is clearly a conflict between the company’s need to manage staff and the employees’ right to privacy. Ultimately, which one takes precedence may be decided in court, and one landmark case went as far as the European court of human rights.

Companies want people to do the work they’re paid to do, so they should have explicit rules about things like making personal phone calls, reading Facebook or viewing pornographic sites at work. These things can usually be monitored by phone and server logs. Personal emails are harder to monitor, but it would seem reasonable for companies to have access to similar logs, without necessarily being able to read the contents of emails.

Some companies also monitor emails by scanning for key words that suggest illegal or unethical behaviour. This could include sexual or racial harassment, or bullying. Note that these filters will also catch emails sent from personal email addresses. If you must send personal emails at work, you should ideally use your own device and either a VPN or your own internet connection.

Thomson Reuters’ Practical Law site has a good guide to email and internet use at work by Michael Hart and Ellen Temperton from Baker McKenzie LLP. It includes sample warnings on internet and email abuse and a guide to formulating a company policy.

Gmail activity

Email services usually keep logs of email access, which can include the IP address and the type of device used. There are several ways to check the records for your Gmail account. The simplest is to scroll to the bottom of a page of email, find “Last account activity” and click “Details”. This will pop up a table showing the type of access (browser, mobile, etc), Location (IP address) and Date/Time. It will also show any accesses made by authorised applications.

You should also go to https://security.google.com/settings/security/activity to find out which computers, mobile phones and other devices have accessed your account. In my case, for example, there are three devices: a desktop PC, a laptop and a smartphone.

Everyone should check these details from time to time, to look for unexpected entries.

If your company has a G Suite account, then the email administrator can see a dashboard with details such as the total number of emails sent and received, and the last time you accessed the account via a web browser or email programme. It also shows the number of files created, edited and shared in Google Drive.

G Suite for Education – used in many schools – and G Suite Enterprise provide more advanced account management features.

Delegated access

It’s also easy to set up delegated access, which means you can access one Gmail account from another Gmail account. This is handy if you have one for business and one for personal use. You can even allow someone else to read and send mail on your behalf, without giving them your password.

It’s also a way that someone else can read your emails. To see if they are, click the cogwheel, pick Settings, go to “Accounts and Import” and check the “Grant access to your account” section.

Google doesn’t allow administrators to force delegated access, but some third-party G Suite programs do. Examples include BetterCloud’s FlashPanel and GAT (General Audit Tool). GAM (Google Apps Manager) appears to do it without warning the user.

Password resets

Your G Suite administrator can also access any account by resetting the password. This is essential because people sometimes forget their passwords, get fired, or just quit.

Of course, you would notice if your password changed. However, email administrators could try “social engineering”. For example, they could reset passwords, add delegated access, then tell users to reset their own passwords “for security reasons”. How many are going to check their Accounts and Import settings?

Other approaches

There are also ways to read people’s Gmail without accessing their account. For example, a G Suite administrator can set up rules to copy incoming and outgoing emails to a different account, or to copy all incoming emails to a different server.

Alternatively, they can read everyone’s emails in a backup such as Google Vault, BetterCloud, Backupify or whatever. Once your unencrypted emails are stored outside your mailbox, there are no real access restrictions.

So, even if you could lock your account, your emails would still be available to any company smart enough to keep backups. They would still be accessible even if you deleted your account.

A real solution would have to be non-technical. Specifically, your company should have a clear statement about its policies on email and internet use and privacy, so employees know exactly where they stand. Further, email administrator access should be policed by a data protection or privacy or security officer, not the whims of the CEO.

Have you got a question? Email it to Ask.Jack@theguardian.com