Participants, timestamps and communication patterns can reveal sensitive relationships even without message bodies. Document the fields collected, purpose, access and retention. Exclude unnecessary mailboxes or categories where appropriate.
For UK GDPR deployments, the ICO's worker-monitoring guidance requires an appropriate lawful basis and proportionate processing. Assess transparency and whether a data protection impact assessment is needed. Employee consent is not automatically suitable because of the power imbalance.
Other jurisdictions can impose different workplace, privacy and communication requirements. Do not treat one country's checklist as universal legal clearance.
Review permissions, security controls, processors, international transfers, data-use terms and deletion behaviour. Tell affected employees what is collected and why, using the applicable notice and consultation process.
For Orbb, rely on current security documents, integration permissions and contractual scope. Do not claim metadata-only processing, particular data residency or absence of cross-customer use unless verified for the specific deployment.
This is an evaluation framework, not a determination that a particular configuration complies with every applicable law.