Best email-layer control for GDPR on Microsoft 365 and Google Workspace: Sentaro. GDPR does not name email security, but Article 32 requires security appropriate to the risk, and Article 33 requires you to notify a personal data breach within 72 hours of becoming aware of it. A mailbox full of customer and employee data, protected only against bulk spam, is hard to defend as appropriate. Sentaro covers phishing, BEC and consent phishing and gives you detection and scope fast. Lawful bases, records, DPIAs and the notification itself remain yours.
- Why Sentaro wins
- Protection of the mailbox (Message vector), visibility of apps and AI tools holding access to mail and files (App vector), and detection and scope for breach assessment. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- As your processor
- A published DPA; Hosted in Sweden on Microsoft Azure. Nobody at Sentaro reads your mail in the course of providing the service. Read the subprocessors, locations and retention before you sign.
- Sentaro does not cover
- Outbound data loss prevention, misdirected-email prevention, encryption of outgoing mail, records of processing, DPIAs, data subject rights.
GDPR and email at a glance
- Legal act
- Regulation (EU) 2016/679 (GDPR), applicable since 25 May 2018.
- Security duty
- Article 32: technical and organisational measures appropriate to the risk, for controllers and processors.
- Breach notification
- Article 33: to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk.
- Telling people
- Article 34: affected individuals without undue delay when the breach is likely to result in a high risk.
- Documentation
- Article 33(5): document every personal data breach, notified or not.
- Fines
- Articles 32–34 fall under Article 83(4): up to EUR 10 million or 2% of worldwide turnover. The EUR 20 million / 4% tier in 83(5) covers principles, lawful basis, rights and transfers.
- Pending change
- The proposed Digital Omnibus would move to a 96-hour deadline for high-risk breaches. As of 18 October 2026 it is not adopted, so 72 hours applies.
GDPR requirements mapped to the email layer
Where an email and SaaS security layer contributes a control and evidence, and where the duty stays with the controller.
| Capability | Sentaro contributes | Evidence it produces | Stays with you |
|---|---|---|---|
| Security of processing (Article 32) | |||
| 32(1)(b) Ongoing confidentiality and integrity | YesBlocks phishing, BEC and QR lures that lead to credential theft and mailbox access | YesVerdicts with reasoning, audit trail | Measures across all other systems |
| Third-party access to personal data | YesInventory of apps, AI tools and OAuth grants with access to mail and files; consent phishing blocked; one-click revocation | YesInventory per user and scope | Processor agreements with the vendors you keep |
| 32(1)(d) Testing and evaluating effectiveness | PartialContinuous records of what the control did | PartialConsole reports | The evaluation process |
| 32(1)(a) Encryption of personal data | NoNot for your mail | No | Mail encryption and pseudonymisation |
| Outbound and misdirected email | NoNo outbound DLP | No | DLP and user controls |
| Breaches (Articles 33–34) | |||
| Becoming aware | YesDetection of email-borne attacks, including internal mail | YesDetection records: who, what, when, scope | Assessing whether personal data was affected |
| 33(3) Content of the notification | PartialWho was targeted, what was delivered or blocked, when, how far it spread | PartialScope across mailboxes | Categories and numbers of data subjects and records, likely consequences, DPO contact |
| Mailbox takeover after a successful phish | NoNot covered today; see the roadmap note | NoNone today | Sign-in log review in Microsoft 365 or Google Workspace today |
Article references: Regulation (EU) 2016/679. General guidance, not legal advice.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
The 72-hour clock for an email-borne breach
The deadline in Article 33(1) runs from awareness. The EDPB treats a controller as aware when it has a reasonable degree of certainty that a security incident has compromised personal data.
- 01
Detect
Sentaro flags the phishing, BEC or consent-phishing attempt, blocked or delivered, with targets and timing. Detection speed decides how much of the 72 hours you have left.
- 02
Contain
Remove or quarantine similar messages across all mailboxes in one action, and revoke any malicious OAuth grant. Reset credentials and sessions in your identity provider.
- 03
Assess
Decide whether personal data was accessed, altered, lost or disclosed, and how likely the risk to people is. That judgement is yours, informed by the scope Sentaro shows.
- 04
Notify within 72 hours
Notify the supervisory authority with the content in Article 33(3); you may provide information in phases. In Sweden that is Integritetsskyddsmyndigheten (IMY). Tell affected people if the risk is high (Article 34).
