Email verification touches personal data, so GDPR applies. The good news: verification is fully compliant when done right, and it actually supports several GDPR principles (data minimization, accuracy). The bad news: not all vendors are compliant by default. Here is what you need to know as a controller.
Is email verification allowed under GDPR?
Yes. Verifying an email address is a processing activity covered by GDPR but explicitly permitted under several lawful bases:
- Legitimate interest (Art. 6(1)(f)). Ensuring delivery accuracy and protecting sender reputation is a legitimate business interest.
- Contract (Art. 6(1)(b)). Verifying an address at signup is necessary to provide the service the user requested.
- Consent (Art. 6(1)(a)). If your privacy notice describes verification, the consent for marketing covers it.
What GDPR requires you to do
- Mention verification in your privacy policy. Describe what you collect, who you share with (the verifier), and how long you retain it.
- Sign a Data Processing Agreement (DPA) with your verifier. Required for any vendor processing personal data on your behalf.
- Pick a vendor with appropriate safeguards. Encryption in transit and at rest, access controls, breach notification commitments, EU-friendly data handling.
- Honour data subject rights. Users can ask what you verified, when, and request deletion.
- Limit retention. Do not keep verification records longer than needed. 90 days is typical for active marketing data.
Vendor due diligence checklist
Before using any email verification vendor, confirm:
- Published DPA available for signature.
- Data processing location (EU vs US). EU servers preferred for EU controllers.
- Encryption: TLS in transit, AES-256 at rest minimum.
- Retention defaults: ideally short, configurable.
- Sub-processor list published.
- Standard Contractual Clauses (SCCs) in place for US transfers.
- SOC 2 or ISO 27001 ideally.
- Clear policy on selling, sharing, or training models on your data (should be "we do not").
What MailoClean does for GDPR compliance
- DPA available on request, signable in minutes.
- Data encrypted in transit and at rest.
- Verification results cached only as long as useful (24 hours for the cache hit benefit, configurable).
- No selling, sharing, or model training on customer data.
- Standard Contractual Clauses for any cross-border transfers.
- Data subject deletion requests honoured within 30 days.
The retention question
Email addresses do not last forever. Mailbox providers reclaim abandoned addresses and turn them into spam traps. Verification helps you spot decay, but the longer you hold an address without re-verifying, the higher the risk. GDPR's data accuracy principle (Art. 5(1)(d)) actually requires you to keep contact data current. Re-verification is a compliance activity, not just a deliverability one.
FAQ
Do I need explicit consent to verify an address I already have?
No. Legitimate interest covers verification of an address you already lawfully hold. You do need to mention it in your privacy notice.
Can I use a US-based verifier as an EU company?
Yes, with SCCs in place. Many US verifiers have updated their DPAs to include the latest EU Commission SCC templates.
Does verification count as profiling under GDPR?
No. Verification establishes deliverability, not behavioral inferences about the individual. It does not require Art. 22 protections.
Verify, document, retain responsibly
Read MailoClean's privacy notice and contact us for a DPA before processing EU data.