{"id":41011,"date":"2026-09-15T10:00:00","date_gmt":"2026-09-15T10:00:00","guid":{"rendered":"https:\/\/grapenordic.com\/?p=41011"},"modified":"2026-11-11T09:17:31","modified_gmt":"2026-11-11T09:17:31","slug":"gdpr-email","status":"publish","type":"post","link":"https:\/\/grapenordic.com\/en\/gdpr-email\/","title":{"rendered":"What may employees write and send by email under GDPR?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Ordinary personal data such as name, job title and work email may be sent in an ordinary email when there is a legitimate purpose. Confidential and sensitive information, such as national ID numbers and health information, has to be sent encrypted. That has been the Danish Data Protection Agency&#8217;s practice for private companies since 1 January 2019.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is the main rule. In practice, the problems arise in the details: the wrong recipient, the long thread with old attachments, and the inbox that has turned into an archive. Email is also one of the Danish Data Protection Agency&#8217;s supervisory focus areas for 2026, where the agency looks at controllers that process confidential and sensitive information by email, as the Confederation of Danish Industry describes in its <a href=\"https:\/\/www.danskindustri.dk\/brancher\/di-radgiverne\/nyhedsarkiv\/2019\/2026\/datatilsynets-fokus-i-2026-det-skal-radgivere-have-styr-pa\/\">review of the agency&#8217;s focus areas<\/a> (in Danish).<\/p>\n\n\n\n<h2 id=\"h-what-may-an-ordinary-email-contain\" class=\"wp-block-heading\">What may an ordinary email contain?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most of what employees send during a day is unproblematic. Meeting invitations, quotes, questions to a colleague and arrangements with a customer&#8217;s contact person contain ordinary personal data, and you may send those without special measures as long as there is a work-related purpose.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two caveats always apply. Send only the information the recipient needs. And send only to those who need it. &#8220;Reply all&#8221; to 30 people about one colleague&#8217;s holiday wishes is rarely necessary.<\/p>\n\n\n\n<h2 id=\"h-what-requires-encryption\" class=\"wp-block-heading\">What requires encryption?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the email or the attachment contains confidential or sensitive personal data, it has to be encrypted when it is sent over the internet. This includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>national ID numbers<\/li>\n\n\n\n<li>health information, including diagnoses and details of sickness absence<\/li>\n\n\n\n<li>information about trade union membership, religion, political opinions and sexual orientation<\/li>\n\n\n\n<li>information about criminal offences<\/li>\n\n\n\n<li>salary, debt and other financial matters concerning private individuals<\/li>\n\n\n\n<li>personnel matters such as warnings and dismissals<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The minimum requirement is encryption at the transport layer, also known as TLS, in an up-to-date version. Where the risk to the people concerned is high, the Danish Data Protection Agency recommends encryption all the way from sender to recipient. The company has to decide which level is necessary in a risk assessment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Employees first and foremost need to know the company&#8217;s solution. Many email systems use TLS automatically when the recipient&#8217;s server supports it, but the employee cannot see whether it happened. Most organisations therefore have a fixed method for confidential information, such as a &#8220;Send securely&#8221; button, a portal where the recipient logs in, or Denmark&#8217;s Digital Post. If it exists, it should be used every time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are unsure whether a piece of information is confidential or sensitive, we have gathered the rules in the article on <a href=\"https:\/\/grapenordic.com\/en\/ordinary-and-sensitive-personal-data\/\">ordinary and sensitive personal data<\/a>.<\/p>\n\n\n\n<h2 id=\"h-five-mistakes-that-keep-recurring\" class=\"wp-block-heading\">Five mistakes that keep recurring<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most of the personal data breaches reported to the Danish Data Protection Agency concern unintentional sharing with the wrong recipients. The agency says so in its guide to the 10 typical breaches. Email accounts for a large share of them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Autofill picks the wrong person.