Email Disclaimers: Legal Requirements and Templates by Country and Industry (2026)

TL;DR: No major jurisdiction requires a generic "this email is confidential" disclaimer. What the law does require is narrower: company identification details on business correspondence in the UK, Germany, France and other EU countries, sender identification and an unsubscribe for commercial email in the US, Canada and Australia, and sector rules for regulated firms such as broker-dealers and mortgage lenders. Put the required details in a centrally managed signature block, keep any confidentiality notice short, and apply both automatically to every external email.

Last reviewed: October 2026.

This is general information, not legal advice. Requirements change and depend on your entity type, sector and the content of each message; confirm what applies to you with counsel in each jurisdiction where you operate. Every requirement below links to the statute or regulator page it comes from.

This guide is the hub of the Scribe Handbook's compliance section. It answers three questions IT and legal teams get asked: what an email disclaimer has to say in each country, what regulated industries add, and how to enforce it on every email without relying on employees. For ready-to-copy confidentiality wording, use our 15 confidentiality disclaimer samples; for healthcare, our HIPAA email disclaimer templates.

Are email disclaimers legally required?

It depends on what you mean by "disclaimer." Most of what appears under business emails falls into two very different groups:

• Mandatory disclosures. Facts the law says business correspondence or commercial messages must contain: registered company name, registration number, registered office, managing directors, a postal address, an unsubscribe mechanism, a regulator's required statement. Leaving these out can carry fines.
• Voluntary notices. Confidentiality, privilege, "no contract," virus and monitoring statements. These are not required by statute in the jurisdictions below. Their legal effect is limited: they can't make an email confidential after it has been sent to the wrong person, and courts tend to look at the circumstances rather than the footer. They are still useful as a clear instruction to a mistaken recipient and as a signal of your intent.

Jurisdiction	Corporate details on business emails	Commercial or marketing email rules	Generic confidentiality notice required?
United States	No general federal rule	CAN-SPAM: postal address, opt-out, no deceptive headers	No
United Kingdom	Yes: name, registration number, part of UK registered, registered office	PECR consent and opt-out rules for marketing	No
European Union (baseline)	Yes: register, number, legal form, registered office (national laws implement Directive 2017/1132)	ePrivacy rules, national implementation	No
Germany	Yes: Pflichtangaben under HGB, GmbHG, AktG	UWG § 7: prior consent for email advertising, sender identity, opt-out address	No
France	Yes: SIREN, "RCS" and registry city, registered office, legal form and capital	National ePrivacy rules for marketing email	No
Canada	No general federal rule for email	CASL: consent, identification, unsubscribe	No
Australia	Name and ACN/ABN on public documents (Corporations Act s 153); whether a given email counts depends on the document	Spam Act 2003: consent, sender identification, unsubscribe	No

What do disclaimers need to say in each country?

United States

There is no general federal requirement to put company details or a disclaimer on business email. Two rules apply often enough to plan for:

• CAN-SPAM applies to commercial email, including business-to-business email. Commercial messages must not use misleading header information or subject lines, must identify themselves as advertising where required, must include a valid physical postal address, and must offer a working opt-out that is honored (FTC: CAN-SPAM Act compliance guide). Messages whose primary purpose is transactional or relationship content are treated differently. This matters for signatures when sales teams add promotional banners to one-to-one emails: if the primary purpose of a message becomes commercial, CAN-SPAM's requirements follow.
• Sector rules (finance, legal, healthcare) are covered in the industry section below.

Some states have their own professional and licensing rules (for example, for real estate licensees and mortgage loan originators), so check state requirements for regulated roles.

United Kingdom

UK companies must disclose their registered name on business letters and "all other forms of its business correspondence and documentation" (The Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015, reg. 24), and must show on business letters, order forms and websites the part of the UK where the company is registered, its registered number and its registered office address (reg. 25). The regulations state that a reference to a document includes one "in hard copy, electronic or any other form" (Part 6), which is why UK companies put these details in email signatures. If you mention share capital, it must be paid-up share capital. The regulations are made under section 82 of the Companies Act 2006.

Template (adapt the bracketed items):

[Registered company name] is a company registered in [England and Wales / Scotland / Northern Ireland]
under company number [12345678]. Registered office: [address].

Marketing email to individuals is governed separately by the Privacy and Electronic Communications Regulations (PECR), which require consent (or the "soft opt-in") and a way to opt out in every message (ICO: electronic mail marketing).

