The first thing to say is that the General Data Protection Regulation (GDPR) does not provide specific rules for the handling and archiving of emails, but it does make a big difference to the way a business or organisation should think about dealing with emails.
This is because the stipulations of GDPR clearly have an effect on the use of emails as a form of communication and marketing.
What is the effect of GDPR on email use and archiving?
Here are some of the things a business or organisation needs to think about when sending or archiving emails. If it does not do so it could face the imposition of significant fines.
- No email contact can be made with clients without prior consent.
- Consent needs to be explicit and informed.
- Once consent is received it can only be used for that specific reason.
- Personal data can only be held and processed for as long as is necessary for a specific purpose. This necessitates carefully consideration of how long archived emails need to be kept.
- GDPR does not stipulate specific security requirements but it does state that you need to document your security processes. This means that you need to examine the security of email sending and archiving. You also need to encrypt any secure personal data.
- Data breaches need to be reported with 72 hours. So processes and procedures need to be in place, to ensure that this happens.
Emails are important communication tools for any business or organisation. Once the GDPR becomes law, businesses and organisations can still use email communication effectively, but they need to ensure that they pay attention to the stipulations of the GDPR, in order to make sure that they are compliant.
Related GDRP Articles