<\/strong> Two contacts are called Mette, and the email program suggests the one you wrote to last. Read the full address before you send. A short send delay, which IT can switch on, lets an email be recalled within the first minute.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cc instead of bcc.<\/strong> An invitation to 200 customers with every address visible in the cc field is a breach. Use bcc or a mailing tool for bulk emails.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The wrong attachment.<\/strong> Open the file before you send it. Check spreadsheets in particular for hidden tabs and columns.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Forwarding the whole thread.<\/strong> A thread of twelve emails can contain information further down that the new recipient should not see. Write a new email with what is relevant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Personal data in the subject line.<\/strong> The subject line appears in notifications and overviews and is not always encrypted in the same way as the content. Write &#8220;Regarding your case&#8221; instead of a name, national ID number or diagnosis.<\/p>\n\n\n\n<h2 id=\"h-when-you-receive-something-you-did-not-ask-for\" class=\"wp-block-heading\">When you receive something you did not ask for<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Customers and citizens often send national ID numbers and health information in ordinary emails on their own initiative. The company did not ask for it, and it is still responsible for the information from the moment it arrives.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Move the information into the system where it belongs and delete the email once that is done. Reply without repeating the confidential information in your answer. And kindly point to the secure channel for next time.<\/p>\n\n\n\n<h2 id=\"h-clean-up-the-inbox\" class=\"wp-block-heading\">Clean up the inbox<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The GDPR requirement that information is deleted when the purpose has been fulfilled applies in the email system too. An inbox with ten years of correspondence contains job applications, sick notes and customer information that should long ago have been deleted or filed somewhere else.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It also makes the damage greater if the account is taken over. An attacker who gets into a mailbox through phishing gains access to everything in it. The less there is, the smaller the breach.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A realistic routine is to move what needs to be kept into the business system or case folder as you go, and clean up the rest a couple of times a year. Automatic deletion after a fixed number of years can take care of what is overlooked.<\/p>\n\n\n\n<h2 id=\"h-may-you-send-newsletters-and-marketing\" class=\"wp-block-heading\">May you send newsletters and marketing?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">People who search for GDPR and email are often thinking of marketing. That is a different set of rules. In Denmark, section 10 of the Marketing Practices Act generally requires the recipient&#8217;s consent before you send advertising by email, and the Consumer Ombudsman supervises it. The GDPR applies alongside it to the processing of the email addresses themselves.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For employees outside marketing, the practical rule is simple: do not use customers&#8217; email addresses to send offers and news unless marketing has confirmed that consent is in place.<\/p>\n\n\n\n<h2 id=\"h-rules-employees-can-remember\" class=\"wp-block-heading\">Rules employees can remember<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An email policy is followed when it is short, and when employees have tried it out on situations they know. A caseworker, a salesperson and an HR partner send very different emails, and each needs their own examples.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is how we work with the topic in our <a href=\"https:\/\/grapenordic.com\/en\/online-courses\/gdpr\/\">GDPR training<\/a>. The course is developed together with specialists in data protection law, and the scenarios can be adapted to your own working day, so employees practise the choices they make in their own email program. Read our overview of <a href=\"https:\/\/grapenordic.com\/en\/gdpr-rules-for-employees\/\">GDPR rules for employees<\/a> as well, or <a href=\"https:\/\/grapenordic.com\/en\/contact\/\">contact us<\/a> to see a demo.