LLPs and other entity types have equivalent rules in the same regulations; regulated firms (for example, those authorised by the FCA or SRA) add their regulator's required wording.

European Union and GDPR

EU company law requires letters and order forms, "whether they are in paper form or use any other medium," to state the register where the company's file is kept and its registration number, the company's legal form and registered office, and, where relevant, that it is being wound up. If capital is mentioned, the subscribed and paid-up capital must be stated (Directive (EU) 2017/1132, Article 26). Each member state implements this in national law, which is why the exact list differs (see Germany and France below).

GDPR does not require an email disclaimer. People often add "GDPR footers," but the regulation's obligations are about processing, not footers. Two GDPR-adjacent points do affect signatures:

• When you collect personal data, you owe the person the information listed in GDPR Article 13 (identity of the controller, purposes, rights and so on). A short link in the signature to your privacy notice is a common, practical way to make that information easy to find; it does not by itself make processing lawful.
• Storing or accessing information on a recipient's device, for example with tracking pixels, falls under the ePrivacy Directive's consent rule (Directive 2002/58/EC, Article 5(3)) as implemented nationally. If your signature tool measures views with a pixel, have your DPO assess it for EU recipients.

Examples of GDPR-related signature wording are in our GDPR disclaimer examples.

Germany: Pflichtangaben (not the Impressum)

German law requires specific details on every business letter "gleichviel welcher Form" (in whatever form) addressed to a specific recipient, which covers business email:

• Registered merchants (Kaufleute): company name, the legal-form designation, place of business, register court and register number (HGB § 37a).
• GmbH: legal form and registered seat, register court and commercial register number, all managing directors (Geschäftsführer), and the chair of the supervisory board if there is one, each with surname and at least one full first name; if capital is mentioned, the share capital (GmbHG § 35a).
• AG: the same pattern with all management board members (the chair identified as such) and the supervisory board chair (AktG § 80).

Separately, email advertising without prior express consent, or that hides the sender or lacks a valid opt-out address, is an unreasonable nuisance under UWG § 7 (with a narrow exception for existing customers).

Two common mix-ups: the Impressum is a different obligation for digital services such as websites (DDG § 5, which replaced TMG § 5); it isn't the legal basis for email details. And the exemption in each law for routine communications "within an existing business relationship" on pre-printed forms is narrow; most companies apply the details to all external email.

[Firma] GmbH · Sitz: [Stadt] · Registergericht: Amtsgericht [Stadt], HRB [12345]
Geschäftsführer: [Vorname Nachname], [Vorname Nachname]
[Vorsitzender des Aufsichtsrats: Vorname Nachname]

France

French companies must show registration details on their commercial documents and correspondence. The Code de commerce (articles R123-237 and R123-238) requires items including the SIREN number, the mention "RCS" followed by the city of the registry where the company is registered, the registered office, and the company name with its legal form and share capital (Code de commerce, Légifrance; summary from the Paris commercial court registry). Check the current article text on Légifrance for your entity type before publishing.

[Dénomination sociale] – [forme juridique] au capital de [montant] € – Siège social : [adresse]
SIREN [123 456 789] – RCS [Ville]

Canada

Canada's anti-spam legislation (CASL) applies to commercial electronic messages: you need consent (express or implied), the message must identify the sender with a mailing address and a phone number, email address or web address, and it must include an unsubscribe mechanism that works (CRTC: CASL frequently asked questions). A signature with the company's mailing address and contact details covers the identification part for one-to-one commercial messages; unsubscribe and consent are handled in the message and your CRM.

Australia

• Corporations Act 2001, section 153: a company must set out its name and ACN (or an ABN that includes the ACN) on its public documents. ASIC's list of examples includes business letterhead, invoices and official notices (ASIC: Australian company number; Corporations Act 2001). ASIC's guidance doesn't list email as such, so many companies include name and ABN in the signature as the electronic equivalent of letterhead.
• Spam Act 2003: commercial electronic messages need consent, must clearly identify the authorizing sender and how to contact them, and must include a functional unsubscribe facility (Spam Act 2003, sections 16 to 18).

What do regulated industries add?

Law firms

• Privilege and confidentiality. A footer doesn't create attorney-client privilege; privilege depends on the communication itself. What footers do is put a mistaken recipient on notice. In the US, ABA Model Rule 4.4(b) requires a lawyer who receives a document or electronically stored information they know or reasonably should know was inadvertently sent to promptly notify the sender (ABA Model Rule 4.4); states adopt their own versions.
• Advertising rules. Emails that advertise legal services fall under the state's version of ABA Model Rule 7.2, which requires the name and contact information of at least one responsible lawyer or firm in such communications. Promotional banners in lawyers' signatures can trigger it.
• UK firms add their regulator's required statement (for example, SRA authorisation and number) as directed by their regulator.

