I have a system in which organizations are usually the main account holders. Usually they will add sub accounts for employees or other people who need to use the system by entering their email address, and an invitation link is sent to that address.

I am wondering if this falls foul of the new GDPR requirements? Technically the recipient email address never signed up to receive emails from my service, however, it is also not an automated email but rather one that must be triggered manually by the customer.

  • "an invitation link is sent to that address" - And if they ignore the "invitation" or explicitly "decline" it then their details are deleted? – DocRoot May 10 '18 at 10:34
  • Currently, no. There is no decline, the link contained in the email would simply be ignored - and the email address would remain on my system as an account that never had been activated. No further emails are sent to that email address. Does the fact that these emails are stored present a problem? – Thomas Harris May 10 '18 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.