Is a business email address personal information?

Which email addresses count as personal information?#

Email addresses count as personal information when they relate to an identified or identifiable person, and the business setting does not change that. The address type is the quickest guide, but the real test is whether someone could work out who is behind it.

Domains alone are a gray area. A large customer's domain usually identifies a company, not a person, but a small firm's domain can point to a handful of people. Many teams replace customer domains with a category, such as customer domain or internal domain, which keeps the routing signal without naming anyone.

How GDPR treats work email addresses#

GDPR treats a work email address that identifies a person as personal data, with no carve-out for professional contact details. The regulation protects natural persons in every role, so an employee's address at a supplier is covered just as a consumer's would be. Information about a company itself, such as its name or a shared company inbox, is not personal data, which is why role inboxes usually fall outside it.

That matters for US companies with European customers, staff or suppliers in their records. Even where a company relied on legitimate interests to email B2B contacts, licensing those records to a third party for AI training is a different purpose, and the analysis starts again. Whether GDPR reaches a given archive is a question for counsel.

How US state privacy laws treat work emails#

US state privacy laws split on work emails: California generally treats them as personal information, while most other comprehensive state laws exclude people acting in a commercial or employment context. California's temporary exemptions for business-to-business and employee information expired on January 1, 2023, after the legislature ended its 2022 session without extending them, so B2B contacts and employees are covered consumers there. Virginia's law, by contrast, generally does not apply to people acting in a commercial or employment context and has no sunset on that exclusion, and Colorado's attorney general describes the Colorado Privacy Act the same way.

The exclusions in other states narrow whose data a law protects. They do not erase contractual confidentiality, customer data processing agreements or the promises in your own privacy notice. A distributor whose notice says contact details are used only to manage accounts should read that promise before licensing CRM history, whatever a particular state law says.

Where business email addresses hide in operational records#

Business email addresses hide in far more places than the contact field, which is why a scan of the email column alone misses most of them.

Signatures and quoted chains cause the most misses in practice, because they sit inside free text and repeat across a thread. Strip signature blocks and quoted history first, then run detection on the message body itself.

• 1Helpdesk requester, CC and follower fields in Zendesk, Freshdesk or Intercom.
• 2Quoted reply chains and forwarded headers inside ticket and email bodies.
• 3Signature blocks with name, title, direct line and email.
• 4CRM contact, lead and activity records in Salesforce or HubSpot, including logged emails.
• 5Calendar invites and meeting notes that list attendees.
• 6Git commit author and committer metadata, and code review comments that mention people.
• 7Jira and Linear assignee, reporter and watcher fields.
• 8Attachments such as invoices, purchase orders, submittals and scanned forms.

How to treat work emails in a licensed dataset#

Work emails in a licensed dataset are usually replaced rather than simply deleted, so the record still shows who wrote to whom in role terms. A typed tag or a consistent token keeps the conversation readable for a buyer without exposing anyone.

Illustrative: an engineering firm's RFI email archive#

Illustrative: a fictional civil engineering firm wants to license years of RFI and submittal correspondence stored in Outlook and Procore. The threads involve architects, general contractors, owners' representatives and the firm's own project engineers.

The privacy review classifies every address in the archive. Named addresses at contractors and owners become role tokens such as GC_PM_1 and OWNER_REP_1. Shared inboxes such as submittals@ and rfis@ stay, because they show how documents were routed. Signature blocks and direct phone numbers are removed, and outside domains become labels such as contractor domain.

The outcome: the buyer sees a complete question-and-answer chain between roles, and the firm can show its general counsel a table of exactly which address types were kept, replaced or removed.

How SourceX handles contact details#

SourceX classifies contact details during the Preparation step of the SourceX five-step transaction, after the Rights step has confirmed which records may be licensed at all. The supplier sees the proposed treatment for each address type and approves it before anything is prepared for delivery.

The treatment is written into the privacy record of the SourceX Evidence Packet, so the buyer and the supplier share one account of which addresses were removed, which were replaced and why.