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ordinary personal data such as name, job title and work email may be sent in an ordinary email when there is a legitimate purpose. Confidential and sensitive information, such as national ID numbers and health information, has to be sent encrypted. That has been the Danish Data Protection Agency&#8217;s practice for private companies since 1 [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":37573,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[11],"tags":[],"class_list":["post-41011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.8 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>What may employees send by email under GDPR?<\/title>\n<meta name=\"description\" content=\"GDPR and email in practice. See which personal data may be sent, when the email has to be encrypted, and how to avoid the most common mistakes.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/grapenordic.com\/en\/gdpr-email\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What may employees write and send by email under GDPR?\" \/>\n<meta property=\"og:description\" content=\"GDPR and email in practice. See which personal data may be sent, when the email has to be encrypted, and how to avoid the most common mistakes.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/grapenordic.com\/en\/gdpr-email\/\" \/>\n<meta property=\"og:site_name\" content=\"Grape\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/grapenordic\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-15T10:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-11T09:17:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/03\/P1127382-1-scaled.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Eya Beldi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Eya Beldi\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/\"},\"author\":{\"name\":\"Eya Beldi\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#\\\/schema\\\/person\\\/1ab7afa85a90f45373c38bcb074f5c1b\"},\"headline\":\"What may employees write and send by email under GDPR?\",\"datePublished\":\"2026-09-15T10:00:00+00:00\",\"dateModified\":\"2026-11-11T09:17:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/\"},\"wordCount\":1065,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/grapenordic.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/P1127382-1-scaled.webp\",\"articleSection\":[\"Compliance\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/\",\"url\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/\",\"name\":\"What may employees send by email under GDPR?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/grapenordic.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/P1127382-1-scaled.webp\",\"datePublished\":\"2026-09-15T10:00:00+00:00\",\"dateModified\":\"2026-11-11T09:17:31+00:00\",\"description\":\"GDPR and email in practice. See which personal data may be sent, when the email has to be encrypted, and how to avoid the most common mistakes.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#primaryimage\",\"url\":\"https:\\\/\\\/grapenordic.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/P1127382-1-scaled.webp\",\"contentUrl\":\"https:\\\/\\\/grapenordic.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/P1127382-1-scaled.webp\",\"width\":2560,\"height\":1707},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/gdpr-email\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Frontpage\",\"item\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What may employees write and send by email under GDPR?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/\",\"name\":\"Grape\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#organization\",\"name\":\"Grape\",\"url\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/grapenordic.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/grape_logo_hvid-2-1.webp\",\"contentUrl\":\"https:\\\/\\\/grapenordic.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/grape_logo_hvid-2-1.webp\",\"width\":433,\"height\":130,\"caption\":\"Grape\"},\"image\":{\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/grapenordic\\\/\",\"https:\\\/\\\/www.facebook.com\\\/grapenordic\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC2OoQQVitKhGDNqQEH0av0Q\"],\"legalName\":\"Grape A\\\/S\",\"vatID\":\"DK26079926\",\"foundingDate\":\"2001\",\"email\":\"info@grapenordic.com\",\"telephone\":\"+45 70 10 20 48\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Aldersrogade 1\",\"postalCode\":\"2100\",\"addressLocality\":\"K\u00f8benhavn \u00d8\",\"addressCountry\":\"DK\"},\"location\":[{\"@type\":\"Place\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Aldersrogade 1\",\"postalCode\":\"2100\",\"addressLocality\":\"K\u00f8benhavn \u00d8\",\"addressCountry\":\"DK\"}},{\"@type\":\"Place\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Mejlgade 