GDPR compliance: the practical guide
Make your email signatures GDPR-compliant.
Email signatures contain personal data. Here is how to handle it in line with GDPR.
Identify the data processed
Name, first name, job title, department, business email and phone, possibly a photo: this is the data about your employees used in signatures.
Choose the legal basis
The employer's legitimate interest generally covers professional information. For the photo, favor the employee's consent, which they must be able to withdraw.
Inform employees
Record the processing in your register and inform employees: purpose, data used, retention period, rights.
Frame the processor relationship
SIGNESTO acts as a processor for your employees' data. A Data Processing Agreement (DPA) governs this relationship.
Your email recipients
Click tracking on banners must remain aggregated and proportionate. Inform your contacts in your privacy policy.
Handling departures
When an employee leaves the company, their data must be deleted within a reasonable time. With directory sync, deactivating the account happens automatically.
Checklist
- Processing recorded in the register.
- Employees informed.
- DPA signed with the provider.
- Photo optional.
- Click tracking documented.
