Fax and data protection
Faxing personal data while staying on the right side of the GDPR.
No article of the GDPR (Regulation EU 2016/679) mentions fax. The text applies to processing, and sending a document that refers to an identifiable person is processing (Article 4(2)). So you need a lawful basis (Article 6), content limited to what is necessary (Article 5), security measures that fit the risk (Article 32) and a procedure ready for a fax sent to the wrong recipient (Articles 33 and 34). Since the last leg of a fax cannot be encrypted, most of the protection comes from organisation: checking, preparing, being discreet.
The framework in four principles
The GDPR thinks in terms of processing and risk, never technology. These four landmarks apply to fax as to any other way of sending.
Sending is processing
Article 4(2) expressly lists "disclosure by transmission" among processing operations. Faxing a customer record, a payslip or a prescription therefore falls squarely within the Regulation.
Every fax needs a lawful basis
Article 6 sets out six: consent, performance of a contract, legal obligation, vital interests, public task, legitimate interests. An employer sending a certificate to a social security body is usually meeting a legal obligation.
Only what is needed travels
The data minimisation principle (Article 5(1)(c)) requires that what you transmit be adequate, relevant and limited to the purpose. Before generating the PDF, strip out the pages and details the recipient has no use for.
Outside the European Economic Area, extra rules apply
Faxing to a third country is a transfer governed by Chapter V (Articles 44 to 49). For Canada, the European Commission has recognised an adequate level of protection for organisations subject to the federal PIPEDA law (Decision 2002/2/EC); for other Canadian recipients, such as some provincial authorities, check which safeguards apply.
Security: what Article 32 asks of a fax
Article 32 requires controllers and processors to implement technical and organisational measures ensuring a level of security appropriate to the risk, taking into account the state of the art, the costs and the nature of the data. Encryption appears there as one possible measure, alongside pseudonymisation and regular testing, to be used as appropriate.
For a fax, encryption covers only part of the journey. With FaxTelecom, the PDF upload runs over HTTPS and the file is deleted after sending; the phone line to the fax machine stays in the clear, as it does for every fax service. Organisational measures therefore take over: a list of verified numbers, a second pair of eyes for sensitive faxes, a call to the recipient beforehand, anonymised pages whenever possible.
Write these choices down. Article 5(2) sets out the accountability principle: you must be able to demonstrate compliance. A short note explaining why fax is used for a given flow, and which precautions go with it, is exactly that demonstration. If your assessment concludes that the risk remains too high without end-to-end encryption, choose another channel.
Fax sent to the wrong recipient: what to do
A page containing personal data that ends up with an outsider counts as a personal data breach under Article 4(12), even when the mistake is accidental and the third party acts in good faith. Here are the steps to take, in order.
Contain the incident
Contact the unintended recipient, ask them to destroy the pages and, if possible, to confirm this in writing. These steps reduce the risk and belong in your records.
Log the breach internally
Article 33(5) requires every breach to be documented: the facts, its effects and the remedial action taken. This applies even when no notification is due.
Report to the regulator within 72 hours where required
Unless it is unlikely to pose any risk to the people concerned, the breach is notified to the supervisory authority (the CNIL in France, the ICO in the UK) without undue delay and, where feasible, no later than 72 hours after you become aware of it (Article 33(1)). After that, the notification must explain the delay.
Tell the people affected if the risk is high
If the risk is high (health data, bank details, information enabling identity theft), the individuals concerned are informed without undue delay, in plain language (Article 34). A processor, for its part, must alert the controller without undue delay (Article 33(2)).
Measures to put in place in your organisation
- A directory of verified numbers
- Regular contacts (health fund, laboratory, court registry, insurer) sit in a checked, dated list. People dial from that list, never from memory.
- Four-eyes checks for sensitive faxes
- For a medical or financial file, a colleague rereads the number and the content before sending. Two minutes that prevent most errors.
- A cover page template
- Named recipient, page count, sender's details and instructions in case of misdelivery. Placed at the front of every transmission, it immediately guides whoever finds the fax.
- Fax machines under control
- For incoming faxes, put the device in a locked room or turn on PIN-protected memory reception where the model allows it. Wipe the disk or memory before returning any leased equipment.
- An entry in the record of processing
- If fax is part of your regular workflows, describe it in the record required by Article 30: purpose, categories of data and recipients, any transfers, retention periods, security measures.
Your questions
- May I fax health data?
- Yes, the GDPR does not prohibit it. Such data belongs to the special categories of Article 9: processing it requires one of the exceptions listed in that article, for instance the provision of health care, plus a higher level of care. National rules such as medical confidentiality and professional codes come on top. Your DPO or professional body can tell you what applies to your practice.
- Should I sign an agreement with a fax provider?
- When a provider acts on your behalf with personal data, Article 28 requires a contract setting out its obligations: instructions, confidentiality, security, how data is returned or deleted once the service ends. If you plan to use FaxTelecom regularly for an organisation, write to contact@faxtelecom.com to look into this.
- How long are my documents kept?
- At FaxTelecom, the uploaded PDF is used only for sending and deleted automatically afterwards; card payment, when there is one, is handled by Stripe. On your side, set a retention period for the copies and receipts you keep (Article 5(1)(e)). At the recipient's end, retention is governed by their own policy.
- Can someone named in a fax exercise their rights?
- Yes. Access, rectification, erasure, objection: the rights in Articles 15 to 22 are exercised against the controller, that is, the organisation that decided to send the document. It must respond within one month, extendable by two further months for complex or numerous requests (Article 12(3)).
Security and data
In this section
Where to go next
Hand-picked pages to help you prepare, send or prove your fax.
- Articles 1358, 1366 and 1379 of the French Civil Code, read from a fax user's point of view.
- Proof, speed, price: what each one brings, with figures.
- The equipment involved, the real price and the reason FaxTelecom only handles sending.