GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup.
Should, from the Data Controller's point of view, emails be either anonymised or pseudonymised?
To put it simple, I run a website which stores users' emails; can I store them in the DB in plaintext?
The GDPR does not regulate specific security measures beyond making recommendations about what you should considder.
It requires you to evalute risks and, if necessary, implement security measures to mitigate those risks. Doing a DPIA (Data Protection Impact Assessment) to identify levels of risk may be helpful.
To do a DPIA, one obviously need to know the website and what personal data it process. Only you can do that.
As an example, I would say that if you run a website for sharing cupcake recipes, you probably would not need to encrypt the emails. If, on the other hand, you run a website were AIDS-patients share experiences, exposing a user's email address to a third part would be very harmful to the individual, and you should probably implement additional layers of security, such as encryption.
