Summary
Yes: no channel is prohibited by the GDPR. The regulation asks for the document to be lightened to the strict necessary, for protection to be proportionate to the risk, and for the response to be planned in case of error. The fax line not being encrypted, vigilance bears first on the accuracy of the number and on the room where the correspondent's machine sits.
The GDPR reasons in terms of risks
The European regulation provides no whitelist of authorized channels. Any document that identifies a person constitutes data processing, whether sent by post, email or fax — all treated alike. Three duties then kick in: disclose only what is necessary, scale your security measures to how sensitive the data is, and define what to do should an incident arise.
The particularities of faxing
With Faxeroo, the PDF is sent via encrypted HTTPS and self-destructs once the transmission completes; the phone line connecting to the receiving device, by contrast, remains unencrypted, just like any other fax line. The actual protection therefore relies mainly on organization.
Health data constitutes a category apart. Before sending, ask the correspondent whether they offer an exchange space reserved for carers or a secure portal: the page devoted to faxes and medical data takes stock.
Before sending: the checklist
Hide or erase every detail the step does not require. Take the number from a recent file, then check it again before clicking the confirmation link. Enter the recipient's name, followed by "confidential", in the cover sheet message. Notify them by phone and request that they confirm they have received it properly.
Fax fallen on a wrong number? Contact the person who received it, demand the destruction of the pages and note the incident in writing. Depending on the seriousness, the data protection authority will have to be alerted, within 72 hours at the latest.
Key points
- Faxing possible in the sense of the GDPR, provided minimisation and security.
- Line in the clear: the precautions are above all organisational.
- Number checked, "confidential" mention, correspondent warned.
- Wrong number: destruction demanded, incident recorded and, if needed, notification.