Mailtiv / Blog

Email signatures and GDPR: what to check

Updated 4 November 2026 by the Inthouse product team

The short answer: yes, an email signature contains personal data. An employee's name, title, phone number and photo are information about an identifiable person. So when you manage signatures centrally, keep the basic principles of the EU General Data Protection Regulation (GDPR) in mind, and know how your tool handles that data.

This article is general information, not legal advice. For an assessment of your own company, talk to your data protection officer or a privacy specialist.

What personal data is in an email signature?

A typical company signature includes:

• full name and job title;
• department and office address;
• work phone and mobile number;
• email address;
• often a profile photo, sometimes a QR code or contact card (vCard) details.

These details usually come from the company's user directory; in companies that use Microsoft 365, from each person's Microsoft 365 profile. And the signature goes out to recipients with every email.

The GDPR points that matter for signatures

In plain words, these are the GDPR principles that matter most for email signatures:

• Lawful basis: you need one of the lawful bases the GDPR lists to process personal data. Using employee details in business email is a normal part of the job in most companies, but your company has to decide the basis itself.
• Transparency: employees should know how their details are used in signatures and in the signature tool. This usually belongs in the company's employee privacy notice.
• Data minimisation: show only what's needed. Not every signature needs a mobile number or a photo, and a shorter signature may be enough for internal email.
• Transfers outside the EU: if the tool stores data outside the European Economic Area, you need to check that the transfer meets the GDPR's conditions. Ask every provider about this.
• Deletion and retention: it should be clear how data is deleted when someone leaves or when you stop using the tool.

Questions to ask before you choose a signature tool

When you evaluate an email signature tool, ask the provider:

1. Does email content pass through the tool's servers? Some approaches route email through their own servers to add the signature. If content never leaves your organization, much less data is processed in the first place.
2. Where is data stored? In which country or region, and on which cloud?
3. Which profile fields does it use? Only the fields that appear in the signature, or more?
4. Can data be deleted? Can you delete all company data in one step, and when do backups go?
5. Are admin actions logged? Can you see who changed which signature, and when?

How Mailtiv approaches this

Mailtiv is designed with a GDPR-aligned approach to these questions:

• Email content isn't read, recorded or stored. The signature is added inside Outlook; your email never passes through Mailtiv.
• Only the profile fields a signature needs are used: name, title, department, phone numbers, office address, photo and similar. They're shown only in that person's own emails.
• Data is stored in Microsoft Azure data centres in the EU (North Europe). What's stored: signature templates, campaigns, company assets (logos, links, address, disclaimer), company settings and an activity log of admin changes. The activity log is kept for 12 months.
• All company data can be deleted from the portal. Settings → Delete all company data removes signatures, campaigns, company assets, settings and the activity log right away; backups go on their own within 8 days.

For details, see "Data and privacy" in How Mailtiv works.

Frequently asked questions

Is an email signature personal data?

Yes. The name, title, phone number and photo in a signature are information about a specific person, and that is personal data under the GDPR.

Does a signature tool read our email?

It depends on the tool; some approaches route email through their own servers to add the signature. With Mailtiv, the signature is added inside Outlook; email content isn't read, recorded or stored.

Where does Mailtiv store data?

In Microsoft Azure, in the North Europe region, inside the EU.

What happens to our data if we stop using Mailtiv?

You can delete it in the portal with Settings → Delete all company data. Then remove the add-in in the Microsoft 365 admin center and delete Mailtiv's access in the Microsoft Entra admin center.