AI email and the GDPR, what to check before you buy

What each vendor actually publishes

Two patterns are worth noticing. A vendor can publish an impeccable DPA and still process everything in the United States, which is Superhuman. And a vendor can be domiciled in the EU and still refuse to name its sub-processors, which is Spark: its DPA states that the full list is not made publicly available.

What a DPA must actually say

Article 28(3) of the GDPR is not optional and it is short enough to check against a draft yourself. The contract must bind the processor to: process only on your documented instructions, including on transfers; impose confidentiality on its staff; apply the security measures of Article 32; respect the conditions for engaging sub-processors; assist you with data subject requests; assist you with Articles 32 to 36, which includes breach notification and impact assessments; delete or return the data when the service ends; and make available the information you need to demonstrate compliance, including allowing audits.

Article 28(2) is the one vendors most often fudge. A processor may not engage another processor without your prior written authorisation, and under a general authorisation it must notify you of intended changes so you can object. In practice that means a named, dated sub-processor list with a notice period. Spark's DPA gives 10 days' notice with a 5 day objection window but no public list. Front and Hiver publish dated lists. Shortwave publishes neither, which makes Article 28(2) unverifiable.

If a vendor says the DPA is available on request, that is acceptable, but read it before the trial ends, not after the rollout.

Where the data sits, and what makes the transfer lawful

If the processing chain leaves the EEA you need a transfer mechanism under Chapter V of the GDPR. In this market you will see two: the EU-US Data Privacy Framework, which only covers US entities that are actually certified under it, and standard contractual clauses. Superhuman names both. HEY uses SCCs and also invokes Article 49(1)(b). Fyxer names SCCs, the UK addendum and DPF membership for its non-EEA providers.

Naming a mechanism is not the end of the analysis. You still need to document why the transfer is defensible given the recipient's legal environment, which is the transfer impact assessment, and you need to know that your sub-processors are covered too. The shortest path out of this work is not to transfer: an EU-only chain, or a tool that does not transmit the body at all.

Be precise about EU hosting claims. Front offers a selectable EU region and ties the AI sub-processor location to it. Fyxer hosts in Belgium and the Netherlands by default but is a UK controller. Microsoft commits to the EU Data Boundary for tenants that signed up in the EU or EFTA, with stated exceptions, and explicitly excludes Multi-Geo tenants. Google's EU data regions and Assured Controls are Enterprise features, not Business.

The training clause nobody reads

A European supplier is not automatically a safe default. Mistral AI's own Data Processing Agreement, effective 27 July 2026, authorises Mistral to process personal data as a controller for the purpose of training its models unless the customer opts out, and says feedback given through thumbs up or down will be used for training. A vendor that calls Mistral for you should be able to show that it has opted out, which is what BoxBee's privacy policy claims when it says the contract with Mistral guarantees no retention and no training.

Retention is the other clause to read. Missive's documentation notes that OpenAI and Anthropic may retain API data for up to 30 days for abuse monitoring. Spark states that providers may retain inputs for at most 30 days and that your data trains no model. Google states that Gemini content is not human reviewed or used for training outside your domain without permission. Each of those is a different promise, and only one of them is zero retention.

What a works council will ask

In Germany, section 87(1) number 6 of the Betriebsverfassungsgesetz gives the works council co-determination over the introduction and use of technical devices intended to monitor employee conduct or performance. An AI tool that classifies, scores and reports on mail traffic is a plausible candidate, so the question is not whether you will consult, it is whether you prepared for it. Expect to be asked: what categories does the model assign, who can see them, is there any reporting on response times per employee, can the feature be switched off per user, and what happens to the labels when someone leaves.

A CNPD-minded operator in Luxembourg will ask the same questions in a different order, starting from the record of processing: name every processor and sub-processor, state the legal basis, state the retention period for the labels and summaries the tool creates, and explain why reading the body is necessary rather than merely convenient. Article 5(1)(c), data minimisation, is the uncomfortable one here, because the honest answer for most of these tools is that the whole body is sent when a subject line would often do.

If you are systematically analysing employee communications, assume you need a data protection impact assessment under Article 35 and write it before the rollout rather than after a complaint.

Ten questions to send a vendor before you buy

1. Which company processes the message body, and in which country?
2. Is the body stored by you, or only passed through?
3. Give me the current sub-processor list, with locations and purposes.
4. Which model providers see mail content, and have you opted out of their training?
5. What is the retention period at each provider in the chain?
6. Can I sign your DPA today, and does it mirror Article 28(3)?
7. Is there an EU-only option, and does it cover the AI calls or only storage?
8. Which transfer mechanism applies, and for which recipients?
9. Can features that read the body be disabled per user?
10. What happens to labels, summaries and embeddings when we cancel?

A vendor that answers all ten in writing within a week is telling you something useful. So is one that does not.

For how each product scores on these points, see our ranking of AI email clients and the team tools comparison. Vendors who want their documentation assessed can get listed.