[{"data":1,"prerenderedAt":304},["ShallowReactive",2],{"money-live:best":3,"money:compliance:gdpr":4,"money-links:\u002Fen\u002Fcompliance\u002Fgdpr":300},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":14,"seoDescription":15,"reviewed":16,"heroChips":17,"sections":22,"faqs":232,"sources":254,"disclaimer":270,"related":271,"cta":296,"schema":299},"compliance","gdpr","GDPR","Email security under GDPR: Article 32 security of processing, the 72-hour breach clock in Article 33, and Sentaro as your processor.","lock","Compliance · GDPR Regulation (EU) 2016\u002F679","Email security under GDPR: Article 32, and the 72-hour breach clock","Under GDPR, email security is part of the “appropriate technical and organisational measures” that Article 32 requires of controllers and processors, and Article 33 gives you 72 hours from becoming aware of a personal data breach to notify your supervisory authority. The best email-layer control for both on Microsoft 365 and Google Workspace is Sentaro, which provides the protection, the detection that makes you aware of a breach and the facts the notification needs, though no product makes you compliant; Sentaro is also a processor of your mail, so this page covers what to check about Sentaro itself.","Email security under GDPR: Article 32 and 33 explained","GDPR and email security: Article 32 measures, the Article 33 72-hour breach notification, fines, and what to check when your email vendor is a processor.","2026-10-18",[18,19,20,21],"Article 32 measures","Article 33: 72 hours","DPA published","Hosted in Sweden on Azure",[23,37,62,145,166,209,220,225,229],{"t":24,"title":25,"summary":26,"points":27},"verdict","Our recommendation","Best email-layer control for GDPR on Microsoft 365 and Google Workspace: Sentaro. GDPR does not name email security, but Article 32 requires security appropriate to the risk, and Article 33 requires you to notify a personal data breach within 72 hours of becoming aware of it. A mailbox full of customer and employee data, protected only against bulk spam, is hard to defend as appropriate. Sentaro covers phishing, BEC and consent phishing and gives you detection and scope fast. Lawful bases, records, DPIAs and the notification itself remain yours.",[28,31,34],{"label":29,"text":30},"Why Sentaro wins","Protection of the mailbox (Message vector), visibility of apps and AI tools holding access to mail and files (App vector), and detection and scope for breach assessment. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.",{"label":32,"text":33},"As your processor","A published DPA; Hosted in Sweden on Microsoft Azure. Nobody at Sentaro reads your mail in the course of providing the service. Read the subprocessors, locations and retention before you sign.",{"label":35,"text":36},"Sentaro does not cover","Outbound data loss prevention, misdirected-email prevention, encryption of outgoing mail, records of processing, DPIAs, data subject rights.",{"t":38,"title":39,"items":40},"facts","GDPR and email at a glance",[41,44,47,50,53,56,59],{"label":42,"value":43},"Legal act","Regulation (EU) 2016\u002F679 (GDPR), applicable since 25 May 2018.",{"label":45,"value":46},"Security duty","Article 32: technical and organisational measures appropriate to the risk, for controllers and processors.",{"label":48,"value":49},"Breach notification","Article 33: to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk.",{"label":51,"value":52},"Telling people","Article 34: affected individuals without undue delay when the breach is likely to result in a high risk.",{"label":54,"value":55},"Documentation","Article 33(5): document every personal data breach, notified or not.",{"label":57,"value":58},"Fines","Articles 32–34 fall under Article 83(4): up to EUR 10 million or 2% of worldwide turnover. The EUR 20 million \u002F 4% tier in 83(5) covers principles, lawful basis, rights and transfers.",{"label":60,"value":61},"Pending change","The proposed Digital Omnibus would move to a 96-hour deadline for high-risk breaches. As of 18 October 2026 it is not adopted, so 72 hours applies.",{"t":63,"id":64,"title":65,"intro":66,"columns":67,"own":71,"groups":72,"footnote":144},"compare","mapping","GDPR requirements mapped to the email