Does GDPR impose requirement for an EU based e-mail address? I mean, not directly but indirectly for all practical purposes.

Assume an EU based company having a public website.

GDPR requires a contact e-mail being mentioned in the website's privacy policy. Or let's say e-mail contact is a possibility for data subjects to demand the right to be forgotten from the data controller (website).

Is the e-mail provider and data storage location of the incoming e-mail by the data subject required to be inside EU?

Otherwise the argument could be made the data subject is forced to transmit its data outside of EU in order to submit requests to the data controller (website)?

1 Answer 1


Otherwise the argument could be made the data subject is forced to transmit its data outside of EU in order to submit requests to the data controller (website)?

There is no issue with it as long the receiver is complying with the GDPR.

For example, even if you are outside the EU, you would be allowed1 to receive the email in order to process it for its intended use (that you perform the data modification request). That would amount to processing is necessary for compliance with a legal obligation to which the controller is subject (art 6.1, c point and probably others).

You could probably argue that you can store the e-mail for certain time to show (in case of dispute) what action did the user request you in order to certify compliance (legitimate interest, art. 6.1, f point)2.

What is important here is that you only use the email and the info in it contained for its expected purpose, and do not use it in any other way (e.g. to spam the subject).

Of course, it could be interesting that, if your email provider is a different organization, then that organization does comply with GDPR, too. But (as far I understand it) in case it does not then it would be mostly the responsability of your email provider, not yours.

In fact, nowhere in the GDPR states that the data must reside in the EU. It does require certain conditions and checks in the case of international data transfer between controllers and operators, but it allows them.

Precisely one of the most commented aspects of the GDPR is that it claims jurisdiction over every entity that holds personal data of EU residents, regardless of where the entity or the data is.

1In fact you are not only allowed but required to process it, because you are mandated to process the data subjects requests to exercise their rights, and that is impossible without identifying the data subject's identity.

2IANAL, IANYL, and legitimate interest is a somewhat fuzzy concept. Consult with a lawyer or GDPR expert.

  • So if the e-mail provider is GDPR non-compliant that's a problem? But couldn't it be argued that the e-mail provider by the website owner (data controller) is using a non-EU data processor which then would require explicit consent for the data transfer? If the e-mail provider is considered a data processor, wouldn't that also result in a requirement for a data processing agreement (DPA) between data controller and data processor?
    – broks
    Jan 12, 2019 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .