Are Email Disclaimers Mandatory for UK Businesses Under the GDPR?

As a UK business owner, your email communications are very important and must comply with UK data protection laws. While emails can help your company obtain new business and achieve good sales figures, they can also potentially harm your company’s reputation and cause damage. This article will explore the use of email disclaimers as a safety measure against inaccurate wording or accidental sending of emails.

What is an Email Disclaimer?

Email disclaimers vary depending on the purpose of the sender. Overall, most email disclaimers will aim to achieve the following goals:

• ensuring the sender is not legally bound to deliver on any promises or statements within the email;
• excluding liability for harm caused by computer viruses or malicious code; 
• requesting the recipient not to forward confidential information within the email to another party without the sender’s prior consent; or
• requesting that any unintentional recipient immediately delete the email.

Are Disclaimers Mandatory Under the GDPR?

Generally, email disclaimers are not mandatory under the General Data Protection Regulations (GDPR). Accordingly, failing to use one within your business is not an automatic GDPR violation.

However, although they are not compulsory, disclaimers can be very useful in ensuring your business complies with data protection rules. One of the primary purposes of the GDPR is to ensure that companies have tight control over personal information. Email disclaimers seek to prevent information leakage within business emails and email marketing.

So, for example, the GDPR imposes certain restrictions on UK businesses. Some of these include safely handling personal data and ensuring it does not become public. Accordingly, an email disclaimer asking other parties to delete unintentional emails immediately or to avoid forwarding information to others without prior consent helps achieve this.

Are Business Email Disclaimers Effective?

Email disclaimers are not always effective. However, a well-drafted email disclaimer is always better than having none.

Most email disclaimers are persuasive rather than legally binding. In the same way as physical post, if you receive an email with unexpected information, you are not necessarily legally bound to delete it if an email disclaimer says so. However, if you are a UK business owner, you may be expected to demonstrate good GDPR compliance by doing so.

If individuals disregard the law or GDPR, they are likely to read (and potentially keep) the email, regardless of a disclaimer. In that case, however, you can demonstrate to the ICO that you have taken reasonable steps to avoid information leakage through your email disclaimer.

Further Steps Beyond Email Disclaimers

There are a few ways your business can seek to protect the content of its emails.

Firstly, if the information within email communications is particularly sensitive, you can provide a password-protected file. You can then provide the password either by telephone or by follow-up email (after triple-checking the email address of the intended recipient).

Furthermore, most businesses have a policy of ‘check twice, send once’. Such a policy is akin to double-checking the full email address before sending. This has become popular because of the habit of email programs, such as Microsoft Outlook, to ‘autofill’ email addresses. Unfortunately, such autofill tools may accidentally lead to sending an email to an unintended recipient. 

Finally, many modern email programs now allow the sender to try and recall business and marketing emails. However, this does not always work and must take place quickly to avoid the recipient receiving and opening the email first. As such, it is not always reliable. Nevertheless, it is another way your business could demonstrate its intention to prevent information leakage to the Information Commissioner’s Office (ICO).

Key Takeaways

Email disclaimers are a helpful way for your company to specify the appropriate use of an email’s contents. While they may not be legally binding on all recipients, they provide your company with a limited opportunity to demand a recipient take specific action in response to an email. Overall, they are akin to CCTV warning signs in that their presence may deter some individuals from mischief but not others.

If you need help putting effective email disclaimers in place, our experienced Data, Privacy and IT lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.  

Frequently Asked Questions