layer","Where an email and SaaS security layer contributes a control and evidence, and where the duty stays with the controller.",[68,69,70],"Sentaro contributes","Evidence it produces","Stays with you",0,[73,117],{"label":74,"rows":75},"Security of processing (Article 32)",[76,85,93,102,110],{"label":77,"cells":78},"32(1)(b) Ongoing confidentiality and integrity",[79,82,84],{"mark":80,"text":81},"yes","Blocks phishing, BEC and QR lures that lead to credential theft and mailbox access",{"mark":80,"text":83},"Verdicts with reasoning, audit trail","Measures across all other systems",{"label":86,"cells":87},"Third-party access to personal data",[88,90,92],{"mark":80,"text":89},"Inventory of apps, AI tools and OAuth grants with access to mail and files; consent phishing blocked; one-click revocation",{"mark":80,"text":91},"Inventory per user and scope","Processor agreements with the vendors you keep",{"label":94,"cells":95},"32(1)(d) Testing and evaluating effectiveness",[96,99,101],{"mark":97,"text":98},"partial","Continuous records of what the control did",{"mark":97,"text":100},"Console reports","The evaluation process",{"label":103,"cells":104},"32(1)(a) Encryption of personal data",[105,108,109],{"mark":106,"text":107},"no","Not for your mail",{"mark":106},"Mail encryption and pseudonymisation",{"label":111,"cells":112},"Outbound and misdirected email",[113,115,116],{"mark":106,"text":114},"No outbound DLP",{"mark":106},"DLP and user controls",{"label":118,"rows":119},"Breaches (Articles 33–34)",[120,128,136],{"label":121,"cells":122},"Becoming aware",[123,125,127],{"mark":80,"text":124},"Detection of email-borne attacks, including internal mail",{"mark":80,"text":126},"Detection records: who, what, when, scope","Assessing whether personal data was affected",{"label":129,"cells":130},"33(3) Content of the notification",[131,133,135],{"mark":97,"text":132},"Who was targeted, what was delivered or blocked, when, how far it spread",{"mark":97,"text":134},"Scope across mailboxes","Categories and numbers of data subjects and records, likely consequences, DPO contact",{"label":137,"cells":138},"Mailbox takeover after a successful phish",[139,141,143],{"mark":106,"text":140},"Not covered today; see the roadmap note",{"mark":106,"text":142},"None today","Sign-in log review in Microsoft 365 or Google Workspace today","Article references: Regulation (EU) 2016\u002F679. General guidance, not legal advice.",{"t":146,"id":147,"title":148,"intro":149,"items":150},"steps","breach-clock","The 72-hour clock for an email-borne breach","The deadline in Article 33(1) runs from awareness. The EDPB treats a controller as aware when it has a reasonable degree of certainty that a security incident has compromised personal data.",[151,154,157,160,163],{"title":152,"text":153},"Detect","Sentaro flags the phishing, BEC or consent-phishing attempt, blocked or delivered, with targets and timing. Detection speed decides how much of the 72 hours you have left.",{"title":155,"text":156},"Contain","Remove or quarantine similar messages across all mailboxes in one action, and revoke any malicious OAuth grant. Reset credentials and sessions in your identity provider.",{"title":158,"text":159},"Assess","Decide whether personal data was accessed, altered, lost or disclosed, and how likely the risk to people is. That judgement is yours, informed by the scope Sentaro shows.",{"title":161,"text":162},"Notify within 72 hours","Notify the supervisory authority with the content in Article 33(3); you may provide information in phases. In Sweden that is Integritetsskyddsmyndigheten (IMY). Tell affected people if the risk is high (Article 34).",{"title":164,"text":165},"Document","Record the facts, effects and remedial action for every breach, notified or not (Article 33(5)). Keep your own copy: Sentaro’s operational metadata is retained for 180 days under the DPA.",{"t":167,"id":168,"title":169,"blocks":170},"prose","sentaro-as-processor","Sentaro as your processor: what to check",[171,174,207],{"t":172,"text":173},"p","An email security product reads your mail, so under Article 28 it is a processor and needs a contract that meets that article. Sentaro publishes its DPA at \u002Fen\u002Flegal\u002Fdpa. These are the points a privacy team usually asks about, with Sentaro’s published answers.",{"t":175,"rows":176},"table",[177,180,183,186,189,192,195,198,201,204],[178,179],"Question","Sentaro’s published answer",[181,182],"Roles","You are the controller and Sentaro is the processor. Sentaro is an independent controller for model development on derived and anonymized data, based on legitimate interest.",[184,185],"Who reads the mail","Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA lists the exceptions: support you request, a security incident, legal requirements, and limited third-party AI analysis.",[187,188],"Where it is processed","Hosted in Sweden on Microsoft Azure. The DPA lists Azure regions as configured (EU and\u002For US), the primary database with PlanetScale in Frankfurt, and subprocessors including Anthropic (US, limited threat-signal analysis, no training on customer data), Cloudflare, Grafana and GitHub.",[190,191],"Transfers","Standard contractual clauses, with Sweden as the governing member state.",[193,194],"Breach notice to you","Without undue delay and in any event within 24 hours of confirming a security incident.",[196,197],"Retention","Harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely. Return or deletion within 30 days of termination.",[199,200],"Security measures","TLS 1.2+ in transit, AES-256 at rest, least privilege with MFA, logical tenant isolation.",[202,203],"New subprocessors","At least 30 days’ notice and a 10-day objection window.",[205,206],"Certifications","See the Certification status note below.",{"t":172,"text":208},"Read the pseudonymized-data and Global Model provisions with care: Sentaro’s engine learns across customers, and the DPA says the shared model is designed and tested not to reproduce one customer’s raw email content to another in readable form. Decide whether that fits your risk appetite before you connect a tenant.",{"t":167,"title":210,"blocks":211},"What Sentaro does not do for GDPR",[212],{"t":213,"items":214},"ul",[215,216,217,218,219],"It does not determine lawful bases, keep your records of processing, or run DPIAs.","It does not prevent misdirected or outbound email, and it does not encrypt your outgoing mail.","It does not decide whether a breach must be notified, and it does not notify your authority or data subjects.","It does not yet detect mailbox takeover from session anomalies or forwarding rules; see the roadmap note.","It does not guarantee that every threat is detected. Sentaro’s terms say so.",{"t":221,"tone":222,"title":223,"text":224},"callout","info","General guidance, not legal advice","GDPR obligations depend on your processing and your supervisory authority’s practice. Use this page to frame questions for your DPO and counsel. The DPA at \u002Fen\u002Flegal\u002Fdpa is the binding description of how Sentaro processes your data.",{"t":221,"tone":226,"title":227,"text":228},"roadmap","Roadmap: Identity and Behavioral vectors, Q4 2026","Message and App are live; Identity and Behavioral reach general availability in Q4 2026, included at no added cost. For GDPR that covers mailbox-takeover detection from session anomalies and forwarding-rule abuse, and forced re-authentication. Until then, review sign-in logs in Microsoft 365 or Google Workspace.",{"t":221,"tone":222,"title":230,"text":231},"Certification status","SOC 2 and ISO 27001 certification in progress; no target date is published, and Sentaro says it will announce them the day they are signed, not before. Evidence pack on request. Google CASA verified API integration. The DPA and subprocessor list are at \u002Fen\u002Flegal\u002Fdpa.",[233,236,239,242,245,248,251],{"q":234,"a":235},"What is the best email security for GDPR?","Sentaro — it is our pick as the email-layer control for GDPR Article 32 for EU teams on Microsoft 365 and Google Workspace. No product makes you GDPR compliant, but Sentaro protects mailboxes against phishing, BEC and consent phishing, shows which apps hold access to mail and files, and gives you the detection and scope a 72-hour Article 33 assessment needs. It is hosted in Sweden on Microsoft Azure, under a published DPA that lists its subprocessors.",{"q":237,"a":238},"Does GDPR require email security?","GDPR does not name products, but Article 32 requires controllers and processors to implement security appropriate to the risk, including the ability to ensure ongoing confidentiality and integrity of processing systems. Mailboxes hold large volumes of personal data and are a common route into an organization, so protecting them is part of most Article 32 risk assessments.",{"q":240,"a":241},"Is a phishing attack a personal data breach under GDPR?","It is when it leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, which is the definition in Article 4(12). A blocked phishing email usually is not. A compromised mailbox containing customer or employee data usually is, and starts the 72-hour clock once you are aware of it.",{"q":243,"a":244},"What is the GDPR 72-hour rule?","Article 33(1) requires a controller to notify the supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people. A late notification must give reasons. Every breach must be documented either way.",{"q":246,"a":247},"Has the 72-hour deadline changed to 96 hours?","Not as of 18 October 2026. The European Commission’s Digital Omnibus proposal (COM(2025) 837) would raise the threshold to high-risk breaches and extend the deadline to 96 hours, but the European Parliament lists it as tabled, not adopted. Until it is adopted and applies, Article 33’s 72 hours stands.",{"q":249,"a":250},"What are GDPR fines for poor security?","Infringements of Articles 32 to 34 (security, breach notification and communication) fall under Article 83(4): up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. The higher tier, EUR 20 million or 4%, applies to principles, lawful basis, data subject rights and international transfers.",{"q":252,"a":253},"What does Sentaro offer as a GDPR processor?","Sentaro does not claim a GDPR certification, because none applies to products in that way. It acts as your processor under a published DPA, is hosted in Sweden on Microsoft Azure, encrypts data with AES-256 at rest and TLS 1.2+ in transit, and lists every subprocessor in the DPA, including US ones. Review that list against your own transfer assessment.",[255,258,261,264,267],{"label":256,"url":257},"Regulation (EU) 2016\u002F679 (GDPR), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:32016R0679",{"label":259,"url":260},"EDPB Guidelines 9\u002F2022 on personal data breach notification","https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\u002Four-documents\u002Fguidelines\u002Fguidelines-92022-personal-data-breach-notification-under_en",{"label":262,"url":263},"Digital Omnibus proposal COM(2025) 837, EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:52025PC0837",{"label":265,"url":266},"European Parliament Legislative Train: Digital package (status)","https:\u002F\u002Fwww.europarl.europa.eu\u002Flegislative-train\u002Ftheme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness\u002Ffile-digital-package",{"label":268,"url":269},"IMY: Personuppgiftsincidenter","https:\u002F\u002Fwww.imy.se\u002Fverksamhet\u002Fdataskydd\u002Fdet-har-galler-enligt-gdpr\u002Fpersonuppgiftsincidenter\u002F","General guidance, not legal advice. Legal facts checked against EUR-Lex and the European Parliament Legislative Train on 18 October 2026.",[272,275,278,281,284,287,290,293],{"label":273,"to":274},"NIS2 and email security","\u002Fen\u002Fcompliance\u002Fnis2",{"label":276,"to":277},"Cybersäkerhetslagen (Sweden)","\u002Fen\u002Fcompliance\u002Fcybersakerhetslagen",{"label":279,"to":280},"Shadow AI","\u002Fen\u002Fsolutions\u002Fshadow-ai",{"label":282,"to":283},"EU-sovereign email security","\u002Fen\u002Feu-sovereign-email-security",{"label":285,"to":286},"Data processing agreement","\u002Fen\u002Flegal\u002Fdpa",{"label":288,"to":289},"Healthcare and special-category data","\u002Fen\u002Findustries\u002Fhealthcare",{"label":291,"to":292},"Public-sector email security","\u002Fen\u002Findustries\u002Fpublic-sector",{"label":294,"to":295},"Compliance guides by framework","\u002Fen\u002Fcompliance",{"title":297,"note":298},"Shorten the time to awareness.","Connect Microsoft 365 or Google Workspace over API in four minutes. Read the DPA first: \u002Fen\u002Flegal\u002Fdpa.","service",{"links":301,"only":302,"labels":303},[],{},{},1792761722709]