The GDPR imposes strict rules on the processing of personal data, including emails. Does using Gmail or Microsoft 365 for your professional communications expose you to legal risks? Let\'s break it down.
Disclaimer
This article is for informational purposes only and does not constitute legal advice. For questions specific to your situation, consult a lawyer specializing in data protection.
Emails Contain Personal Data
A professional email typically contains:
- First and last names (sender, recipient)
- Email addresses
- Content that may reveal personal information
- Attachments (invoices, contracts, identity documents...)
- Metadata (IP address, timestamp, device used)
All of this constitutes personal data under the GDPR.
Your Obligations as a Data Controller
1. Legal Basis for Processing
You must have a legal basis for processing this data (Article 6 GDPR):
- Performance of a contract
- Legitimate interest
- Legal obligation
- Consent (rare for professional emails)
2. Informing Data Subjects
Individuals whose data you process must be informed (Articles 13 and 14 GDPR):
- Who is the data controller
- Purposes of the processing
- Retention period
- Data recipients
- Transfers outside the EU where applicable
3. Data Security
You must implement appropriate technical and organizational measures (Article 32 GDPR):
- Data encryption
- Confidentiality, integrity, availability
- Ability to restore data
- Regular testing and assessments
The Problem of Transfers Outside the EU
General Principle
The GDPR prohibits by default the transfer of personal data to countries that do not provide an "adequate" level of protection (Articles 44-49).
The United States: A Special Case
A chaotic history:
- 2015 – Invalidation of Safe Harbor (Schrems I ruling)
- 2020 – Invalidation of Privacy Shield (Schrems II ruling)
- 2023 – New EU-US framework (Data Privacy Framework)
The new framework is criticized and could be invalidated again. In the meantime, the legal situation remains uncertain.
The Cloud Act: The Real Problem
The US Cloud Act (2018) allows US authorities to require access to data held by American companies, even if that data is stored in Europe.
This creates a direct conflict with the GDPR, which prohibits transmitting personal data to a foreign authority without a European legal basis.
Real Risk
If you use Gmail or Microsoft 365, your emails from European clients/partners can theoretically be accessed by US authorities, in violation of the GDPR.
Managing Subcontracting (Article 28)
Your email hosting provider is a data processor under the GDPR. You must:
- Sign a data processing agreement (DPA)
- Verify the processor\'s security guarantees
- Ensure they don\'t use unauthorized sub-processors
- Be able to audit their practices
What the DPA Must Include
- Subject matter and duration of processing
- Nature and purpose of processing
- Types of data concerned
- Categories of data subjects
- Obligations and rights of the controller
- Security measures implemented
Penalties for Non-Compliance
The GDPR provides for deterrent penalties:
- Warnings and formal notices from the data protection authority
- Fines up to €20 million or 4% of global annual turnover
- Suspension of data transfers
- Legal action from data subjects
Examples of Penalties
- Google: €150 million (CNIL, 2022) for cookies
- Meta: €1.2 billion (DPC Ireland, 2023) for transfers to USA
The Solution: Host in Europe (or Better, Switzerland)
Why Switzerland?
Switzerland benefits from an adequacy decision from the European Commission. Transfers to Switzerland are therefore authorized without additional safeguards.
In addition, Switzerland offers:
- One of the strictest data protection laws (FADP)
- No subjection to the Cloud Act
- A globally recognized tradition of confidentiality
- Legal and political stability
Why Infomaniak?
- 100% of data in Switzerland – No transfers abroad
- Independent Swiss company – No American parent company
- GDPR-compliant DPA – Data processing agreement available
- ISO certifications – 27001 (security), 14001 (environment)
How to Make Your Email Compliant
Step 1: Identify Data Flows
Map out where your emails go and the data they contain:
- Email servers (location)
- Backups (where are they stored?)
- Connected third-party applications
- Email clients used
Step 2: Assess Risks
For each flow, ask yourself:
- Is there a transfer outside the EU/EEA/Switzerland?
- Is the processor subject to the Cloud Act?
- Is the data encrypted?
Step 3: Migrate If Necessary
If your emails are with an American hosting provider (Google, Microsoft), seriously consider migrating to a European or Swiss hosting provider.
Step 4: Document Everything
Keep a record of your choices and analyses. In case of an audit, you must be able to justify your decisions.
Legal FAQ
My company is small, does this apply to me?
Yes. The GDPR applies to any organization processing personal data, regardless of its size. The obligations are the same.
All my clients are local, can I use Gmail?
Technically, their data is transferred to the US as soon as it\'s on Google\'s servers. The location of your clients makes no difference.
Microsoft stores my data in Europe, is that enough?
No. As an American company, Microsoft remains subject to the Cloud Act, even for data stored in Europe.
Conclusion
The GDPR requires serious reflection on your professional email hosting. American solutions, despite their convenience, create a legal gray area that many companies prefer to avoid.
Choosing a Swiss hosting provider like Infomaniak means the certainty of unambiguous GDPR compliance. Your data remains protected by privacy-respecting laws, out of reach of foreign jurisdictions.
Ready to migrate to Infomaniak?
Contact us for a free 15-minute audit. We will analyze your situation and provide you with a personalized quote.
Request a free audit