Under the GDPR, employers in the EU can only monitor employees’ work emails if it is necessary, proportionate, and serves a legitimate purpose, such as ensuring compliance or security. Employees must be informed about the monitoring in advance, and clear policies should be in place to respect transparency and consent requirements. Any monitoring must also balance the employer’s business interests with the employees’ right to privacy, ensuring minimal intrusion. Some countries like Germany have really strict interpretations of how to apply the GDPR here.