GDPR and Email Signatures: Disclaimers, Tracking Pixels and Employee Data (2026)

TL;DR: GDPR doesn't require an email signature or a "GDPR disclaimer". What it does touch is narrower and more practical: the signature is a convenient place to link your privacy notice; the employee data it displays (names, photos, mobile numbers, pronouns) needs a lawful basis and should be minimized; and view or click tracking in signatures is covered by the ePrivacy consent rule, which the EDPB has confirmed applies to tracking pixels and tracking links in email, and which France's CNIL detailed for email pixels in April 2026. Finally, a signature vendor is a processor, so you need a data processing agreement and a view of its subprocessors.

Last reviewed: October 2026.

This is general information, not legal advice. Data protection rules apply differently by member state, sector and relationship with the recipient; confirm requirements for your jurisdiction with your DPO or counsel. Article references are to the GDPR (Regulation (EU) 2016/679) unless stated otherwise.

Search for "GDPR email signature" and you'll find long footers asserting that "this email is GDPR compliant". They don't do anything. This guide separates what GDPR and the ePrivacy rules actually ask of email signatures from what's folklore, for the IT, marketing and privacy teams who run company-wide signatures for EU and UK staff and recipients. Company registration details that EU and UK law require on business correspondence are a separate, company-law obligation, covered in the email disclaimers guide.

Does GDPR require an email signature or disclaimer?

No. Nothing in the GDPR requires a signature, a footer or a disclaimer. Three obligations are often confused with one:

• Transparency (Articles 13 and 14). When you collect someone's personal data, you must give them specific information: who the controller is, the purposes and legal basis, recipients, retention, their rights and so on. A one-line link to your privacy notice in the signature is a practical way to make that information easy to reach when the email is the first contact. The link doesn't make processing lawful; it just points to the notice.
• Company identification. EU company law requires letters and order forms in any medium to show the company's register, registration number, legal form and registered office (Directive (EU) 2017/1132, Article 26), and national laws such as Germany's Pflichtangaben implement and extend it. That's company law, not GDPR.
• Marketing consent. Rules on unsolicited electronic marketing come from the ePrivacy Directive and national laws (for example PECR in the UK), not the GDPR, and they govern the message, not the signature.

A confidentiality notice asking a mistaken recipient to delete the email is fine to include, but it isn't a GDPR requirement and it doesn't cure a misdirected email. If personal data goes to the wrong person, that may be a personal data breach you have to assess under Article 33 regardless of the footer.

GDPR wording for email signatures: short templates

Keep it short. One or two lines that point to the right place are more useful than a paragraph nobody reads. Replace the bracketed items.

Privacy notice link (most organizations):

How we use personal data: [company.com/privacy]

Privacy notice plus DPO contact (organizations that must appoint a DPO, Article 37):

[Company] processes personal data as described at [company.com/privacy].
Data protection officer: [dpo@company.com]

First-contact email to a prospect or candidate (where you obtained their details from another source, Article 14):

We contacted you using details from [source]. To see how we use them, or to ask us
to stop, visit [company.com/privacy] or reply to this email.

Signature tracking notice (only if you keep tracking on and your assessment supports it):

Links and images in this signature may record when they are viewed or clicked.
Details and how to object: [company.com/privacy#email]

Whatever you choose, put it in live text, apply it centrally, keep it out of internal email, and don't add claims such as "this email is GDPR compliant", which have no legal effect. For confidentiality wording that sits next to these lines, see our confidentiality disclaimer samples.

Employee personal data in signatures

A signature is a public display of employee personal data. A name, job title, work phone and work email are personal data (Article 4(1)) like any other, and so are a photo, a mobile number or pronouns. The GDPR questions are lawful basis, minimization and transparency to staff.

Which lawful basis applies?

• Core business contact details (name, title, work phone, work email, office): most employers rely on legitimate interests (Article 6(1)(f)) or on what's necessary for the employment contract, because identifying who's writing is part of the job. Record the assessment.
• Optional details (photo, personal mobile number, pronouns, social profiles): make them optional and controlled by the employee. Consent is a weak basis in employment: the EDPB notes that the imbalance of power between employer and employee means consent will rarely be freely given (EDPB Guidelines 05/2020 on consent). In practice, "optional, opt-in, removable at any time, no consequence for saying no" is the safer design whatever basis you document.
• National employment rules. Article 88 lets member states set more specific rules for employee data, so check local law and any works agreement.