Signature-block conventions for attorneys are in our attorney email signature guide.

Financial services

• Broker-dealers (FINRA): all retail communications and correspondence must prominently disclose the member firm's name (or the name on Form BD) and reflect any relationship with non-members named in the message (FINRA Rule 2210(d)(3)). Email is also subject to record retention under SEC Rule 17a-4; a signature doesn't satisfy retention, but your signature relay or add-in must not interfere with your archiving.
• Mortgage lenders: Regulation Z requires the NMLSR ID of the creditor and loan originator on specific loan documents (credit application, note, security instrument) (12 CFR 1026.36(g)). Many state regulators also require NMLS IDs in advertising and some correspondence; check each state where you're licensed.
• Banks: FDIC-insured banks must include the official advertising statement ("Member FDIC") in advertisements, subject to listed exceptions (12 CFR Part 328). Whether a given email, or a banner in a signature, counts as an advertisement is a question for your compliance team.

Scribe's finance documentation describes per-person fields for NMLS numbers, SEC and FINRA registrations and state insurance licenses, and firm-wide Equal Housing Lender or FDIC/NCUA statements (Scribe: email signatures for finance). More on advisor signatures in our financial advisor signature guide.

Healthcare (HIPAA)

HIPAA does not require an email disclaimer. What it requires is safeguards: covered entities and business associates must implement technical security measures against unauthorized access to electronic PHI being transmitted over a network (45 CFR 164.312(e)), and HHS has said providers may communicate with patients by email if they apply reasonable safeguards (HHS FAQ 570). A disclaimer is a useful notice, not a safeguard. Templates and the detail of what HIPAA does and doesn't cover are in our HIPAA email disclaimer guide.

If PHI could pass through a signature vendor (for example, with server-side routing, where outbound mail transits the vendor), ask whether the vendor will sign a business associate agreement before you deploy. For Scribe, confirm BAA availability with Scribe directly; the client-side add-ins don't route mail through Scribe's servers.

Which types of disclaimer exist, and what do they do?

Type	Purpose	Required?	Keep it to
Company identification	Statutory corporate details	Yes in UK, Germany, France, other EU states	2-3 lines
Regulatory statement	Regulator-mandated wording (FINRA, FDIC, SRA)	Sector-dependent	The exact required wording
Commercial email identification	Postal address, sender identity	For commercial messages (CAN-SPAM, CASL, Spam Act)	One line
Confidentiality	Instructions to a mistaken recipient	No	1-2 sentences
Privilege	Assert privilege for legal advice	No (privilege comes from the content)	1 sentence
No contract / authority	Clarify email doesn't form a contract	No	1 sentence
Monitoring	Tell recipients mail may be monitored or recorded	Check local employment and privacy law	1 sentence
Privacy notice link	Point to your GDPR Article 13 information	The notice is required; the link is good practice	One link

Copy-ready wording for confidentiality, privilege and no-contract notices is in the confidentiality disclaimer samples. Don't paste all of them; long legal blocks are skipped by readers and push useful content out of view.

Where should the disclaimer go, and should internal emails get it?

• Below the signature, in live text. Not an image: images are often blocked, aren't searchable, and fail accessibility checks. Use a smaller font, but keep it legible.
• External mail, always; internal mail, rarely. Statutory company details are aimed at third parties. Most companies drop the disclaimer on internal email to keep threads readable.
• Once per thread. If you use a server rule, add an exception so replies don't stack copies.
• Per legal entity. A group with UK, German and French subsidiaries needs a different identification block for each entity's employees, chosen by which entity employs the sender, not by where the recipient is.
• Language. Use the language of the jurisdiction whose law requires the text; add a translation if your recipients won't read it.

How do you add a disclaimer for every employee?

