Ordinary personal data such as name, job title and work email may be sent in an ordinary email when there is a legitimate purpose. Confidential and sensitive information, such as national ID numbers and health information, has to be sent encrypted. That has been the Danish Data Protection Agency’s practice for private companies since 1 January 2019.
That is the main rule. In practice, the problems arise in the details: the wrong recipient, the long thread with old attachments, and the inbox that has turned into an archive. Email is also one of the Danish Data Protection Agency’s supervisory focus areas for 2026, where the agency looks at controllers that process confidential and sensitive information by email, as the Confederation of Danish Industry describes in its review of the agency’s focus areas (in Danish).
What may an ordinary email contain?
Most of what employees send during a day is unproblematic. Meeting invitations, quotes, questions to a colleague and arrangements with a customer’s contact person contain ordinary personal data, and you may send those without special measures as long as there is a work-related purpose.
Two caveats always apply. Send only the information the recipient needs. And send only to those who need it. “Reply all” to 30 people about one colleague’s holiday wishes is rarely necessary.
What requires encryption?
If the email or the attachment contains confidential or sensitive personal data, it has to be encrypted when it is sent over the internet. This includes:
- national ID numbers
- health information, including diagnoses and details of sickness absence
- information about trade union membership, religion, political opinions and sexual orientation
- information about criminal offences
- salary, debt and other financial matters concerning private individuals
- personnel matters such as warnings and dismissals
The minimum requirement is encryption at the transport layer, also known as TLS, in an up-to-date version. Where the risk to the people concerned is high, the Danish Data Protection Agency recommends encryption all the way from sender to recipient. The company has to decide which level is necessary in a risk assessment.
Employees first and foremost need to know the company’s solution. Many email systems use TLS automatically when the recipient’s server supports it, but the employee cannot see whether it happened. Most organisations therefore have a fixed method for confidential information, such as a “Send securely” button, a portal where the recipient logs in, or Denmark’s Digital Post. If it exists, it should be used every time.
If you are unsure whether a piece of information is confidential or sensitive, we have gathered the rules in the article on ordinary and sensitive personal data.
Five mistakes that keep recurring
Most of the personal data breaches reported to the Danish Data Protection Agency concern unintentional sharing with the wrong recipients. The agency says so in its guide to the 10 typical breaches. Email accounts for a large share of them.
Autofill picks the wrong person. Two contacts are called Mette, and the email program suggests the one you wrote to last. Read the full address before you send. A short send delay, which IT can switch on, lets an email be recalled within the first minute.
Cc instead of bcc. An invitation to 200 customers with every address visible in the cc field is a breach. Use bcc or a mailing tool for bulk emails.
The wrong attachment. Open the file before you send it. Check spreadsheets in particular for hidden tabs and columns.
Forwarding the whole thread. A thread of twelve emails can contain information further down that the new recipient should not see. Write a new email with what is relevant.
Personal data in the subject line. The subject line appears in notifications and overviews and is not always encrypted in the same way as the content. Write “Regarding your case” instead of a name, national ID number or diagnosis.
When you receive something you did not ask for
Customers and citizens often send national ID numbers and health information in ordinary emails on their own initiative. The company did not ask for it, and it is still responsible for the information from the moment it arrives.
Move the information into the system where it belongs and delete the email once that is done. Reply without repeating the confidential information in your answer. And kindly point to the secure channel for next time.
Clean up the inbox
The GDPR requirement that information is deleted when the purpose has been fulfilled applies in the email system too. An inbox with ten years of correspondence contains job applications, sick notes and customer information that should long ago have been deleted or filed somewhere else.
It also makes the damage greater if the account is taken over. An attacker who gets into a mailbox through phishing gains access to everything in it. The less there is, the smaller the breach.
A realistic routine is to move what needs to be kept into the business system or case folder as you go, and clean up the rest a couple of times a year. Automatic deletion after a fixed number of years can take care of what is overlooked.
May you send newsletters and marketing?
People who search for GDPR and email are often thinking of marketing. That is a different set of rules. In Denmark, section 10 of the Marketing Practices Act generally requires the recipient’s consent before you send advertising by email, and the Consumer Ombudsman supervises it. The GDPR applies alongside it to the processing of the email addresses themselves.
For employees outside marketing, the practical rule is simple: do not use customers’ email addresses to send offers and news unless marketing has confirmed that consent is in place.
Rules employees can remember
An email policy is followed when it is short, and when employees have tried it out on situations they know. A caseworker, a salesperson and an HR partner send very different emails, and each needs their own examples.
That is how we work with the topic in our GDPR training. The course is developed together with specialists in data protection law, and the scenarios can be adapted to your own working day, so employees practise the choices they make in their own email program. Read our overview of GDPR rules for employees as well, or contact us to see a demo.
