Email signatures and GDPR: the short, practical version

Signatures aren't marketing emails, but the personal data inside them — the sender's name, role, phone, sometimes photo — is still personal data. Here's the short version of what GDPR asks of you.

Lawful basis

For a work email signature, the lawful basis is almost always legitimate interest: the employer needs to identify the sender. You don't need consent for the fact that a signature exists.

What people get wrong

Baking a marketing tracking pixel into every employee's signature without a separate lawful basis. A signature is transactional; a pixel that reports opens back to a CRM is not. Keep the two separate.

The safe defaults

• No hidden tracking in the signature itself
• Marketing banner links use standard UTM tags, nothing exotic
• A confidentiality footer only where it's genuinely required
• A way for employees to opt out of the marketing banner