The General Data Protection Regulation (Regulation (EU) 2016/679) is the EU's data protection law: it governs how organizations collect, use, protect and delete personal data, with fines up to EUR 20 million or 4% of global turnover for the most serious violations. For security teams, its sharpest edge is Article 33: personal data breaches must be reported to the supervisory authority within 72 hours of awareness. Guidance is published by the European Data Protection Board.
Key facts:
- GDPR applies to any organization processing EU residents' personal data, regardless of where the organization sits.
- Security of processing (Article 32) requires measures appropriate to the risk, and regulators consistently treat email protection as baseline.
- Most reportable personal data breaches begin as email incidents: phishing, mailbox compromise or misdirected data, which makes the 72-hour clock an email detection problem.
The duties that touch security teams
Lawful basis, transparency and data subject rights are the privacy lawyers' domain. Security teams own: appropriate technical measures (Article 32), breach detection and the 72-hour notification (Articles 33-34), processor oversight (who processes your data, under what agreement), and data minimization in practice, including knowing where personal data actually flows. That last duty collides directly with shadow IT and shadow AI: personal data pasted into an unsanctioned AI tool or synced by an unapproved app is a GDPR event no policy document prevented.
The 72-hour clock is a detection problem
You cannot report what you have not noticed. The breach notification timeline starts at awareness, and regulators expect organizations to become aware promptly. For email-borne breaches, including business email compromise, the practical difference between a controlled notification and a late one is whether the mailbox compromise or phishing incident was detected in hours or discovered weeks later in the damage. See also NIS2 for a parallel EU regime with the same clock discipline, and the EU AI Act for how AI use layers on top.
Where email security fits, honestly
No product makes an organization GDPR compliant; lawful bases, agreements, registers and rights processes are organizational. What Sentaro contributes: protection of the channel where most personal data breaches start, early detection that starts the 72-hour clock with facts (what was accessed, whose data, when), visibility into which third-party apps and AI tools hold access to mail and files (your processor reality, not just your processor list), and evidence for the accountability principle.
This page is general guidance, not legal advice.