A certified email proves that a message was sent, received, and was not altered. But that does not mean the content is protected.
This distinction — seemingly technical — has very real legal and financial consequences under the General Data Protection Regulation (GDPR).
In this article, we analyse in depth what happens when a certified email is sent without encryption, when this is legally defensible, when it represents a serious risk for your business, and how platforms like Legalpin resolve this duality with solutions that combine probative value and real security.
What Is a Certified Email and What Does It Actually Guarantee?
Before addressing the risks, it is essential to understand what a certified email certifies and, above all, what it does not.
A certified email is an electronic delivery service that generates verifiable evidence about a message: who sent it, to whom, when, and that the content was not modified during transmission.
This evidence has legal probative value and can be presented in judicial or administrative proceedings.
The European legal framework governing these services is the EIDAS regulation, which defines registered electronic delivery as a service that:
- Transmits data electronically with proof of sending and receipt.
- Protects transmitted data against risks such as data-loss, theft or unauthorised alteration.
- In its qualified version, provides enhanced presumptions of integrity, identification of sender and recipient, and certified date and time.
What eIDAS does not automatically guarantee is the confidentiality of the content. Probative value and content security are two distinct dimensions, and confusing them is the most frequent mistake in the professional use of certified email.
Is It Legal to Send a Certified Email Without Encryption?
The answer is nuanced: it may be legally valid as evidence, but it may violate the GDPR if the content includes personal data and adequate security measures are not applied.
The eIDAS Perspective: Probative Value
From the eIDAS standpoint, a certified email can have full legal validity even if the content is not end-to-end encrypted, provided the service provider performs the certification correctly.
The regulation does not deny legal effect to a communication solely because it is electronic, and in its qualified version establishes presumptions that greatly facilitate its use as evidence.
The GDPR Perspective: Security of Processing
The GDPR, on the other hand, operates on a different level.
Its Article 32 obliges controllers to implement technical and organisational measures appropriate to the risk, expressly mentioning encryption and the ability to ensure confidentiality and integrity.
Recital 83 reinforces this requirement: risks must be evaluated and measures applied to mitigate them, including encryption, taking into account the state of the art and the nature of the data being processed.
The conclusion is clear: eIDAS and the GDPR do not replace each other — they complement each other. A system may comply with eIDAS as a probative tool and still violate the GDPR if it does not adequately protect the personal data in the message content.
The 6 Main GDPR Risks of Certified Email Without Encryption
1. Confusing Certification with Confidentiality
This is the foundational conceptual risk. Electronic certification focuses on evidence: who sent, to whom, when, and that the content arrived intact.
This does not equate to the content being protected against unauthorised access during transmission, in mailboxes, in backups, or in subsequent forwards.
An email can have perfect legal evidence and still be transmitted with no real protection of its content. For the GDPR, what matters is the second dimension: the confidentiality of personal data included in the message.
2. Vulnerabilities in Transport Encryption (Opportunistic TLS)
Many emails travel with TLS in transit, but in the SMTP protocol this may function as opportunistic STARTTLS: if the destination server does not support TLS or has a weak configuration, the message may end up travelling without encryption or with insufficient protection.
This matters especially when the certified email relies on traditional mail infrastructure for delivery. In that case, there are hops in the transport chain that the sender does not control.
A message may begin its journey with TLS and end up in plain text, without the sender knowing and without the send certification reflecting this.
3. Sending to the Wrong Recipient
One of the most frequent incidents in organisations is the accidental sending to the wrong recipient, particularly in environments with email address autocomplete.
Data protection authorities have identified this scenario as one of the most common real-world risks.
If the email content is not protected, an address error becomes directly a breach of personal data confidentiality, triggering the obligation to notify the supervisory authority and, depending on severity, the affected individuals themselves.
4. Compromise of Mailboxes and Storage
Email transit is only part of the problem. Messages are stored at multiple points: inboxes, local copies, backups, ticketing tools, historical archives.
If any of these points is compromised — through phishing, credential theft, or improper access by an administrator — the content is exposed.
The GDPR requires that security measures be proportionate to the risk. For communications containing sensitive data — medical documentation, financial data, legal information — the level of requirement is high. The compromise of a single mailbox may be equivalent to a data breach with serious consequences.
5. Metadata Is Also Personal Data
A frequently overlooked aspect: email metadata contains personal data.
Email addresses, the subject line, the list of recipients, technical headers, and exchange dates are data that identify people and situations.
Data protection authorities have repeatedly sanctioned the sending of mass emails where recipients could see each other because blind carbon copy (BCC) was not used.
Even without sensitive attachments, email can reveal significant personal information. In the context of certified email, the evidence generated — which is itself personal data — must be minimised and adequately protected.
6. Real Sanctions for Insecure Emails
Sanctions for sending personal data by email without adequate measures are real and documented.
A pharmacy was sanctioned for sending personal information by email without encryption.
Another company was sanctioned for sending access credentials by email without protection. Public bodies have been sanctioned for sending reports with sensitive data to incorrect recipients.
The pattern is consistent: regulators examine the type of data, the measures applied, the alternatives available, and whether the risk was foreseeable.
Not every unencrypted email communication results in a fine, but when data is sensitive and no adequate controls were applied, responsibility is clear.
