GDPR and fax

Sending a fax containing personal data without breaching European regulations.

Regulation (EU) 2016/679 never mentions fax: it governs processing, and carrying a document that identifies a person is one (article 4, point 2). In practice, you need a lawful basis (article 6), content reduced to what is strictly necessary (article 5), protections proportionate to the risk (article 32) and, for a misaddressed fax, a procedure already written down (articles 33 and 34). The last stretch of a fax escapes all encryption: most of the compliance burden therefore falls on your own organisation — checking numbers, preparing pages, discretion at the receiving end.

Four markers for a compliant fax

The regulation reasons in terms of processing and risk levels, never in technologies. Fax or email, the markers below apply alike.

  • Every fax is a data processing operation

    “Communication by transmission” appears word for word among the processing operations covered by article 4, point 2. Sending a named quote, a payslip or a prescription by fax therefore falls squarely within the regulation.

  • A lawful basis for every send

    Article 6 sets out six grounds: consent, contractual performance, compliance with a legal duty, safeguarding vital interests, tasks in the public interest, and legitimate interests. As a rule, an employer who transmits a certificate to a social-security organisation relies on compliance with a legal duty.

  • No unnecessary data in the pages

    Set by article 5, paragraph 1, point c, the minimisation principle only allows data that is useful and proportionate to the purpose to circulate. Before generating the PDF, strip the document of everything the recipient can do without.

  • A recipient outside the EEA triggers Chapter V

    Any transmission to a third country falls under Chapter V, which governs transfers (articles 44 to 49). Canada: the European Commission has ruled protection adequate for organisations bound by PIPEDA, the federal Canadian law (decision 2002/2/EC). Other Canadian recipients — certain provincial authorities in particular — require you to verify the safeguards in place.

Article 32: the security expected of a fax send

Under article 32, both the controller and the processor must put in place technical and organisational measures that guarantee security appropriate to the risk, taking account of the state of the art, the cost of implementation and the nature of the information processed. The text cites encryption among the possible measures, alongside pseudonymisation and regularly tested processes, to be combined as needed.

On a fax, encryption protects only part of the journey. At Faxeroo, the PDF is uploaded over HTTPS and the file disappears automatically after transmission; the telephone segment that carries it to the recipient's machine travels in clear, as on any fax. Protection then comes from organisation: a directory of verified numbers, a second check for sensitive sends, a prior call to the recipient, anonymised pages where possible.

Record these decisions in writing. The accountability principle (article 5, paragraph 2) requires you to demonstrate your compliance: a note setting out why fax was preferred for this flow, and the precautions that go with it, is precisely that demonstration. If your analysis concludes that end-to-end encryption is essential, change channel.

Wrong recipient: the protocol to follow

A named page landing with a third party: that is a personal data breach as defined by article 4, point 12 — intention and good faith change nothing. The steps below follow one another in order.

  1. Limit the damage first

    Call the unintended recipient, demand that the pages be destroyed and, if you can, confirmation in writing. These steps limit the risk and will feed your internal file.

  2. Record the breach in the register

    Under Article 33, paragraph 5, each breach must be recorded in writing: its facts, its effects, and the corrective steps taken. This duty stands even where no notification ends up being required.

  3. Alert the CNIL within 72 hours if required

    Unless you judge, on the facts, that the risk to individuals is zero or unlikely, the breach must be brought to the attention of the supervisory authority — the CNIL for France — without undue delay and, as far as possible, within 72 hours of its discovery (article 33, paragraph 1). Beyond that, the notification must justify its delay.

  4. Warn the individuals concerned if the risk is high

    High risk — medical data, bank details, information that makes identity theft easier: the people affected are warned without delay, in clear language (article 34). The processor, for its part, does not write to the individuals: it alerts the controller immediately (article 33, paragraph 2).

Five actions to implement within your organisation

A verified directory of numbers
List your regular contacts after checking, with a date: health funds, laboratories, court registries, insurers. Fax from that list, never from memory.
Two pairs of eyes on sensitive sends
Medical or banking file: have the number and the content checked by someone else before it goes out. Two minutes of checking rules out most mistakes.
A standard cover sheet
Recipient's name, total page count, your contact details and the instruction to follow if the fax lands in the wrong hands: placed at the head of the send, it says straight away who the pages are for and what to do in case of a mix-up.
Receiving equipment under control
On the receiving side, put the machine in a restricted-access room or, on models that offer it, have incoming faxes held in code-protected memory. Before returning leased equipment, wipe its disk and memory.
Fax recorded in the register (article 30)
If fax runs through your everyday flows, enter it in the article 30 register: for what purpose, which categories of data and recipients, to which countries, for how long, with which protections.

Questions and answers

Can medical data be sent by fax?
Yes — no European legislation rules it out. Such information belongs to the special categories defined in article 9, so handling it requires one of the exceptions that article itself sets out (healthcare, for instance) together with heightened care. In France, medical confidentiality and the rules specific to health professions also apply. For your particular activity, ask your DPO or your professional body.
Is a contract needed with a fax service?
As soon as a provider handles personal data on your behalf, article 28 requires a contract to frame the work: the instructions to follow, confidentiality, security, and what becomes of the data once the service is finished. For regular use of Faxeroo on behalf of an organisation, write to contact@faxeroo.com to look at this framework.
How long do my files live at Faxeroo?
Your PDF upload serves solely to carry out the fax; afterwards, our system deletes it automatically, with no manual step. Where card payment applies, it is handled by Stripe. Define how long you retain copies and receipts on your side (article 5, paragraph 1, point e); the recipient follows their own policy.
Can the people mentioned take action?
Certainly. The rights covered by articles 15 through 22 — access, rectification, erasure, objection — all target the controller, meaning the organisation that made the decision to send. A response is due within one month, which may be extended by two months when the request proves complex or voluminous (article 12, paragraph 3).

Data and security

This topic

Keep reading

Pages chosen to help you prepare a send, track it, or keep proof of it.

See also