A data controller's fax playbook: mapping, register, processors, rights

Short answer: under the GDPR, a fax is personal-data processing like any other. The controller maps the flows — inbound and outbound —, records a purpose, a lawful basis and a retention period for each, enters them in the record of processing activities, binds the online fax service with an Article 28 contract and knows how to answer an access or erasure request about archived faxes. Half a day covers an SME; here is the method, with a register line ready to copy.

Map the flows before writing the register

A register does not describe "the fax" in the abstract; it describes real processing, flow by flow. Start with an honest inventory:

• outbound flows: signed quotes, purchase orders, payment reminders, letters to partners — sent from the reception fax machine or from an online fax service;
• inbound flows: returned contracts, supporting documents, records received from peers or suppliers — printed into an open tray or delivered as PDF into a shared inbox.

For each flow, note the data actually carried: identity and contact details almost always; payroll, health or bank data sometimes. Put a number on it to convince management: an SME exchanging 40 faxes a month handles 480 a year; at five personal data points per page, that is 2,400 data items exposed annually, somewhere between a paper tray and a client folder. This flow map — who sends what, to whom, where the document lands, who can reopen it — dictates what the register must say. The general framework is recalled on our GDPR obligations applied to online fax page; the rest of this article is its operational translation.

Lawful basis and purpose: one answer per flow

One flow, one purpose, one lawful basis — never a single answer for the whole machine:

• performance of a contract: quotes, orders, delivery tracking between you and your clients;
• legal obligation: accounting records, payroll items — the retention period then follows the applicable rule, not your mood;
• legitimate interests: commercial reminders, handling a dispute, with the balancing test written down;
• consent: almost never the right basis for a professional fax flow, because consent is hard to evidence fax after fax.

Health data falls under a stricter regime: only the flows necessary for a patient's care justify it. The page on fax and health data details the expected precautions.

Minimise what the fax carries

The cover sheet is the cheapest minimisation there is: it carries the recipient's name, the file reference — and nothing else. A diagnosis, a bank balance or a quote amount has no business on the first page, the one every front desk sees. Our fax cover sheet template takes a minute to fill in and asks for no unnecessary data.

Two reflexes complete the cover sheet:

• fax the useful pages, not the whole file: three targeted pages expose less data than a ten-page digest;
• check the number before every send: a fax sent to the wrong number discloses data to an unknown third party; the breach gets documented, and notification to the authority may be due within 72 hours.

The register line, in practice

One line per flow, not one line for "the fax". A copyable example for a typical outbound flow:

Even below 250 employees, the Article 30 carve-out only covers occasional processing: weekly fax flows are not occasional, and the register stands. To fill the security column, fax transmission security describes what a fax flow can reasonably promise.

Processors: the online fax service under Article 28

The fax machine you bought sits on your premises: no third party, no processor. An online service that transmits your documents on your behalf is one — it processes data on your instructions, exactly like your email host.

Before the first send, require four certainties:

1. a data processing agreement conforming to Article 28 — a dedicated clause, not three lines buried in general terms;
2. the location of the servers: hosting inside the Union spares you the standard contractual clauses that transfers outside the EU require;
3. the chain of sub-processors, announced with a right to object;
4. two operational commitments: prompt notification of any breach, and the fate of your data at the end of the contract.

The provider's name then joins the recipients column of the register. Note that a service usable without creating an account bounds what you hand over from the start: to transmit a document, no provider needs the full directory of your clients.

Honouring rights over archived faxes

An access request lands: you must find every fax concerning the person, delivery receipt included. Impossible without filing rules — one folder per counterparty, a uniform naming scheme, fax archiving documented with retention periods actually enforced.

An erasure request follows a different logic: delete the person's faxes, except where a legal obligation requires keeping the record — an accounting invoice is not erased before its due date. Answer citing the obligation, delete the working copies that hold no evidential value, and log the response. In every case the deadline is one month, extendable for complex requests: date it, file it, keep it.

The SME privacy officer's checklist

1. flow map of inbound and outbound fax, revised at every equipment change;
2. purpose and lawful basis noted per flow, balancing test documented where relevant;
3. one register line per flow, retention period included;
4. neutral cover sheet applied to every send, with no superfluous sensitive data;
5. processing agreement signed with the fax service, data location verified;
6. access / erasure procedure tested once a year on real faxes;
7. annual review aligned with the retention policy, destructions logged.

Half a day settles the fax, and the rest of the register follows the same logic, flow after flow. The Faxeroo sending form works without creating an account, and every transmission can carry a timestamped PDF delivery receipt.