Privacy by design

Little data collected, short retention, and clear guidance on faxing personal information.

Updated on:

The GDPR (Regulation (EU) 2016/679) does not mention fax, but it applies to it: sending a document about an identifiable person is processing of personal data. CaptainFax is operated from France, so European rules apply to us. We keep the uploaded document only until the fax is sent, we ask for no account, and card payments go through Stripe. If you are the one faxing personal data, you are usually the controller. The sections below set out what that implies, in particular for security and for a fax that reaches the wrong person.

Four ideas to start from

The GDPR reasons about data and risk, not about technology. These points apply to a fax as they do to an email or a letter.

  • Transmitting is processing

    Under Article 4(2), disclosure by transmission counts as processing. Sending a payslip, a medical form or a customer file by fax is thus covered by the Regulation.

  • A lawful basis is required

    Article 6 provides six: consent, contract, legal obligation, vital interests, public interest and legitimate interests. Which one fits depends on why you are sending the document and to whom.

  • Send what is necessary, nothing more

    Data minimization (Article 5(1)(c)) means the data must be adequate, relevant and limited to what the purpose requires. Remove unnecessary pages and details before you create the PDF.

  • Transfers outside the EU have conditions

    Faxing someone outside the European Economic Area counts as a transfer under Chapter V (Articles 44 to 49). One of our destinations, Canada, has a European Commission adequacy decision for commercial organizations subject to PIPEDA (Decision 2002/2/EC). Other recipients there require you to verify which safeguard applies.

What Article 32 means for a fax

Article 32 obliges controllers and processors to put in place technical and organizational measures that fit the risk, weighing the state of the art, the cost and the nature of the data. Encryption is mentioned as one such measure, alongside pseudonymization and regular testing.

For a fax, encryption covers just the first leg. With CaptainFax the upload goes over HTTPS and the file is erased after the fax is sent, but the telephone leg stays unencrypted, as with any fax. Organizational safeguards must handle the rest: verified numbers, a second person reviewing sensitive faxes, a call to the recipient in advance, and anonymized pages whenever the purpose permits.

Document your decisions. Article 5(2) holds you accountable for being able to show compliance, and a brief note on why a given flow uses fax, and what precautions accompany it, does the job. If your risk assessment finds that unencrypted fax is too risky for certain content, use a different channel for it.

A fax went to the wrong person

When a page with personal data reaches someone it wasn’t meant for, Article 4(12) classes it as a personal data breach, innocent mistake or not. Work through the following steps in this order.

  1. Limit the damage

    Reach out to the person who received the fax by mistake and ask them to destroy the pages, confirming this in writing if they can. Keep a record of what you exchange.

  2. Record it internally

    Article 33(5) requires you to document every breach: what happened, its effects and what you did about it. This applies even when no notification is needed.

  3. Notify the authority within 72 hours if needed

    Unless the breach is unlikely to put individuals at risk, notify your national supervisory authority promptly, and where possible within 72 hours of learning about it (Article 33(1)). A notification made after that must include the reasons for the delay.

  4. Inform affected individuals when the risk is high

    Where the risk is high, for instance with health or financial data or anything enabling identity theft, the individuals affected must be told promptly and in plain language (Article 34). If you are a processor, you must also alert the controller promptly (Article 33(2)).

What to set up in your organization

A list of verified numbers
Keep regular recipients such as an insurer, a laboratory or a court registry in a checked and dated list. People pick the number from the list and never from memory.
A second look for sensitive faxes
With a medical or financial file, have a colleague check both the number and the content before you send. It takes two minutes and heads off most mistakes.
A standard cover sheet
Name of the recipient, number of pages, sender details and what to do if the fax arrived by mistake. Placed first in every transmission, it tells whoever finds the pages what to do.
Control of your own machines
For incoming faxes, put the machine in a room that can be locked, or enable reception into protected memory with a PIN where the model supports it. Wipe the memory or the disk before returning leased equipment.
An entry in your record of processing
When fax is part of your routine workflows, record it in the register required by Article 30: the purpose, categories of data and of recipients, transfers, retention periods and security measures.

Frequently asked questions

Is it allowed to fax health data?
The GDPR doesn’t prohibit it. Health data falls under the special categories in Article 9, which means you need one of that article’s exceptions, such as providing care, and you must meet a higher standard of diligence. National rules like medical confidentiality apply too. Your data protection officer or professional body can explain what applies to your practice.
Do I need a contract with CaptainFax?
Article 28 says that any provider processing personal data for you must be bound by a contract covering instructions, confidentiality, security and the return or deletion of data at the end of the service. If your organization plans to use CaptainFax regularly for documents containing personal data, contact us through the contact page so that we can look at it together.
How long are my documents kept?
CaptainFax uses the uploaded file to send the fax and then deletes it automatically. Card payments go through Stripe. On your end, decide how long to hold your own copies and receipts (Article 5(1)(e)). On the recipient's side, retention depends on their own policy.
Can a person named in a fax exercise their rights?
Yes. Access, rectification, erasure, objection and the other rights set by Articles 15 to 22 are owed by the controller, meaning whichever organization chose to send the document. It has one month to respond, with up to two further months allowed when requests are complex or numerous (Article 12(3)).

Keep exploring

A few pages that go well with the one you just read.

Related questions