Email Verification and GDPR: What Is Lawful When You Clean a List

An email address that identifies a person is personal data. Running it through a verification service is processing that data, and you are doing it through a third party. That places verification squarely inside GDPR, the UK GDPR, India's DPDP Act and the various US state laws, and it means there are questions worth answering before you upload a file.

This is not legal advice and I am not a lawyer. It is the set of practical questions that come up, and where the honest answers are.

01The relationship: you are the controller, we are the processor

Under GDPR the party that decides why data is processed is the controller. The party that processes it on the controller's instructions is the processor.

When you upload a list for verification, you are the controller. You decided to collect those addresses, you decided to check them, and you decide what happens next. The verification service is a processor acting on your instruction.

This matters because the obligations are not symmetrical. As controller you need a lawful basis for the processing, you need to be able to demonstrate it, and you carry the accountability. The processor's job is to process only as instructed, keep the data secure, not use it for its own purposes, and let you audit that.

02Do you need consent to verify an address?

This is the question people expect to be hard and it usually is not.

You need a lawful basis for the processing. Consent is one of six under Article 6, and it is rarely the relevant one here.

If you hold an address on the basis of consent for marketing, verifying that address is compatible with the purpose you already have. You are checking whether the address you were given still works. That is not a new purpose requiring fresh consent, it is data quality maintenance in service of the original one.

If you hold the address under legitimate interests, the same reasoning applies and arguably more comfortably. Article 5(1)(d) requires that personal data be accurate and kept up to date. Verification is one of the few processing activities that exists specifically to satisfy an obligation the regulation itself imposes on you.

Where it gets genuinely difficult is not the verification. It is whether you had a lawful basis for the address in the first place. If you cannot articulate why you are lawfully holding an address, verifying it does not fix that, and it does not launder it either. A verified address you have no basis to hold is still an address you have no basis to hold.

03What a DPA is and when you need one

A Data Processing Agreement is the contract Article 28 requires between a controller and a processor. It has to be in place, and it has to cover specific things: the subject matter and duration of processing, the nature and purpose, the categories of data, your instructions, confidentiality, security measures, sub-processors, and what happens at the end.

Practically, you need one with any verification service you use at meaningful volume, and you should ask for it before you upload rather than after. Most established vendors have a standard one. If a vendor cannot produce a DPA, that tells you something about how they think about their obligations.

If you need formal processing terms from us, email [email protected] and we will work through terms that fit your situation.

04The questions to actually ask a vendor

Four, and the second is the one that matters most.

Where is the data processed? If personal data belonging to EU residents leaves the EEA, you need a transfer mechanism. Ask where the servers are and what mechanism covers any transfer.

Is my list used for anything other than my job? This is the question. A verification service sees enormous volumes of address data and there is real commercial value in aggregating it: building a shared known-good database, improving models, enriching a data product. Some vendors are explicit that they do not do this. Some are silent. Silence is an answer, and you should treat it as one, because if your list becomes part of a shared dataset you have facilitated a disclosure you did not have a basis for.

How long is my file retained? Uploaded lists should be deleted on a defined schedule, not kept indefinitely. Ask for the number.

Who are the sub-processors? Every service uses infrastructure providers. You are entitled to know who is in the chain.

05Where verification genuinely helps your compliance position

Three places, and they are more substantial than most vendors bother to explain.

The accuracy principle. Article 5(1)(d) says personal data must be accurate and, where necessary, kept up to date. A list where 15% of the addresses no longer belong to anyone is a list that fails that test. Periodic verification is direct, documentable evidence that you take the accuracy obligation seriously.

Data minimisation. Article 5(1)(c) says you should hold no more personal data than you need. Addresses that are permanently undeliverable serve no purpose. They are personal data you are storing for no reason, which is a minimisation problem regardless of how you acquired them. Culling them reduces the amount of personal data you hold, which is the direction the regulation wants you to move in.

Demonstrating accountability. Article 5(2) requires you to be able to show compliance rather than merely assert it. A verification record with dates gives you an artefact. "We verify quarterly and remove undeliverable addresses, here are the job records" is a considerably better answer to a regulator than "we intend to keep our data accurate."

06Where it does not help

Being clear about the limits, because compliance is an area where overclaiming is actively harmful.

Verification does not establish lawful basis. If you bought a list from a broker of unknown provenance, verifying it tells you the addresses work. It tells you nothing about whether anyone consented, and it does not create a basis you lacked. You now have a clean list you still cannot lawfully mail. Our post on what to do with a purchased list covers that situation directly.

Verification is not consent. An address being deliverable means a mailbox accepts mail. It carries no information about whether the person wants yours.

A clean list is not a compliant list. These are independent properties. You can have a perfectly clean list of addresses you have no right to process, and a messy list of addresses with impeccable consent records.

07A note on what your own terms should say

If you are on the other side of this, collecting addresses and having them verified, your privacy notice should mention that you use third-party processors for data quality purposes. It does not need to name us. It does need to not be silent about the category, because a data subject asking who has touched their address is entitled to a truthful answer.

08The short version

You are the controller and the verification service is your processor. You need a lawful basis for the addresses, not separate consent for the verification, because checking that an address still works is compatible with whatever purpose you already had. Get a DPA. Ask specifically whether your list is used for anything beyond your job, because that is the question where vendor practice diverges most.

Verification helps with accuracy, minimisation and demonstrable accountability, all of which are real obligations. It does nothing whatsoever for lawful basis, and no amount of cleaning turns a list you should not have into one you should.

If you need processing terms, email [email protected]. Our terms of service set out the lawful-basis warranties we ask of customers, in sections 3.1 and 4.