Minimize what you sync

Signature tools usually import more from the directory than a signature shows. Scribe, for example, documents that its Microsoft Entra ID connection stores profile picture, first and last name, job position, mobile, work and fax numbers, department, office, street address, groups and administrative units (Scribe: Entra ID data collected), and that you can choose which data to sync beyond the mandatory email, first name, last name and job position (Scribe: how Scribe tracks and stores data). Data minimization (Article 5(1)(c)) means mapping only the fields your templates use, and not pulling photos or mobile numbers into the tool if no template shows them. See Entra ID attributes and HRIS-driven signatures.

Per-employee analytics and works councils

Signature analytics often rank employees. Scribe's analytics, for example, include a Teammates tab and "top 5 teammates" leaderboards by views and clicks (Scribe: Analytics overview). In Germany, the works council has a right of co-determination over the introduction and use of technical systems designed to monitor employee behavior or performance (BetrVG § 87(1) no. 6), and German courts read "designed to" broadly as "objectively suitable for". Similar consultation duties exist elsewhere. Involve employee representatives before switching on per-teammate reporting, or limit reports to signature and campaign level.

Personalized links send employee data to other tools

Adding teammate details to links (for example a UTM parameter carrying the sender's full name, or a booking link with the sender's email) sends that data to whatever analytics, CRM or scheduling tool receives the click (Scribe: personalize links). Prefer an employee ID or team name over a full name in analytics parameters, and make sure the receiving tools are covered by your records of processing.

View and click tracking in signatures under GDPR and ePrivacy

This is the part of signature management where the law is most specific and most often ignored.

The ePrivacy consent rule applies to email pixels and tracking links

Article 5(3) of the ePrivacy Directive requires consent for storing information, or gaining access to information already stored, on a user's terminal equipment, unless it's strictly necessary for a service the user requested (Directive 2002/58/EC). The EDPB's guidelines on the technical scope of that article address email directly: a sender "may include a tracking pixel to detect when the receiver reads the email"; tracking links work the same way; distributing them to the recipient's device counts as storage, "at the very least through the caching mechanism"; and collecting the identifiers counts as gaining access, so Article 5(3) applies (EDPB Guidelines 2/2023, version 2.0, paragraphs 47 to 51). The guidelines also note that a pixel can be built by adding tracking information to an image that's part of the content, which in a signature could be the logo or a banner.

Where consent is required, the GDPR standard for consent applies, and the data collected is personal data subject to the GDPR as a whole.

National positions: France and the UK

• France. The CNIL published its final recommendation on tracking pixels in email on 14 April 2026, setting out when consent is needed under article 82 of the French Data Protection Act and recognizing a narrow exemption for measuring deliverability of emails linked to a service the recipient requested; for addresses collected before publication, it gave senders three months to inform recipients and let them object (CNIL: pixels de suivi dans les courriels). The recommendation is framed around email campaigns; it doesn't specifically discuss signatures on one-to-one email, so ask your DPO how it applies to yours.
• United Kingdom. The ICO's guidance gives email tracking pixels as an example of a technology covered by PECR regulation 6, alongside the marketing rules in regulation 22, and describes exceptions including a "statistical purposes" exception where users must be able to object (ICO: storage and access technologies). Its examples of statistical use are about analytics for your own service, such as a website; whether counting signature views on correspondence fits that exception is not settled.

What Scribe documents about its tracking

• Tracking of signature openings and clicks starts when you install signatures, and you can opt out in workspace settings (Scribe: how Scribe tracks and stores data).
• For each view or click Scribe records an anonymized IP address, the country determined from the IP before anonymization, the email client and version, and the device type. Tracking data is kept for 30 days on the free plan and 1 year on paid plans (same source). Its conversion tracking page describes the IP as hashed before storage (Scribe: conversion tracking); note that under the GDPR a hashed identifier is usually pseudonymized rather than anonymized data.
• Scribe describes its built-in tracking as measuring views and clicks "per signature, link, and recipient" (Scribe: personalize links), and its plans page describes domain verification as using your own domain for signature links instead of Scribe's default domain (Scribe: Plans).
• For website conversion tracking, Scribe tells customers to get the consent their region requires before enabling tracking, and its SDK can hold back storage until a visitor consents (Scribe: conversion tracking).
• Scribe's public documentation doesn't describe exactly how views are detected (for example, which image request is counted), and describes only the workspace-wide opt-out, not a per-region or per-signature switch.

Practical options

1. Off for EU and UK staff and recipients unless your DPO has documented a basis. This is the simplest defensible position for one-to-one business email.
2. Separate workspaces by region, with tracking off where your assessment requires it, if your tool allows splitting the directory that way.
3. Use your own analytics instead: plain links with non-personal UTM parameters, measured by your consent-managed web analytics when the recipient lands on your site. You lose open counts but keep campaign attribution. See banner campaigns.

