SOURCE: Vacation Tracker TITLE: Out of Office (OOO): What It Means and What to Include URL: https://vacationtracker.io/glossary/out-of-office/ LANG: en PUBLISHED: 2026-10-17 UPDATED: 2026-10-17 SUMMARY: What out of office means, what a good auto-reply should and shouldn't say, the security risk nobody mentions, and the rules when someone leaves # Out of Office (OOO): What It Means and What to Include Out of office (OOO) is the status of being away from work and unavailable, and the automatic reply that announces it. The phrase covers both the state and the message, which is where the confusion starts. OOO is a status, not a leave type (https://vacationtracker.io/glossary/leave-type/). Someone can be out of office without being on leave — travelling, at a conference, on a workation (https://vacationtracker.io/glossary/workation/) — and on leave without being out of office, because they forgot to set the message. ### Two systems that don’t talk to each other Your leave system knows who’s off. Your mail server knows who set an auto-reply. By default, neither knows about the other. That gap produces the familiar failures: the reply saying “back Monday” when the booking says Thursday, the approved leave with no auto-reply at all, the message still running a week after someone returned. Less carelessness than the predictable result of asking someone to enter the same information twice, in two places, as they’re trying to leave. Worth fixing, because the auto-reply does real work. It’s the only mechanism enforcing the boundary of booked leave. Without one, the absence is recorded, the sender doesn’t know, and the work arrives anyway — the mechanical start of leaveism (https://vacationtracker.io/glossary/leaveism/). See also: How to Set Up Out of Office in Outlook Calendar (https://vacationtracker.io/blog/how-to-set-up-out-of-office-in-outlook-calendar/) How to Set Out-of-Office Replies in Google Calendar (https://vacationtracker.io/blog/how-to-set-out-of-office-replies-in-google-workspace/) How to set out of office in Microsoft Teams (and Outlook) (https://vacationtracker.io/blog/how-to-set-an-ooo-message-in-microsoft-teams/) ### What a good one does Four jobs, in order of how often they’re botched: - Says when you’re back — the first working day you’re actually available, not the day your flight lands - Names what happens to the message — who’s covering, or that it will wait. Both fine; silence isn’t - Doesn’t volunteer a reason. “On annual leave” is fine. Medical details aren’t, and shouldn’t be disclosed automatically on someone’s behalf - Doesn’t promise availability That last one deserves its own line, because “I’ll be checking email periodically” is the most self-defeating sentence in workplace communication. It converts leave into availability and invites exactly the contact the message exists to deflect. If you’re genuinely on call, say who to phone and when. If you’re not, don’t offer. One more thing that gets missed: naming a colleague as cover only works if they’ve agreed, know the context, and aren’t also away. An unconsented handoff just moves the frustration. Use our Out of Office Email Generator (https://vacationtracker.io/tools/ooo-generator/) and write a perfect email ### The security problem HR content never mentions this; security teams think about little else. An auto-reply is an outbound disclosure to anyone who emails you — including people who emailed you to find out. Between them, OOO messages leak absence dates, colleagues’ names and contact details, job titles and reporting lines, the email address format, and internal tone and signature conventions: close to a complete toolkit for impersonation. The attack is mundane and effective — a fraudulent payment or payroll-change request, sent to the right person, timed for the window when the approver is confirmed away, and someone less familiar is covering. Business email compromise relies on exactly that timing. The mitigations are cheap: - Point urgent matters at a team or shared inbox rather than a named individual - Keep external replies vague about dates — “currently unavailable” rather than a precise return - Use different internal and external messages, which most mail platforms support natively - Issue a standard template rather than leaving everyone to compose their own ### When someone leaves Different rules apply, and they’re more concrete than most people expect. European data protection authorities treat a departed employee’s mailbox as ongoing processing: the Belgian regulator has taken one month as the reasonable period to keep it live with an auto-reply, extending to around three months for senior or sole-holder roles, and found five months excessive. The message should say the person no longer holds the role and name who to contact instead. ### Frequently asked questions What should an out-of-office message include? Your return date, who’s covering, or that the message will wait, and nothing about why you’re away. Should an OOO say why you’re absent? No more than “on leave.” Medical or personal reasons shouldn’t be broadcast automatically. Is it safe to name a colleague? Only with their agreement — and for external replies, a shared inbox is safer than a named individual. How long should an auto-reply stay up after someone leaves? European regulators have treated about a month as reasonable, longer only for senior roles. Read more on our blog: 5 Out of Office Email Samples You Can Use (https://vacationtracker.io/blog/5-out-of-office-email-samples-you-can-use/) Game Changing Out Of Office Email Templates (https://vacationtracker.io/blog/game-changing-out-of-office-email-templates/)