What are an individual employee's duties when they forward a business email to personal accounts?

Forwarding a work email to a personal account (such as a personal webmail address) does not move the email out of your recordkeeping obligations. If the message documents organizational business, it is a record regardless of where a copy ends up. The individual employee carries specific duties before, during, and after any such forwarding.

Know Whether It Is a Record First

A business email is generally a record when it documents decisions, transactions, policies, approvals, or other organizational activity. The medium and the mailbox do not change that status. Before forwarding, ask whether the message has continuing value and whether it is subject to your organization’s retention schedule, legal holds, or access laws such as public-records or freedom-of-information requirements.

Preserve the Authoritative Copy

Your first duty is to ensure the official copy remains in the organization’s system of record. Forwarding to a personal account must never become the only place a record lives. In many government settings, conducting business through a personal account is restricted, and where it is permitted at all, the employee is typically required to copy or forward the message back into an official account within a short, defined period so it can be captured and managed.

Follow Policy and Avoid Unauthorized Disclosure

Forwarding can violate acceptable-use, security, or privacy rules. Common individual duties include:

• Confirming your organization’s policy actually permits forwarding to a personal account.
• Not transmitting sensitive, confidential, controlled, or personally identifiable information outside approved systems.
• Preserving metadata and the complete message rather than excerpting it.
• Not deleting the official copy and not using a personal account to evade retention or transparency obligations.

Why It Matters

Records held only in personal accounts are hard to search, secure, retain, and produce. That exposes the organization to gaps in legal discovery, audits, and access requests, and exposes the individual to potential accountability for mishandling records. The safe default is to keep business communications in official channels and route any unavoidable personal-account copy back into the system of record promptly.

For related guidance on managing messages as records, see the email and messaging topic hub.