What GDPR means for your email address
Your email address is personal data under GDPR (General Data Protection Regulation). This means that all companies and organisations within the EU that collect and process your email address must comply with GDPR rules. The regulation gives you strong rights and places clear requirements on how organisations handle your data.
The most important principle is that collecting personal data, including email addresses, requires a legal basis. The most common bases are consent (you have actively agreed), contract (you have entered into an agreement with the company), or legitimate interest (the company has a legitimate need). Without a legal basis, the collection is unlawful and can be reported.
GDPR rules for email marketing
GDPR provides rights including access, correction and erasure. Rights have conditions and exceptions; deletion is not unconditional. Organizations need a valid legal basis for processing, but that basis is not always consent. See the data protection authority’s guidance for your situation. IMY.
- Freely given: You cannot be forced to consent as a condition of using a service (unless it is necessary for the service)
- Specific: You must know exactly what you are consenting to — "newsletter about offers" is sufficiently specific
- Informed: You must understand what you are giving consent to
- Unambiguous: Pre-ticked boxes are not accepted — you must actively tick the box
Every marketing email you receive must contain an unsubscribe link. When you click it, the unsubscription must take effect immediately, and the company may not try to persuade you to stay.
Your rights as an email recipient
Under GDPR you have the right at any time to:
- Request information: What data does the company hold about you? How is it used?
- Request rectification: If the data is incorrect it must be corrected
- GDPR provides rights including access, correction and erasure. Rights have conditions and exceptions; deletion is not unconditional. Organizations need a valid legal basis for processing, but that basis is not always consent. See the data protection authority’s guidance for your situation. IMY.
- Object to processing: You can object to your data being used for direct marketing
- Withdraw consent: If the processing is based on your consent you can withdraw it at any time
GDPR provides rights including access, correction and erasure. Rights have conditions and exceptions; deletion is not unconditional. Organizations need a valid legal basis for processing, but that basis is not always consent. See the data protection authority’s guidance for your situation. IMY.
GDPR and data breaches involving email
If a company suffers a data breach affecting email addresses and other personal data, under GDPR they must:
- GDPR provides rights including access, correction and erasure. Rights have conditions and exceptions; deletion is not unconditional. Organizations need a valid legal basis for processing, but that basis is not always consent. See the data protection authority’s guidance for your situation. IMY.
- Inform you as the affected individual if the breach poses a high risk to you
- Document all breaches, even those that do not need to be reported
This is a major step forward from pre-regulation times when companies could hide breaches for months or years. Read more about how to protect yourself in our email security guide.
Practical tips: Protect your email with GDPR on your side
- Clean up old subscriptions: Systematically go through all services you subscribe to and unsubscribe from those you no longer want. Request deletion of your data by emailing their data protection officer.
- Check what data companies hold: Send a subject access request to services you use. The answer can be surprising — data is sometimes stored far longer than necessary.
- The free inbox is active for 10 minutes. It then stops receiving messages and keeps existing email for another 10 minutes so you can extend the same inbox. Extending resets the session to 10 minutes and moves its deletion deadline. Without an extension, the free inbox, messages and address-related technical data are removed by server cleanup, normally within one minute after the deadline. Starting Stripe Checkout reserves existing messages for 30 minutes; the server checks payment before deletion. Account and Premium-linked inboxes are excluded from free cleanup. Premium sessions last 60 minutes.
- Report GDPR violations: If you receive unsolicited email from a company you never contacted, or if a company refuses your deletion request, you can report them directly to your national data protection authority.
How temporary email complements GDPR
The service processes temporary addresses, incoming messages and technical information, including IP addresses. Your browser stores an access token and your address to reopen the inbox. Disposable email hides your regular address from the recipient; it does not make you anonymous online. See the privacy policy for details.
Read more in our online privacy guide and visit our FAQ for answers to common questions.