27\",\"postalCode\":\"8000\",\"addressLocality\":\"Aarhus\",\"addressCountry\":\"DK\"}}],\"contactPoint\":{\"@type\":\"ContactPoint\",\"contactType\":\"customer service\",\"telephone\":\"+45 70 10 20 48\",\"email\":\"info@grapenordic.com\",\"url\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/contact\\\/\",\"availableLanguage\":[\"Danish\",\"English\"]},\"areaServed\":[{\"@type\":\"Country\",\"name\":\"Denmark\"},{\"@type\":\"Country\",\"name\":\"Sweden\"},{\"@type\":\"Country\",\"name\":\"Norway\"},{\"@type\":\"Country\",\"name\":\"Finland\"},{\"@type\":\"Country\",\"name\":\"Iceland\"}],\"knowsAbout\":[\"e-learning\",\"compliance training\",\"GDPR\",\"IT security\",\"anti-money laundering (AML)\",\"anti-corruption\",\"onboarding\",\"leadership e-learning\",\"soft skills\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/#\\\/schema\\\/person\\\/1ab7afa85a90f45373c38bcb074f5c1b\",\"name\":\"Eya Beldi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b060ea18e56f68c10bc11a2b5ccf1a989054b58c051a748b81a1bad598325211?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b060ea18e56f68c10bc11a2b5ccf1a989054b58c051a748b81a1bad598325211?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b060ea18e56f68c10bc11a2b5ccf1a989054b58c051a748b81a1bad598325211?s=96&d=mm&r=g\",\"caption\":\"Eya Beldi\"},\"description\":\"Eya Beldi er Marketing Manager hos Grape, hvor hun skriver om digital l\u00e6ring, AI i uddannelse og om, hvordan organisationer i Norden udvikler e-l\u00e6ring, der virker i praksis. Hun er forfatter til bogen \u201cGEO: The New Rules of AI SEO\u201d om synlighed i AI-s\u00f8gning.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/eyabeldi\\\/\"],\"knowsAbout\":[\"e-learning\",\"digital learning\",\"AI in learning\",\"compliance training\",\"leadership e-learning\",\"search visibility\",\"AI search visibility\",\"generative engine optimization\"],\"knowsLanguage\":[\"Danish\",\"English\",\"French\",\"Arabic\",\"Turkish\"],\"jobTitle\":\"Marketing Manager\",\"worksFor\":\"Grape\",\"url\":\"https:\\\/\\\/grapenordic.com\\\/en\\\/author\\\/eya\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"What may employees send by email under GDPR?","description":"GDPR and email in practice. See which personal data may be sent, when the email has to be encrypted, and how to avoid the most common mistakes.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/grapenordic.com\/en\/gdpr-email\/","og_locale":"en_US","og_type":"article","og_title":"What may employees write and send by email under GDPR?","og_description":"GDPR and email in practice. See which personal data may be sent, when the email has to be encrypted, and how to avoid the most common mistakes.","og_url":"https:\/\/grapenordic.com\/en\/gdpr-email\/","og_site_name":"Grape","article_publisher":"https:\/\/www.facebook.com\/grapenordic\/","article_published_time":"2026-09-15T10:00:00+00:00","article_modified_time":"2026-11-11T09:17:31+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/03\/P1127382-1-scaled.webp","type":"image\/webp"}],"author":"Eya Beldi","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Eya Beldi"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/#article","isPartOf":{"@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/"},"author":{"name":"Eya Beldi","@id":"https:\/\/grapenordic.com\/en\/#\/schema\/person\/1ab7afa85a90f45373c38bcb074f5c1b"},"headline":"What may employees write and send by email under GDPR?","datePublished":"2026-09-15T10:00:00+00:00","dateModified":"2026-11-11T09:17:31+00:00","mainEntityOfPage":{"@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/"},"wordCount":1065,"commentCount":0,"publisher":{"@id":"https:\/\/grapenordic.com\/en\/#organization"},"image":{"@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/#primaryimage"},"thumbnailUrl":"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/03\/P1127382-1-scaled.webp","articleSection":["Compliance"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/grapenordic.com\/en\/gdpr-email\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/","url":"https:\/\/grapenordic.com\/en\/gdpr-email\/","name":"What may employees send by email under GDPR?","isPartOf":{"@id":"https:\/\/grapenordic.