GDPR and fax

Faxing pages that identify real people, without falling foul of EU data protection rules.

Regulation (EU) 2016/679 never mentions fax. It regulates the processing of personal data, and transmitting a page on which someone can be identified is one form of processing (article 4, point 2). In practice, you must establish a lawful basis (article 6), limit the data to what is strictly necessary (article 5), put in place safeguards proportionate to the risk (article 32) and, when a transmission goes to a wrong number, follow a predefined protocol (articles 33 and 34). A fax's final stage is transmitted unencrypted, so most of the compliance burden falls on your own organisation — double-checking numbers, preparing pages, and maintaining discretion on the receiving end.

Four markers for a compliant fax

The regulation speaks about processing and risk levels, never about technologies. Whether fax or email, the criteria below apply equally.

  • Every fax is a data processing operation

    “Communication by transmission” appears verbatim among the processing operations listed in article 4, point 2. Sending a named quotation, a payslip or a prescription by fax therefore clearly falls within the scope of the regulation.

  • A lawful basis for every send

    Article 6 sets out six grounds: consent, contractual performance, compliance with a legal duty, safeguarding vital interests, tasks in the public interest, and legitimate interests. As a rule, an employer who transmits a certificate to a social-security organisation relies on compliance with a legal duty.

  • No unnecessary data in the pages

    Set by article 5, paragraph 1, point c, the minimisation principle only allows data that is useful and proportionate to the purpose to circulate. Before generating the PDF, strip the document of everything the recipient can do without.

  • A recipient outside the EEA triggers Chapter V

    Any transmission to a third country falls under Chapter V, which governs transfers (articles 44 to 49). Canada: the European Commission has ruled protection adequate for organisations bound by PIPEDA, the federal Canadian law (decision 2002/2/EC). Other Canadian recipients — certain provincial authorities in particular — require you to verify the safeguards in place.

Article 32: the security expected of a fax send

Per article 32, both the data controller and the processor are obliged to adopt technical and organisational safeguards that ensure a level of security commensurate with the risk, considering the current state of technology, the expenses involved, and the type of data being processed. The provision lists encryption among the possible safeguards, together with pseudonymisation and routinely validated procedures, which may be combined as appropriate.

Part of every fax's route is unencrypted, whatever service you use. At Faxeroo, the PDF is uploaded over HTTPS and the file disappears automatically after transmission; the telephone segment that carries it to the recipient's machine travels in clear, as on any fax. Protection then comes from organisation: a directory of verified numbers, a second check for sensitive sends, a prior call to the recipient, anonymised pages where possible.

Record these decisions in writing. The accountability principle (article 5, paragraph 2) requires you to demonstrate your compliance: a note setting out why fax was preferred for this flow, and the precautions that go with it, is precisely that demonstration. If your analysis concludes that end-to-end encryption is essential, change channel.

Wrong recipient: the protocol to follow

A named page landing with a third party: that is a personal data breach as defined by article 4, point 12 — intention and good faith change nothing. The steps below follow one another in order.

  1. Limit the damage first

    Contact the wrong recipient, ask them to shred the documents and, where possible, obtain written confirmation. Such measures reduce the risk and build up your internal record.

  2. Record the breach in the register

    Under Article 33, paragraph 5, each breach must be recorded in writing: its facts, its effects, and the corrective steps taken. This duty stands even where no notification ends up being required.

  3. If circumstances require, notify the CNIL within a 72-hour timeframe.

    If the circumstances suggest that individuals may be exposed to more than a negligible risk, the CNIL (the French regulator) has to be notified promptly — within 72 hours of discovering the breach wherever that can be done (article 33, paragraph 1). Should that deadline prove impossible to meet, the notification must set out the reasons for the delay.

  4. Where the danger is serious, alert the affected people.

    High risk — medical data, bank details, information that makes identity theft easier: the people affected are warned without delay, in clear language (article 34). The processor, for its part, does not write to the individuals: it alerts the controller immediately (article 33, paragraph 2).

Five actions to implement within your organisation

A verified directory of numbers
After checking, list your usual contacts with a date: health insurance funds, laboratories, court registries, insurers. Fax from this list, never rely on memory.
Two pairs of eyes on sensitive sends
Medical or banking file: have the number and the content checked by someone else before it goes out. Two minutes of checking rules out most mistakes.
A standard cover sheet
Recipient's name, page count, your contact details, and the actions to follow if a fax goes astray: this block, placed at the beginning of your message, instantly tells the target reader who it is meant for and what to do if an error occurs.
Receiving equipment under control
On the receiving side, place the device in a room with limited access or, on compatible models, enable storage of incoming faxes in memory protected by a code. Before returning leased equipment, erase its disk and memory.
Fax recorded in the register (article 30)
If fax runs through your everyday flows, enter it in the article 30 register: for what purpose, which categories of data and recipients, to which countries, for how long, with which protections.

Questions and answers

Can medical data be sent by fax?
Yes — no European rule forbids it. This type of information belongs to the special categories set out in article 9, meaning its handling calls for one of the exemptions listed in that same article (health-related purposes, for instance) plus heightened safeguards. In France, medical secrecy and the specific obligations for health professionals apply as well. Depending on your line of work, seek guidance from your DPO or your professional body.
Is a contract needed with a fax service?
If a third party processes personal information on your behalf, article 28 mandates a contract that establishes how the processing will be carried out: clear instructions, confidentiality duties, security safeguards, and the handling of the data once the collaboration ends. To set up this framework for continued use of Faxeroo for an organisation, email contact@faxeroo.com.
How long do my files live at Faxeroo?
Your PDF upload serves solely to carry out the fax; afterwards, our system deletes it automatically, with no manual step. Where card payment applies, it is handled by Stripe. Define how long you retain copies and receipts on your side (article 5, paragraph 1, point e); the recipient follows their own policy.
Can the people mentioned take action?
Certainly. The rights set out in articles 15 through 22 — access, correction, deletion, and objection — belong to the controller, i.e., the entity that decided to send. A response must be given within one month, which may be extended by up to two further months if the request is complex or large-scale (article 12, paragraph 3).

Data and security

This topic

Keep reading

Pages chosen to help you prepare a send, track it, or keep proof of it.

See also