Vendor checklist: DPA, subprocessors, transfers and deletion

A signature service processes employee directory data and, with server-side routing, the content of outbound email, on your behalf. That makes it a processor, and Article 28 applies.

Check	GDPR basis	What Scribe publishes
Data processing agreement	Article 28(3)	A DPA customers can request and sign; listed as a document in the Trust Center (Scribe: GDPR; Trust Center)
Subprocessor list and changes	Article 28(2) and (4)	Subprocessor list with purpose and location in the Trust Center (26 listed in October 2026, including AWS); all said to have signed DPAs (Scribe: subprocessors)
International transfers	Chapter V (Articles 44 to 46)	Not stated in the help center; check each subprocessor's location and transfer mechanism in the Trust Center and DPA
Data protection officer	Articles 37 to 39	DPO reachable at privacy@scribe-mail.com (Scribe: data subject requests)
Security of processing	Article 32	SOC 2 Type II; encryption in transit (Scribe: product security)
Retention and deletion	Article 5(1)(e), Article 28(3)(g)	Tracking data 30 days (free) or 1 year (paid); workspace data kept until deletion or 6 months of inactivity; a deleted workspace is removed within a few hours (Scribe: delete workspace data)
Email content on the relay (server-side)	Articles 28 and 32	Recipients, subject, attachments and body are passed through unchanged, and Scribe states it "cannot read or edit your emails" (Scribe: Microsoft 365 server-side); retention on the relay isn't documented

Also add the signature tool to your records of processing (Article 30), and consider whether a data protection impact assessment is needed (Article 35) if you enable per-recipient tracking at scale or per-employee performance reporting. Scribe is operated by Scribe SAS, a French company, according to its Trust Center; ask Scribe to confirm where the signature service and the server-side relay are hosted if data residency matters to you. For the architecture trade-offs, see client-side vs server-side signatures.

Handling data subject requests about signatures

• From employees: access and rectification requests about signature data are usually answered from the directory or HRIS, because that's where the signature reads from. Fix the source and the signature follows.
• From recipients: if you track views or clicks, a recipient can ask what you hold about them. Know where the tracking data lives (the vendor's dashboard), how long it's kept, and how to export or delete it. Scribe documents a data subject request form and DPO contact (Scribe: data subject requests).
• Objections to tracking: if you rely on an exception or legitimate interests, you need a way to honor an objection. A workspace-wide switch is coarse; ask your vendor how per-recipient objections would be handled.

Put the decisions in your email signature policy so they survive staff changes.

Frequently asked questions

Is a GDPR disclaimer required in email signatures?

No. The GDPR requires you to give people privacy information when you collect their data (Articles 13 and 14), not to add a footer. A link to your privacy notice in the signature is a practical way to make that information easy to find. This is general information, not legal advice.

Are email signatures personal data under GDPR?

Yes. An employee's name, title, work phone and email are personal data, and so are photos, mobile numbers and pronouns. Employers usually rely on legitimate interests or the employment contract for core contact details and keep optional details opt-in and employee-controlled.

Do email signature tracking pixels need consent under GDPR?

Often, yes. The EDPB's Guidelines 2/2023 confirm that the ePrivacy consent rule in Article 5(3) applies to tracking pixels and tracking links in email, and France's CNIL published a recommendation on email pixels in April 2026. Exceptions are narrow; ask your DPO before enabling signature view tracking for EU or UK recipients.

Can I turn off signature tracking in Scribe?

Yes. Scribe documents that tracking of signature openings and clicks starts on install and can be switched off in workspace settings. The documentation describes a workspace-wide setting, not per-region or per-signature controls.

Do I need a DPA with my email signature provider?

Yes. A signature service processes your employees' directory data, and with server-side routing your outbound email, on your behalf, which makes it a processor under Article 28. Scribe offers a DPA customers can request and sign, and lists its subprocessors in its Trust Center.

Should employee photos be in email signatures?

Only if the employee chooses. Make photos optional, let employees remove them at any time, and don't sync photos into the signature tool if no template uses them. Consent from employees is rarely freely given, so design the feature so that saying no has no consequences.

What should a GDPR-friendly signature include?

Name, title, work contact details, the company identification your national company law requires, and a one-line link to your privacy notice. Leave out long "GDPR compliant" statements, which have no legal effect.

Related Handbook guides

• Email disclaimers: legal requirements by country and industry
• Email signature policy template
• Email signature banner campaigns
• Client-side vs server-side email signatures
• HIPAA and email signatures for healthcare