# Email and GDPR for a small company: the practical basics > A plain guide to GDPR for a small company that lives in email: what counts as personal data, lawful reasons, access requests, retention and a short checklist. - Published: 2026-10-17 - Author: Koltrix Team - Category: Startups - Source: https://koltrix.com/blog/email-and-gdpr-for-a-small-company-the-practical-basics If you have customers in the European Union or the United Kingdom, the General Data Protection Regulation, GDPR, applies to you, even if you are a team of three. Email is where most of your personal data lives: names, addresses, phone numbers, invoices, complaints and the odd health detail somebody mentions in passing. This is a practical guide, not legal advice. It covers the points a small company meets most often, and what to do about each in your inbox. For anything that affects your business seriously, speak to a qualified adviser in your country. ## What counts as personal data in email Personal data is any information about an identifiable person. In email that includes: - Names and email addresses, including work addresses - Phone numbers, home addresses and account numbers - The content of messages that describe a person or their situation - Attachments such as invoices, contracts and ID scans - Metadata: who wrote to whom, and when An email address alone is personal data, so even a mailing list is covered. You do not need to hold anything sensitive for the rules to apply. See [personal data in email: plain rules for small teams](/blog/personal-data-in-email-plain-rules-for-small-teams) for what to keep out of messages. ## You need a reason for each use GDPR asks that you have a lawful basis for using personal data. For most small companies, three bases cover email: - **Contract.** You email a customer because you must to provide the service: receipts, account notices, replies to support questions. - **Legitimate interest.** You have a good business reason that does not override the person's rights, such as following up on an existing customer relationship. You should be able to explain it. - **Consent.** The person has clearly agreed, for example by ticking a box to receive a newsletter. Consent should be specific, easy to withdraw and recorded. Marketing to people who have not asked for it is where small companies get into trouble. Check the rules for your country, keep a record of how each person joined your list, and make unsubscribing easy. [Cold email basics: consent, unsubscribe and sender identity](/blog/cold-email-basics-consent-unsubscribe-sender-identity) goes through the essentials. ## Be clear with people You must tell people what you do with their data. For a small company, that usually means a privacy page that says, in plain language: - Who you are and how to contact you about privacy - What data you collect and why - Who else receives it, such as your email provider or payment processor - How long you keep it - What rights people have and how to use them Link to it from sign-up forms and your footer. Keep it accurate; a vague page copied from somewhere else is worse than a short honest one. ## Know your providers Any company that handles personal data on your behalf, such as an email host, a support tool or a newsletter service, is a processor. You are expected to choose providers carefully and to have an agreement that covers data protection. Most reputable providers publish one you can accept online. Keep a simple list of the services you use for email and what each one holds. Where your data is stored also matters. Some providers store it inside the EU; others transfer it elsewhere under extra safeguards. Know which applies to you, and say so on your privacy page if it affects customers. ## People can ask for their data Individuals have rights, and email is how most requests arrive. The main ones: - **Access.** They can ask what you hold about them and get a copy. - **Correction.** They can ask you to fix wrong data. - **Erasure.** In many cases they can ask you to delete it. - **Objection.** They can tell you to stop using it for marketing. You generally have one month to respond. To be ready: 1. Pick one person who owns privacy requests, and one address such as privacy@. 2. Keep a log: who asked, when, what you did and when you answered. 3. Check identity before you hand over data. A reply to the same address on file is a reasonable minimum. 4. Know where the data is: your mailbox, your CRM, your support tool, backups. Our guide to [handling privacy and data requests by email](/blog/handling-privacy-and-data-requests-by-email) gives a step-by-step process and wording. ## Do not keep everything forever Keep personal data only as long as you need it. Old mailboxes full of customer details are both a risk and an obligation. Set a retention rule that you can explain, such as keeping support conversations for two years after they close and invoices for as long as tax law requires. [Team mailbox archive and retention habits](/blog/team-mailbox-archive-retention-habits) shows how to put this into daily practice. ## Keep it secure GDPR expects reasonable security. For an email-centred company, that means: - Two-step verification on every mailbox - Unique passwords stored in a password manager - Access to shared mailboxes only for people who need it, removed when they leave - No sensitive data sent by email when a safer channel exists - Care with attachments and with who you copy If a mailbox is compromised or a message goes to the wrong person with personal data in it, that may count as a breach. Some breaches must be reported to the authority within 72 hours. Decide in advance who investigates and who decides, and write the steps on one page. ## A short checklist - We know where personal data sits in our email and tools. - Each use has a reason we can state. - Our privacy page is accurate and linked from forms. - We have a list of providers and agreements. - Someone owns privacy requests and a log exists. - We have a retention rule and follow it. - Mailboxes are secured and access is reviewed. - We know what to do if something goes wrong. ## What to remember GDPR for a small company is mostly habit: know what you hold, have a reason for using it, tell people plainly, answer their requests on time, delete what you no longer need, and keep accounts secure. Start with the checklist, fix the biggest gap first, and ask a professional when the stakes are high.