GDPR and Email Security: Is Your Domain Compliant?
GDPR is often discussed in terms of cookie banners and privacy policies. But Article 32 — the requirement to implement "appropriate technical and organisational measures" — applies directly to how your domain handles email. A domain with no DMARC policy is a domain with a known, fixable vulnerability. Under GDPR, that matters.
What Article 32 Actually Says
GDPR Article 32 requires organisations to implement measures that ensure security "appropriate to the risk" of data processing. It specifically mentions:
- Pseudonymisation and encryption of personal data
- The ability to ensure ongoing confidentiality and integrity of processing systems
- A process for regularly testing and evaluating the effectiveness of technical measures
Email is one of the primary channels through which personal data moves. A domain vulnerable to spoofing or without encrypted mail delivery is a domain where personal data can be intercepted or misdirected — both of which create reportable breach scenarios under Article 33.
The Three Email Spoofing Risks
1. Your domain is spoofed to attack your customers. Without DMARC enforcement, an attacker can send emails that appear to come from your domain. If those emails trick customers into sending personal data or clicking malicious links, the reputational and legal exposure falls partly on you — you had the technical means to prevent it.
2. Your staff are targeted with spoofed emails. Phishing attacks targeting employees often use domains that look similar to internal or trusted sender domains. DMARC protects your own domain from being spoofed in these attacks. It does not protect against look-alike domains — but it removes one attack vector.
3. Email containing personal data is intercepted in transit. If your email infrastructure does not enforce TLS for delivery, emails containing personal data can be delivered unencrypted. MTA-STS (RFC 8461) is the mechanism that tells sending mail servers to require TLS — without it, a sending server may fall back to unencrypted delivery.
What the DPC and ICO Look for After a Breach
Both the Irish Data Protection Commission (DPC) and the UK's Information Commissioner's Office (ICO) assess technical measures as part of any post-breach investigation. A domain with:
- No DMARC record, or DMARC policy of
none - No SPF record or a permissive
+allpolicy - No DKIM configured
- An expired or invalid SSL certificate
...is a domain that will struggle to demonstrate "appropriate technical measures" in the context of an email-related data breach.
The ICO's 2023 guidance on security explicitly references email authentication as a baseline control. The DPC has issued reprimands in several cases where preventable technical vulnerabilities contributed to a breach.
The GDPR Email Security Checklist
These are the technical controls that evidence appropriate measures under Article 32 for email:
- SPF record with
-all(hardfail), under 10 DNS lookups - DKIM configured with a 2048-bit key minimum
- DMARC policy of
quarantineorrejectwith a reporting address - Valid SSL certificate with TLS 1.2 minimum (TLS 1.3 preferred)
- HSTS header to ensure browsers always connect over HTTPS
- MTA-STS to require TLS for incoming mail delivery (emerging standard)
You can check all of these for your domain in one free scan — no sign-up required.