Delegated access, GDPR Article 28, NDAs and who is liable: what actually protects you when a virtual executive assistant works in your inbox.
Yes, it is safe to give a virtual assistant access if you set it up properly and have a company behind the assistant. A virtual executive assistant needs the same access to your inbox and calendar that a direct hire would. What protects you is how that access is granted and what sits behind the person: delegated access instead of shared passwords, an email address on your own domain, GDPR and confidentiality terms in the contract, and a company you can hold responsible.
Your inbox holds investor updates, legal threads, salary conversations and things your board has not seen yet. Handing it to someone you have never met in person feels like a bigger risk than it is, mostly because nobody explains how the access actually works.
Security is one of the first questions founders raise on our sales calls. The worries differ. One founder was not concerned about his own data at all, but about the data of the wealthy families he advises and his contractual duties to them. Another worried specifically about employee records rather than client information. In one case a deal slipped because the prospect’s information security team got stuck on the review.
The rules themselves are clear. Under Article 28 of the GDPR (opens in a new tab), anyone processing personal data on your behalf must work under a binding contract, and the people doing the work must have committed to confidentiality. And when you delegate your inbox rather than share it, Gmail’s own help pages (opens in a new tab) confirm that a delegate can read, send and delete email for you, but cannot change your password or access sensitive account settings.
The sections below follow the order in which these questions usually come up: access, the contract, NDAs, your clients’ data, devices, your IT team, and who is liable if something goes wrong.
Any assistant who manages your inbox will see what is in it, so the real question is not whether someone sees your data but what stands behind them when they do.
A personal assistant you hire directly in your own office gets exactly the same access as a remote one. They read the same emails and open the same calendar invitations. Nobody seriously suggests that an office hire is a security risk by default, because the protection comes from the arrangement around them: an employment contract, confidentiality terms, company equipment and a company that answers for them.
A remote executive assistant should come with the same structure, and a managed agency should add to it. At DonnaPro, every assistant is backed by an account manager, a quality manager and IT support. The assistant is one person you work with every day. The protection is the system behind them, which is the real difference between an agency and a freelancer.
Your assistant should never know your password: you grant delegated access instead, and you can withdraw it at any time.
Google Workspace and Microsoft 365 both let you give another person access to your mailbox and calendar without sharing your login. In Gmail, a delegate can read, send and delete messages, but cannot change your password or access sensitive account settings.
When they send, Gmail lets them choose to send as you, the original sender, or as themselves on your behalf, so recipients see “on behalf of” your name. In Outlook the rights are set separately. Full Access lets the assistant open and manage the mailbox. Send on behalf shows recipients the assistant’s name with “on behalf of” yours. Send as hides the assistant completely. Your IT team sets these permissions. Replies to Send on behalf messages go to your mailbox, so the assistant also needs Full Access to see them.
Three details make this safer still:
The practical setup, including WhatsApp and payment cards, is covered step by step in our guide to working with an executive assistant.
DonnaPro’s standard contract includes GDPR, intellectual property and confidentiality clauses, so the core protections are in place before your assistant starts. If your security team needs specific wording, we are open to adjusting or adding clauses.
That matters because GDPR is specific about what an arrangement like this needs. Article 28 requires a binding contract that sets out what personal data is processed, for what purpose and for how long, and requires the people authorised to process it to have committed to confidentiality, or to be under a statutory duty of confidence.
The second layer is where the assistant is based. Every DonnaPro assistant works from the EU. Because of that, the transfer safeguards that apply to work done outside the EU do not apply to their work. An assistant working outside the EU would mean personal data is transferred outside the EU, which needs safeguards such as the EU Standard Contractual Clauses, on top of the Article 28 contract.
A note for UK founders: UK GDPR keeps the same requirements. The ICO’s guidance on controller and processor contracts (opens in a new tab) lists the same core terms: documented instructions, confidentiality, security measures, rules on sub-processors, and deletion or return of data at the end of the contract.
Most of the protection is settled in the contract, before anyone touches your inbox.
For companies that need additional protection, DonnaPro can sign your NDA as the agency, particularly in fields where confidentiality is part of the job, such as investment, law and advisory work.
A separate NDA is useful when your own investors, clients or regulators expect to see one in a specific form, or when you work on transactions that require a named list of people with access. DonnaPro reviews and signs these as an agency, which means you have a contractual commitment from the company, not just from an individual. If your NDA template has unusual terms, such as a long duration or a restriction on future work in your sector, send it early so it can be reviewed without delaying the start.
That company-level commitment also matters in practice. If something goes wrong, there is a registered business behind the service that can be held accountable. You are not relying solely on an individual contractor’s personal liability.
If your assistant will see your clients’ personal data, check whether you hold that data as a controller or as a processor for your clients, because the answer decides what you need to tell them.
This is the concern that comes from founders in advisory, wealth management and professional services. Their own data is not the issue. Their obligations to the people they serve are.
The distinction is simple in principle:
Two practical measures help in either case. Grant your assistant access only to the folders and inboxes the work needs, rather than to everything. And tell your clients plainly, before they ask, that a named executive assistant supports you under GDPR and confidentiality terms. Being open early prevents the question from turning into a concern later.
The same applies to employee data. HR folders, payroll and personnel files can sit outside your assistant’s delegated access entirely, if they do not need them.
This section is general information about how GDPR works, not legal advice. If your client contracts are unusual, ask your own lawyer to check the sub-processor terms.
Assistants work from their own device. Sometimes a client sends a company-issued device to the assistant instead.
This is one of the clearest differences between a managed agency and a solo hire. An independent assistant may store your passwords on a personal laptop, connect through a home network, and if the relationship ends, you may have no visibility into what happens to your credentials afterwards. Passwords are stored in our enterprise vault, LastPass. If a client already has their own password manager, the assistant uses theirs. If something goes wrong, there is a company behind the assistant that can be held accountable.
When an assistant leaves, two things can happen. If you continue working with DonnaPro, all credentials and working files transfer to your new assistant. If you choose to leave DonnaPro entirely, all credentials, files and documents are deleted within the timeframe specified in your contract.
Before granting access to any assistant, whether through DonnaPro or independently, ask four questions:
Ask us for the answer to each of these before the assistant starts.
Payment cards work on the same principle of controlled access. If your assistant needs to pay for things, a virtual or second card works well. Load it with a fixed amount and keep it separate from your main account, so the assistant never sees your main card details. Platforms such as Pleo let you set spending limits for each person, get real-time notifications, and freeze a card when something looks wrong. Features change, so check the current details with each provider before you rely on them.
Your IT team usually becomes involved around day seven to nine of onboarding, when accounts are created and access is granted, not before you sign.
DonnaPro assistants typically start working with a client within nine days of signup. The first days go on briefing and matching. The IT steps come at the end of that period, once the assistant is confirmed and the scope of access is clear.
During the kickoff call, DonnaPro shares best practices and requirements for what needs to be set up on the IT side. If your company does not have a dedicated IT team, DonnaPro’s own IT team will guide you through the setup together, so you are not working through it alone.
What your IT team will usually be asked to do:
If your company has a formal information security review, start it in parallel with signing rather than before it. The first 60 days with DonnaPro carry no long-term commitment, so a review that raises a real problem does not leave you locked in.
If something goes wrong, an agency is a company with contracts, policies and a reputation to protect, while an independent assistant is one person.
GDPR spreads responsibility in a specific way. Under Article 82 (opens in a new tab), you as the controller remain liable for how your data is processed. A processor is liable where it breaks the obligations GDPR places on processors, or acts outside your lawful instructions. In plain terms, using an agency does not remove your own duties, but it does put a company with defined obligations between you and the risk.
With an independent assistant, the same rules apply in theory. In practice, your recourse is against one individual, with no team behind them and no policy on devices or offboarding beyond their own. That is the real difference, and it matters most for founders handling investor, client or employee data. It is also what to look for when you are choosing an executive assistant agency.
When a remote assistant is not the right answer: if your security policy forbids any external access to company email, or requires everyone with access to work on site on company hardware, no remote arrangement will fit, however well it is run. It is better to know that before the first call. If you are still weighing the wider decision, see the questions founders ask before hiring an executive assistant.
Book Your Free Strategy SessionThis guide draws on the questions founders raise about security on DonnaPro’s sales calls, the text of the GDPR, guidance from the UK Information Commissioner’s Office, and Google’s documentation on mailbox delegation. We weighed what founders worry about most against what the rules actually require. Platform features and regulatory guidance change, so check current settings with your IT team. This guide is general information, not legal advice.
Sources reviewed
Checked for accuracy against how DonnaPro actually works before publication.
Explore more guides to help you hire, work with, and get the most from your executive assistant.
