---
title: "GDPR"
canonical: https://replypen.com/glossary/gdpr
description: "The GDPR, the European Union's General Data Protection Regulation, is the law that governs how organisations collect, use, store and share personal data about people in the EU."
question: "What is the GDPR, and what does it mean for customer email?"
author: "ReplyPen team"
published: 2026-09-30
operator: ProBackup BV (Hasselt, Belgium)
---

# What is the GDPR, and what does it mean for customer email?

The GDPR, the European Union's General Data Protection Regulation, is the law that governs how organisations collect, use, store and share personal data about people in the EU. Customer emails are full of personal data, so any business answering them, and any tool that reads them, falls under it.

This is a general explanation, not legal advice. The GDPR applies since 2018 and covers names, email
addresses, order details, and anything else that identifies a person. It gives people rights over
their data, such as seeing it and having it deleted, and it requires a lawful reason, security and
transparency from whoever handles it.

## Why it matters

When you answer customer email, your business is usually the controller: you decide why the data is
used. A tool that reads your inbox on your behalf is a processor. The GDPR expects a written contract
between the two, a [data processing agreement](https://replypen.com/glossary/data-processing-agreement.md), and a list of
any other companies the processor relies on, its [sub-processors](https://replypen.com/glossary/sub-processor.md). If
data leaves the EU, it also requires approved safeguards.

Practical questions to ask any tool: what data it reads, where it is stored, who else sees it, how
long it is kept, and how you can have it deleted.

## An example

A customer asks you to delete everything you hold about them. You delete the emails in your own
mailbox and ask each tool that processed them to do the same.

**In ReplyPen:** What ReplyPen stores, where, and which companies are involved is on [where your data goes](https://replypen.com/data-residency.md);
the legal text is the [privacy policy](https://replypen.com/privacy-policy.md).

## Related

- [Data processing agreement (DPA)](https://replypen.com/glossary/data-processing-agreement.md): A data processing agreement, or DPA, is the contract between a business and a service provider that handles personal data on its behalf.
- [Sub-processor](https://replypen.com/glossary/sub-processor.md): A sub-processor is a company that a service provider uses to process your data on its behalf, such as a hosting provider, an AI model provider or an email delivery service.
- [Data residency](https://replypen.com/glossary/data-residency.md): Data residency is the country or region where your data is physically stored and processed, for example in data centres inside the EU.