With personal data often included in messages and their attachments, there are several ways that your use of emails can put you at risk of a data breach and non-compliance with GDPR. In this post, we examine the risks and discuss strategies for addressing them.
Contents
The risks businesses face
For the ICO, which oversees GDPR, email has been a consistent cause of concern. The main areas of risk include:
- Human error – sending information to the wrong recipients
- Interception of unencrypted messages – when your data is sent without encryption, it can be stolen or tampered with in transit.
- Phishing and malware – email is the main cause of cyberattacks that compromise accounts and give criminals access to your data and systems.
- Weak technical safeguards – failure to use email encryption or multi-factor authentication leaves your mailboxes vulnerable.
- Unlawful marketing – sending unsolicited messages without explicit consent breaches GDPR.
- Retention and storage issues – keeping personal data in your mailboxes for longer than needed contravenes the GDPR storage limitation principle.
- International transfers – moving email data outside the UK, where it becomes subject to foreign jurisdiction, can breach UK GDPR.
To address these risks, you’ll need to manage your data carefully, use secure infrastructure, and choose a compliant email hosting provider.
Is your business still using Gmail? Read: How Email Hosting Protects Brand Identity Better Than Gmail or Yahoo
Data sovereignty under UK GDPR
In the UK, personal data is governed by UK GDPR and the Data Protection Act 2018. These laws mean that you remain legally responsible for protecting personal data, under UK law, even if your email provider stores or transfers it outside of the country.
The compliance risk for businesses is that if your email data is stored abroad, it falls under the jurisdiction of that country’s laws as well. For instance, if your email is stored on servers in America, it is subject to the US CLOUD Act, which allows US authorities to access it. If this happens, you are potentially breaching GDPR.
Another concern is that even if your data is stored in a UK data centre, if the provider is an overseas company, it may still be required to disclose that data under its home country’s laws.
To ease this issue, the UK government has issued ‘adequacy regulations’ for some countries, e.g., EU and EEA states, enabling personal data to be transferred there without additional safeguards. For transfer to other countries, you would need a legal contract, such as an International Data Transfer Agreement (IDTA) and would be required to carry out a Transfer Risk Assessment to ensure privacy rights remain protected.
A solution that avoids all these risks and complications, and ensures that personal data stays completely within UK jurisdiction, is to host your email with a UK-owned provider that stores all your email data in UK-based data centres.
Don’t fall victim to a phishing attack. Read: Emerging Phishing Tactics and How to Spot Them
Secure email systems
There are several measures that businesses can implement to improve compliance and reduce the threat of a data breach. These are:
Encryption is the most effective way to protect email data from being accessed or tampered with during transmission. Email certificates, which work in a similar way to SSL certificates, encrypt both emails and their attachments. Moreover, they verify your identity to the recipient, so they know the email is genuinely from your business.
Email filtering is another essential measure. With phishing and malware attacks becoming more sophisticated, advanced spam and virus scanning tools, like SpamExperts, stop malicious emails from reaching your inbox, reducing the risk of employees falling victim.
Archiving and recovery: It is also vital to ensure your email hosting provides GDPR compliant archiving and recovery features. Not only does this prevent emails from getting lost; it also enables you to search and retrieve messages, set retention policies and protect stored emails with encryption. This supports data subject rights, such as the right of access or deletion, and retention policies, so you only keep people’s data for as long as necessary. Email backups, meanwhile, ensure that if email data is lost, mailboxes can be quickly restored.
Backup your email and all other data easily. Read: Cloud Backups – The Best Way to Protect Website Data
Staff training has become increasingly important for email GDPR compliance. Two of the biggest causes of data breaches are sending emails to the wrong recipients and employees falling victim to phishing scams. New staff Induction and regular training can significantly reduce the chances of these happening.
Access control: To prevent unauthorised access, admins can enforce strong password rules on email accounts, making it harder for criminals to hack in. Two-factor authentication (2FA) provides additional protection, ensuring that compromised credentials on their own are not sufficient to give access.
Account management: A potential security and compliance risk can be posed by maintaining the email accounts of former staff. Deleting these as soon as the employee leaves prevents them from retaining access to data they are no longer authorised to see.
Compliance going forward
As GDPR can change, businesses need to ensure they remain compliant. At the same time, changes to the laws in other countries could result in adequacy regulations being revoked, preventing the future transfer of data to affected states. To prevent falling foul of any changes, a business’s data controller must stay up to date with ICO communications and implement changes where required.
Key takeaways
- Email is a frequent source of GDPR compliance failures, especially in relation to security and retention.
- UK GDPR introduces sovereignty challenges, including adequacy reviews and CLOUD Act concerns.
- Encryption, filtering, archiving, backups and retention controls are essential for compliance.
- Hosting email with UK-owned providers in UK data centres provides stronger protection and clearer accountability.
- Regular reviews are necessary to keep pace with regulatory change.
Conclusion
To ensure your email complies with GDPR, you must consider both security and sovereignty. This includes everything from encryption and filtering to retention and hosting. Choosing a provider owned and based in the UK, and which offers the right security tools and safeguards, makes it far easier to maintain compliance and keep personal data protected.
Webhosting UK offers professional email hosting solutions that support GDPR compliance. UK-owned and based, our solutions include archiving and recovery, SpamExperts filtering, email certificates and cloud-based backups. We also provide all the features you’d expect from business-class email: storage, email addresses, webmail, mobile access, email client integration, calendars, to-dos, 24/7 support and more. For more information, visit our Email Hosting page.
