Introduction and importance of transactional emails:
Transactional emails are messages that are directly related to a transaction or a specific action by a user, such as order confirmations, shipping notifications or password reset emails. These emails are essential for business operations, but here too the data protection requirements of the GDPR must be met. Here are the requirements explained in detail:
Lawfulness of processing (Article 6 GDPR):
- Lawful basis: The processing of personal data for sending transactional emails must be based on a lawful basis. Typically, this is the performance of a contract or pre-contractual steps taken at the request of the data subject.
Transparency and information (Article 13 GDPR):
- Information obligation: Users must be informed that their data will be used to send transactional emails. This information should be included in the website’s privacy policy and explain the purposes and legal basis of data processing.
Security measures (Article 32 GDPR):
- Security of communications: Transactional emails should be protected by appropriate technical measures to ensure the security of personal data during transmission. This can be achieved by using Transport Layer Security (TLS).
- Access controls: Implementing mechanisms to restrict access to the systems used to send email to prevent unauthorized access.
Data minimization and purpose limitation (Article 5 GDPR):
- Data minimization: Transactional emails should contain only the personal data that is necessary for the specific purpose. Unnecessary data should not be included in the emails.
- Purpose limitation: The use of personal data for transactional emails must be limited to the specific purposes for which the data was originally collected. Further use of the data for other purposes, such as marketing, is not permitted without additional consent.
Documentation and proof (Article 30 GDPR):
- Register of processing activities: Controllers must maintain a register of processing activities, which includes the sending of transactional emails. Manage this account and specify what types of notifications they wish to receive.
Summary:
Websites must provide users with the ability to easily manage and control their notification preferences. This includes obtaining consent for non-transactional notifications, providing clear and understandable information about the notifications available, and simple mechanisms to manage preferences. Providing these options will strengthen users’ control over their personal data and ensure compliance with the GDPR.
