As soon as a company sends email through an external service, that service processes personal data: email addresses, names, content, often order or even health information. The GDPR sets clear requirements for this. This overview shows your duties as controller and what to look for when choosing a provider.
1. The provider is a processor
An email service processes your recipients' data on your behalf. Under Art. 28 GDPR you therefore need a data processing agreement (DPA). It covers, among other things:
- subject, duration, nature and purpose of processing, data categories and data subjects,
- the provider acting only on your instructions and its staff's confidentiality,
- technical and organizational measures under Art. 32 GDPR,
- the use of subprocessors and your right to object,
- support with data subject rights and breaches,
- deletion or return of data at the end of the contract.
Without a DPA, transferring data to the service is not lawful – even if everything works technically.
2. Third-country transfers and US providers
Many well-known email services are US companies. Transfers to third countries are only allowed under Chapter V GDPR, for example via an adequacy decision or standard contractual clauses. Certified US companies have been covered by the EU-US Data Privacy Framework since 2023. Many data protection officers still see a residual risk: US providers are subject to laws such as the CLOUD Act that can allow government access even to data in European data centers – and the CJEU struck down the predecessor, Privacy Shield, in 2020.
The simplest answer is a provider based in the EU that processes data only in the EU and uses no US subprocessors.
3. Data minimization and retention
Under Art. 5 GDPR data may only be kept as long as needed. For email sending that means:
- Content is hardly needed after delivery – a few days for support and debugging suffice.
- Metadata such as recipient and delivery status is needed a bit longer for evidence and reporting, but not indefinitely.
- Suppression lists and consent records are exceptions: they must persist so unsubscribes stick and consent can be proven.
4. Tracking needs consent
Open tracking via pixels and click tracking via redirects access information on the recipient's device. Under the ePrivacy rules (in Germany § 25 TDDDG) that generally requires consent, plus a legal basis under Art. 6 GDPR for the analysis. Many companies therefore skip tracking or collect consent with the newsletter subscription.
5. Security
Art. 32 GDPR requires an appropriate level of security. For email services that means TLS on every hop, encrypted storage of keys and secrets, strict roles and permissions, audit logs and working backups. Ask to see the provider's security measures.
6. Data subject rights and breaches
Recipients may request access, erasure or object. Your service should help: delete contacts, export data, honor unsubscribes immediately. After a breach you must notify the supervisory authority within 72 hours (Art. 33 GDPR) – so your processor must inform you without undue delay.
Checklist for choosing a provider
- DPA under Art. 28 GDPR available without negotiation?
- Company seat and processing location in the EU?
- Public subprocessor list without US providers?
- Configurable retention for content and metadata?
- Tracking off by default?
- Built-in proof of consent for newsletters?
- Export and deletion of all data in one click?