A disclaimer only protects you if it's on every email. Three ways to apply it centrally:

Method	Strengths	Limits
Microsoft 365 mail flow rule ("Apply disclaimers")	Free, applied in transit, works from any client	One block per rule, invisible to sender, fallback handling for encrypted mail; see the Microsoft 365 guide
Google Workspace Append footer	Free, per organizational unit, optional for internal mail	No per-user data, no raw HTML, up to 24 hours to apply; see the Google Workspace guide
Signature manager	Disclaimer is part of a designed signature, per-entity and per-person data, visible while composing, reporting	Paid; server-side routing needs IT setup

With Scribe, legal disclaimers are part of the signature editor on every plan (pricing). A few documented behaviors are relevant to compliance owners:

• One edit, firm-wide. Change the disclaimer in the template and the change is pushed to every assigned teammate; there's no window where some people have the old text (Install signatures).
• Per-person regulated fields. Licence and registration numbers live in Smart Fields, and a block whose field is empty is left out instead of printing a blank label (Smart Fields).
• Per-entity signatures. Assign each entity's signature by a Smart Field condition (for example, company or country from Entra ID or Google Workspace) with auto-assign for future hires (Assign teammates).
• Internal variant. An internal-email variant can drop the disclaimer on mail where every recipient is on the sender's domain. This works in Outlook and with server-side routing, not with the client-side Gmail install (Signature variants).
• Edits don't stick. If someone deletes the disclaimer locally, the approved version comes back on their next email (Scribe docs).

How do you keep disclaimers on mobile and third-party senders?

Client-side signatures depend on the email app. Gmail for Android and Apple Mail don't let a signature tool set the compose signature, so mail sent from them can go out without your disclaimer (Scribe: mobile). If a missing disclosure is a compliance risk, add server-side enforcement: a mail flow rule, Google's Append footer, or a signature relay. Scribe's finance documentation describes server-side installation as the way to apply disclaimers "even when an employee sends from an unsupported client or a personal device" (Scribe docs). The trade-offs are covered in client-side vs server-side signatures.

Mail sent by marketing platforms from their own servers never passes through your mail system, so it needs its own footer configured in that platform.

Who should own disclaimer wording?

1. Legal or compliance approves the text for each entity and sector, with the statute or rule it relies on.
2. IT owns enforcement: the rule, footer or signature tool, and which mail paths it covers.
3. Marketing owns the design, without editing the legal block.
4. Review at least yearly and on any trigger: a new entity, office move, director change (Germany), new licence, or a change in the rule.
5. Keep a change log with the date each version went live, so you can answer "what did this email say in March?"

Our company email signature policy guide includes a policy you can adapt.

Frequently asked questions

Is an email disclaimer legally required?

A generic confidentiality disclaimer isn't required by statute in the US, UK, EU, Canada or Australia. What is required in several countries is company identification on business correspondence, such as registered name, number and office in the UK, or Pflichtangaben in Germany, plus sender details and an unsubscribe in commercial email. This is general information, not legal advice.

Are email confidentiality disclaimers legally binding?

Generally not on their own. A notice added after an email has been sent to the wrong person can't make it confidential, and courts look at the circumstances. Disclaimers are still useful as instructions to a mistaken recipient. Copy-ready wording is in our confidentiality disclaimer samples.

What must a UK company include in its emails?

Its registered name, the part of the UK where it's registered, its registered number and its registered office address, under regulations 24 and 25 of the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015, which apply to documents in electronic form.

What are the Pflichtangaben for German business emails?

For a GmbH: legal form and registered seat, register court and commercial register number, all managing directors, and the supervisory board chair if there is one (GmbHG section 35a). Merchants follow HGB section 37a and stock corporations AktG section 80. The Impressum is a separate website obligation under DDG section 5.

Does GDPR require an email disclaimer?

No. GDPR requires you to give people the Article 13 information when you collect their data and to have a lawful basis for processing. A link to your privacy notice in the signature is a practical way to make that information easy to find. Tracking pixels in emails raise separate ePrivacy consent questions.

Does HIPAA require an email disclaimer?

No. HIPAA requires safeguards for electronic PHI, such as transmission security, and HHS allows emailing patients with reasonable safeguards. A disclaimer is a notice, not a safeguard. See our HIPAA email disclaimer guide.

Should disclaimers go on internal emails?

Usually not. Statutory company details and confidentiality notices are aimed at external recipients, and adding them to internal mail makes threads harder to read. Use your mail rule's external-recipient condition or an internal signature variant.

How do I add a disclaimer to every employee's email?

Use a central mechanism: an Exchange Online mail flow rule, Google Workspace's Append footer, or a signature manager that adds the disclaimer to every signature and, with server-side routing, enforces it on mail from any device.

Related Handbook guides

• Microsoft 365 and Exchange Online company-wide signatures
• Google Workspace company-wide signatures
• Client-side vs server-side email signatures