What are an agency's legal obligations when an employee uses personal email for official business?

When a federal employee uses a personal email account to conduct official agency business, the content of those messages does not stop being a federal record. The recordkeeping obligation attaches to the function an email serves, not to the system it happens to travel through. As a result, the agency carries several ongoing legal responsibilities.

Capture the record in an official system

Federal recordkeeping law treats messages documenting agency business as records regardless of the account used to create or send them. When official business is conducted on a personal account, the employee generally must forward or copy the relevant message into an official recordkeeping system, and agencies are expected to do this promptly so the record is preserved where it can be managed, searched, and retained.

Preserve, retain, and dispose properly

Once captured, these records are subject to the same retention schedules and disposition rules as any other agency record. They may not be deleted, altered, or removed except in accordance with an approved schedule. An agency that allows records on personal accounts to be lost risks an unauthorized destruction situation and undermines its ability to demonstrate compliance.

Remain accountable for access and disclosure

Records that reside on a personal account remain subject to access regimes that apply to agency records, including:

• Freedom of Information Act (FOIA) requests, which can reach responsive records even when they sit in a personal account, so long as the agency controls them as records.
• Litigation holds and discovery, which require the agency to locate and preserve relevant material wherever it lives.
• Congressional, audit, and oversight inquiries.

Because of this, the agency must be able to search for and produce responsive records, which is far easier when messages have been moved into managed systems.

Practical takeaways for IG and RM staff

• Treat the medium as irrelevant: if the content documents agency business, it is a record.
• Ensure policy requires timely forwarding of official messages into an authorized system.
• Train staff that using a personal account does not place communications beyond reach of FOIA, retention rules, or oversight.
• Build defensible processes for capture, retention, and search.

In short, personal email does not create a records-free zone. The agency keeps its full obligations to capture, preserve, and produce these records.

Learn more at the federal records topic hub.