Email Spec

Recipient data minimisation

Put only necessary personal data in message bodies, headers, links, logs, and provider metadata, with explicit retention for each copy.

What it is

Data minimisation limits personal data to what is adequate, relevant, and necessary for the message and its operational obligations.

Why it matters

Email is copied across queues, relays, mailboxes, backups, logs, and notification previews. Every extra field increases exposure.

How to implement

Prefer secure account links over full records, redact logs, avoid personal data in URLs and subjects, and define retention for delivery events and rendered content.

Common mistakes

  • Placing account or health details in the subject line.
  • Using an email address as a tracking token.
  • Sending complete records when a notification is sufficient.

Verification

Inventory personal fields in raw source, URLs, provider tags, logs, and webhooks. For each field, record its purpose, access, and deletion rule.

Sources

  1. GDPR Article 5 — Principles relating to processing — European Union