Email security and GDPR: a practical guide for businesses

Why email is at the center of data protection

Many personal data breaches are not sophisticated cyberattacks but ordinary email incidents: a customer list sent to the wrong person, an HR mailbox taken over through phishing, ID scans or health information sent as an unprotected attachment. Supervisory authorities' published breach statistics (for example the UK ICO's data security incident trends) consistently list data emailed to the wrong recipient and phishing among the most common incident types. Email is where personal data travels most often, so it is one of the first places to look in any GDPR compliance effort.

The legal basis: Articles 5, 32, 33 and 34

• Article 5(1)(f), integrity and confidentiality: personal data must be processed with appropriate security, including protection against unauthorized processing, accidental loss and damage.
• Article 32, security of processing: controllers and processors must implement measures appropriate to the risk, "taking into account the state of the art". The article names encryption, ongoing confidentiality and resilience of systems, the ability to restore access after an incident, and regular testing of the measures.
• Article 33, notification to the supervisory authority: a personal data breach must be reported without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. Every breach must be documented internally, whether reported or not.
• Article 34, communication to data subjects: if a breach is likely to result in a high risk, the affected people must be told without undue delay.

The full text is available on EUR-Lex. The UK GDPR contains equivalent provisions, and many other data protection laws, such as Türkiye's KVKK, impose similar security duties.

The most common email-related breaches

• Account takeover through phishing: the attacker reads customer or employee data in the compromised mailbox, or uses it to attack colleagues and customers.
• Misdirected email: autocomplete picks the wrong recipient, or a spreadsheet with personal data goes to the wrong person. Using To/Cc instead of Bcc for a mailing to many people is a classic variant.
• Unprotected attachments: ID documents, health, financial or HR data sent as plain attachments.
• Leaver accounts left open: mailboxes of former employees that stay active create both an access risk and unnecessary retention.
• Malware delivered by email: ransomware arriving as an attachment that encrypts or exfiltrates data.

Technical and organizational measures for email

What to do if there is a breach

If a phishing-driven account takeover gave an attacker access to a mailbox containing personal data, that is likely a personal data breach under the GDPR. The general process:

1. Contain it: reset the password, revoke sessions and app passwords, remove any forwarding rules the attacker created, and suspend the account if needed.
2. Assess the scope: record which data and how many people were affected, and when you became aware of it.
3. Notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. If you are a processor, notify the controller without undue delay (Article 33(2)).
4. Inform the affected people where the risk to them is high.
5. Fix the root cause so it can't happen the same way again (missing MFA, unfiltered phishing, missing DMARC).
6. Document it: keep a record of the facts, effects and remedial action, even if you decided not to notify.

Email service providers are processors

Your mail host, your filtering service and your archiving provider all process personal data on your behalf, so under Article 28 you need a data processing agreement (DPA) with each of them. Also check where they process data: transfers outside the EU/EEA (or the UK) need an adequacy decision or another safeguard such as Standard Contractual Clauses under Chapter V.

Spambil processes mail on infrastructure in Türkiye, which is not covered by an EU or UK adequacy decision. Our Data Processing Addendum covers that transfer with the EU Standard Contractual Clauses and the UK Addendum; record it as an international transfer in your records of processing.

Practical checklist

• Is incoming mail automatically scanned for spam, viruses and phishing?
• Is multi-factor authentication enforced on every mailbox?
• Are SPF, DKIM and DMARC in place? (See SPF, DKIM and DMARC explained.)
• Are files with personal data sent as unencrypted attachments?
• Are leavers' accounts closed on their last day?
• Is there a written procedure for who does what in a breach, including the 72-hour clock?
• Do you have DPAs with your email providers, and do you know where they process data?

Where Spambil fits

Spambil addresses the first item on that list directly: every incoming message is scanned for spam, viruses and phishing, and quarantine actions are logged. That gives you an up-to-date, documented malware and phishing control with a single MX change. But GDPR compliance is never delivered by one product; the other items on the checklist require internal processes and policies.

Frequently asked questions

Related pages