Email verification and privacy laws: POPIA, GDPR and what to keep in mind

An email address that identifies a person is personal information. Checking it with a verification service is "processing" that information, so the privacy laws that apply to your list apply to verification too. This article is a general overview, not legal advice; if you are unsure about your own situation, ask a qualified professional.

The main laws people ask about

• POPIA (Protection of Personal Information Act) in South Africa
• GDPR in the European Union and the UK's equivalent
• CAN-SPAM in the United States
• CASL in Canada

They differ in detail, but share several ideas that affect how you handle a list.

Common principles

A lawful basis for contacting people. In many regimes this means consent, or an existing relationship plus a clear way to opt out. Cleaning a list doesn't create consent. Mailing a bought list is risky in most places whether or not the addresses are valid.

Purpose limitation. Use the data for the purpose people gave it. Verifying addresses to avoid sending to dead mailboxes fits comfortably within running a mailing list you are entitled to run.

Minimisation. Send a verification service only what it needs. For checking an address, that is the address itself, not names, phone numbers and purchase history. Strip other columns from a file before uploading if you can.

Security. Choose providers that protect uploaded data, and keep your own copies safe.

Retention. Don't keep data longer than needed. Ask any provider how long they keep uploaded lists and whether you can have them deleted.

Rights of the person. People can usually ask what you hold, ask you to correct or delete it, and object to marketing. Suppression lists need to survive imports so a removed person isn't re-added.

Checking a verification provider

Before uploading a list anywhere, look for:

• a privacy policy that says what is collected, why, and for how long
• whether they use your data for anything other than giving you the result
• where data is stored and who else can access it
• how to request deletion

You can read Mailsure's in our privacy policy.

What verification does not do

It doesn't prove consent, and it doesn't make an unlawful list lawful. It reduces bounces and waste on a list you already have good reason to use. Pair it with clear signup wording, a visible unsubscribe link and, where appropriate, double opt-in.

Keep records

Note when and how each address was collected and what the person agreed to. If anyone ever asks, that record is your answer.