Is it necessary to carry out a DPIA when monitoring email communications?

ANSWER

It depends on the assessment of the specific case. For example, monitoring only certain emails and only reviewing information such as the sender and subject line may require a different assessment than monitoring the content of all emails using AI tools.

However, because monitoring is systematic and concerns individuals requiring special protection, a Data Protection Impact Assessment (DPIA) is required.