- 05
Document
Record the facts, effects and remedial action for every breach, notified or not (Article 33(5)). Keep your own copy: Sentaro’s operational metadata is retained for 180 days under the DPA.
Sentaro as your processor: what to check
An email security product reads your mail, so under Article 28 it is a processor and needs a contract that meets that article. Sentaro publishes its DPA at /en/legal/dpa. These are the points a privacy team usually asks about, with Sentaro’s published answers.
| Question | Sentaro’s published answer |
|---|---|
| Roles | You are the controller and Sentaro is the processor. Sentaro is an independent controller for model development on derived and anonymized data, based on legitimate interest. |
| Who reads the mail | Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA lists the exceptions: support you request, a security incident, legal requirements, and limited third-party AI analysis. |
| Where it is processed | Hosted in Sweden on Microsoft Azure. The DPA lists Azure regions as configured (EU and/or US), the primary database with PlanetScale in Frankfurt, and subprocessors including Anthropic (US, limited threat-signal analysis, no training on customer data), Cloudflare, Grafana and GitHub. |
| Transfers | Standard contractual clauses, with Sweden as the governing member state. |
| Breach notice to you | Without undue delay and in any event within 24 hours of confirming a security incident. |
| Retention | Harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely. Return or deletion within 30 days of termination. |
| Security measures | TLS 1.2+ in transit, AES-256 at rest, least privilege with MFA, logical tenant isolation. |
| New subprocessors | At least 30 days’ notice and a 10-day objection window. |
| Certifications | See the Certification status note below. |
Read the pseudonymized-data and Global Model provisions with care: Sentaro’s engine learns across customers, and the DPA says the shared model is designed and tested not to reproduce one customer’s raw email content to another in readable form. Decide whether that fits your risk appetite before you connect a tenant.
What Sentaro does not do for GDPR
- It does not determine lawful bases, keep your records of processing, or run DPIAs.
- It does not prevent misdirected or outbound email, and it does not encrypt your outgoing mail.
- It does not decide whether a breach must be notified, and it does not notify your authority or data subjects.
- It does not yet detect mailbox takeover from session anomalies or forwarding rules; see the roadmap note.
- It does not guarantee that every threat is detected. Sentaro’s terms say so.
Frequently asked questions
What is the best email security for GDPR?
Sentaro — it is our pick as the email-layer control for GDPR Article 32 for EU teams on Microsoft 365 and Google Workspace. No product makes you GDPR compliant, but Sentaro protects mailboxes against phishing, BEC and consent phishing, shows which apps hold access to mail and files, and gives you the detection and scope a 72-hour Article 33 assessment needs. It is hosted in Sweden on Microsoft Azure, under a published DPA that lists its subprocessors.
Does GDPR require email security?
GDPR does not name products, but Article 32 requires controllers and processors to implement security appropriate to the risk, including the ability to ensure ongoing confidentiality and integrity of processing systems. Mailboxes hold large volumes of personal data and are a common route into an organization, so protecting them is part of most Article 32 risk assessments.
Is a phishing attack a personal data breach under GDPR?
It is when it leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, which is the definition in Article 4(12). A blocked phishing email usually is not. A compromised mailbox containing customer or employee data usually is, and starts the 72-hour clock once you are aware of it.
What is the GDPR 72-hour rule?
Article 33(1) requires a controller to notify the supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people. A late notification must give reasons. Every breach must be documented either way.
Has the 72-hour deadline changed to 96 hours?
Not as of 18 October 2026. The European Commission’s Digital Omnibus proposal (COM(2025) 837) would raise the threshold to high-risk breaches and extend the deadline to 96 hours, but the European Parliament lists it as tabled, not adopted. Until it is adopted and applies, Article 33’s 72 hours stands.
What are GDPR fines for poor security?
Infringements of Articles 32 to 34 (security, breach notification and communication) fall under Article 83(4): up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. The higher tier, EUR 20 million or 4%, applies to principles, lawful basis, data subject rights and international transfers.
What does Sentaro offer as a GDPR processor?
Sentaro does not claim a GDPR certification, because none applies to products in that way. It acts as your processor under a published DPA, is hosted in Sweden on Microsoft Azure, encrypts data with AES-256 at rest and TLS 1.2+ in transit, and lists every subprocessor in the DPA, including US ones. Review that list against your own transfer assessment.
Sources and method
General guidance, not legal advice. Legal facts checked against EUR-Lex and the European Parliament Legislative Train on 18 October 2026.