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/#primaryimage"},"image":{"@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/#primaryimage"},"thumbnailUrl":"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/03\/P1127382-1-scaled.webp","datePublished":"2026-09-15T10:00:00+00:00","dateModified":"2026-11-11T09:17:31+00:00","description":"GDPR and email in practice. See which personal data may be sent, when the email has to be encrypted, and how to avoid the most common mistakes.","breadcrumb":{"@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/grapenordic.com\/en\/gdpr-email\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/#primaryimage","url":"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/03\/P1127382-1-scaled.webp","contentUrl":"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/03\/P1127382-1-scaled.webp","width":2560,"height":1707},{"@type":"BreadcrumbList","@id":"https:\/\/grapenordic.com\/en\/gdpr-email\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Frontpage","item":"https:\/\/grapenordic.com\/en\/"},{"@type":"ListItem","position":2,"name":"What may employees write and send by email under GDPR?"}]},{"@type":"WebSite","@id":"https:\/\/grapenordic.com\/en\/#website","url":"https:\/\/grapenordic.com\/en\/","name":"Grape","description":"","publisher":{"@id":"https:\/\/grapenordic.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/grapenordic.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/grapenordic.com\/en\/#organization","name":"Grape","url":"https:\/\/grapenordic.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/grapenordic.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/09\/grape_logo_hvid-2-1.webp","contentUrl":"https:\/\/grapenordic.com\/wp-content\/uploads\/2026\/09\/grape_logo_hvid-2-1.webp","width":433,"height":130,"caption":"Grape"},"image":{"@id":"https:\/\/grapenordic.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/grapenordic\/","https:\/\/www.facebook.com\/grapenordic\/","https:\/\/www.youtube.com\/channel\/UC2OoQQVitKhGDNqQEH0av0Q"],"legalName":"Grape A\/S","vatID":"DK26079926","foundingDate":"2001","email":"info@grapenordic.com","telephone":"+45 70 10 20 48","address":{"@type":"PostalAddress","streetAddress":"Aldersrogade 1","postalCode":"2100","addressLocality":"K\u00f8benhavn \u00d8","addressCountry":"DK"},"location":[{"@type":"Place","address":{"@type":"PostalAddress","streetAddress":"Aldersrogade 1","postalCode":"2100","addressLocality":"K\u00f8benhavn \u00d8","addressCountry":"DK"}},{"@type":"Place","address":{"@type":"PostalAddress","streetAddress":"Mejlgade 27","postalCode":"8000","addressLocality":"Aarhus","addressCountry":"DK"}}],"contactPoint":{"@type":"ContactPoint","contactType":"customer service","telephone":"+45 70 10 20 48","email":"info@grapenordic.com","url":"https:\/\/grapenordic.com\/en\/contact\/","availableLanguage":["Danish","English"]},"areaServed":[{"@type":"Country","name":"Denmark"},{"@type":"Country","name":"Sweden"},{"@type":"Country","name":"Norway"},{"@type":"Country","name":"Finland"},{"@type":"Country","name":"Iceland"}],"knowsAbout":["e-learning","compliance training","GDPR","IT security","anti-money laundering (AML)","anti-corruption","onboarding","leadership e-learning","soft skills"]},{"@type":"Person","@id":"https:\/\/grapenordic.com\/en\/#\/schema\/person\/1ab7afa85a90f45373c38bcb074f5c1b","name":"Eya Beldi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/b060ea18e56f68c10bc11a2b5ccf1a989054b58c051a748b81a1bad598325211?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/b060ea18e56f68c10bc11a2b5ccf1a989054b58c051a748b81a1bad598325211?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b060ea18e56f68c10bc11a2b5ccf1a989054b58c051a748b81a1bad598325211?s=96&d=mm&r=g","caption":"Eya Beldi"},"description":"Eya Beldi er Marketing Manager hos Grape, hvor hun skriver om digital l\u00e6ring, AI i uddannelse og om, hvordan organisationer i Norden udvikler e-l\u00e6ring, der virker i praksis. Hun er forfatter til bogen \u201cGEO: The New Rules of AI SEO\u201d om synlighed i AI-s\u00f8gning.","sameAs":["https:\/\/www.linkedin.com\/in\/eyabeldi\/"],"knowsAbout":["e-learning","digital learning","AI in learning","compliance training","leadership e-learning","search visibility","AI search visibility","generative engine optimization"],"knowsLanguage":["Danish","English","French","Arabic","Turkish"],"jobTitle":"Marketing Manager","worksFor":"Grape","url":"https:\/\/grapenordic.com\/en\/author\/eya\/"}]}},"_links":{"self":[{"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/posts\/41011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/comments?post=41011"}],"version-history":[{"count":1,"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/posts\/41011\/revisions"}],"predecessor-version":[{"id":41012,"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/posts\/41011\/revisions\/41012"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/media\/37573"}],"wp:attachment":[{"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/media?parent=41011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/categories?post=41011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/grapenordic.com\/en\/wp-json\/wp\/v2\/tags?post=41011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}