Email signatures and GDPR: what data is involved

Does GDPR apply to email signatures? Yes. A signature is personal data about the person sending it, and a signature service processes more: directory details, and a record of the mail it signs. None of that is a reason not to have one, but your data protection officer will want to know what is shown, what is collected, where it goes and how long it is kept. This post answers those questions in general, and for Footer365 in particular.

The signature itself

A signature shows a person's name, job title, phone numbers and sometimes a photo to everyone they email. Two principles in Article 5 of the UK GDPR are the useful ones here:

• Data minimisation: personal data should be "adequate, relevant and limited to what is necessary". Ask whether every line earns its place. A direct dial helps a customer; a personal mobile number on every email may not be necessary for everyone.
• Accuracy: personal data should be accurate and kept up to date. A signature with an old job title or a former colleague's number fails that, quietly, on every email.

A central signature helps with both. You decide once which fields appear, and the details come from your directory rather than from what each person typed years ago.

Fields people do not want shown

In Footer365, an empty field is removed from the signature along with its label. So a person who should not show a mobile number simply has none in the directory, and their signature drops the line. The QR code element follows the same principle: the contact card behind it adds details such as job title or phone only when the signature itself shows them.

What a signature service processes

For the details in your directory, your organisation is the data controller and the signature service is a processor, so you need a data processing agreement with it. Footer365's is published as its data processing terms. The questions to ask any provider:

Our technical article on data and privacy gives the full list, including how long each kind of record is kept.

Campaign clicks

Banner campaigns raise the most questions, because tracking a click means recording something about the person who clicked. Footer365 records which campaign and link, when, and whether it looks like an automated link scanner, plus the IP address and user agent of the request for a limited time.

• The IP address and user agent are cleared after 90 days by default. You can set your own period, up to 365 days, under Campaign click privacy in the account settings.
• Once those two details are cleared, the click identifies no one, and your campaign figures do not change.
• No recipient is ever named. Footer365 cannot say who followed a link.

For messages that carried a banner, Footer365 also records which outside organisations the message reached, as email domains only, never addresses. Our guide to click data and privacy covers how to explain this in your own privacy notice.

A checklist for your data protection officer

1. List the fields your signature shows, and decide which are necessary for which roles.
2. Confirm the details come from one maintained source, such as your Microsoft 365 directory.
3. Put a data processing agreement in place with the signature provider, and read its sub-processor list.
4. Find out whether it keeps copies of email, and what it records about each message.
5. If you run campaigns, decide how long click details are kept, and mention link tracking in your privacy notice.

This is general information rather than legal advice. If your DPO has questions we have not answered here, the security page and data processing terms are the place to start, and the contact page reaches us with anything else.