How Email Infrastructure Actually Works
To understand the technical risk, it is necessary to understand that email was designed in the 1970s without security in mind. A typical message follows this flow:
- Sender’s client → 2. Sender’s SMTP server → 3. Intermediate routing servers → 4. Recipient’s SMTP server → 5. Recipient’s client
At each of these points, the message may be processed, temporarily stored, and potentially read.
An email can pass through between 2 and 6 different servers before reaching its destination, and at each one a copy accessible to system administrators or attackers with access may exist.
Transport TLS vs. Real Content Encryption
TLS protects the transmission channel, not the content.
The message is decrypted at each server that processes it. When talking about real content encryption, we refer to systems like PGP or S/MIME, where the message is encrypted before leaving the client using the recipient’s public key.
No intermediate server can read the content.
Without this type of content encryption, email is technically vulnerable at multiple points in its lifecycle, regardless of whether a send certification exists.
When Is It Defensible and When Is It a Serious Risk?
Scenarios Where It May Be Defensible
Using certified email without end-to-end encryption may be reasonably defensible when the following conditions are met:
- Data is low risk: operational communications with no sensitive information, notices that do not reveal significant personal content.
- Minimisation is applied: neutral subject line, minimal content, attachments avoided or anonymised, similar to the approach commonly recommended when implementing Certified email software for property managers.
- Additional technical measures exist: forced TLS where the platform allows, DMARC/SPF/DKIM, forward controls, multi-factor authentication on accounts.
- Organisational measures are in place: double recipient verification procedures, staff training, send records.
Even in these cases, it is advisable to document a risk assessment aligned with Article 32 of the GDPR in order to demonstrate the organisation’s proactive accountability.
High GDPR Risk Scenarios
Using certified email without encryption is clearly problematic when the content includes:
- Special categories of data: health, biometrics, religion, sexual orientation, etc.
- Sensitive legal documentation: complaints, judicial files, situations of vulnerability.
- Credentials or information enabling fraud: passwords, banking data, identity documents.
- Large volumes or recurring sends: the probability of an incident increases with frequency.
In these scenarios, data protection authorities clearly push towards real content encryption and the adoption of safer alternative channels.
The Privacy by Design Principle Applied to Email
One of the fundamental principles of the GDPR is privacy by design and by default.
This principle requires that data protection be integrated from the design phase of processes and systems, not added as an afterthought.
In the context of email, this principle raises questions every organisation should ask itself:
- Is email the appropriate channel for sending this information?
- Has a more secure alternative been evaluated before opting for email?
- What controls exist to prevent human error or improper access?
When an organisation continues to use standard email for sensitive communications without evaluating alternatives, it may be considered that it is not correctly applying the privacy by design principle.
This principle does not only protect the individuals whose data is being processed; it also protects the organisation itself in the event of an incident.
Proactive Accountability: Proving You Managed the Risk
The GDPR does not only require compliance; it requires being able to demonstrate that you have complied. This principle of proactive accountability implies documenting:
- Risk assessment of the communication channel used.
- Internal policies on sending personal data by email.
- Staff training in the secure handling of data.
- Technical measures implemented and their justification (decision making)
If an incident occurs and the organisation cannot demonstrate that it assessed the risk before sending the email, its legal position is significantly weaker. Documentation of the decision-making process is as important as the decision itself.
Safer Alternatives That Maintain Probative Value
If you need to combine legal proof of communication with real content protection, there are alternatives that resolve this duality:
1. Secure Portal with Email Notification
The email only notifies that a communication is available.
The content is accessed on a secure portal with authentication.
This model eliminates the direct sending of sensitive documents by email, while maintaining access and reading traceability.
2. Encrypted Attachments with Password Sent via a Separate Channel
Documents are encrypted before sending.
The recipient receives the encrypted file by email and the password via a completely different channel (phone call, secure SMS, password manager), a practice that can also complement tools such as certified SMS software for management firms.
Note: sending the password in a second email to the same mailbox adds no real protection if that mailbox is compromised.
3. Qualified Registered Electronic Delivery with Secure Architecture
Platforms like Legalpin offer an architecture that does not rely on open email for content, while maintaining eIDAS evidence.
This means you can have maximum probative value under European legislation and, at the same time, real confidentiality of content through integrated encryption.
Legalpin: Where Legal Value and Real Security Meet
At Legalpin, we understand that certified email cannot be merely a probative tool. In a professional environment where the GDPR is enforceable and sanctions are real, content security is as important as proof of sending.
That is why our platform combines:
- Certified email with probative value equivalent to a digital registered letter, with verifiable evidence of sending, receipt and content.
- Advanced encryption that protects content throughout its entire lifecycle: transmission, storage and subsequent access.
- Probative custody in the cloud with encrypted folders and complete traceability, available for audits or legal proceedings.
- Advanced electronic signature under the eIDAS regulation, with integrated digital identity verification.
- Simple integration via public API or directly from your usual email client, with no additional software required.
The result is a tool that meets both demands of the current regulatory environment: that of eIDAS (legal proof of communication) and that of the GDPR (real protection of personal data).
Because certified email serves to prove facts — sending, receipt, integrity —, but the GDPR requires you to protect people, particularly in scenarios such as debt recovery where organisations rely on solutions like certified Email Software for managing unpaid debts. With Legalpin, you can do both at the same time.
Conclusion: Two Legal Frameworks That Complement, Not Replace, Each Other
Certified email without encryption may be legally valid from a probative standpoint under eIDAS. But its use raises real risks under the GDPR when the content includes personal data and adequate security measures are not applied.
The key is not to choose between probative value and content security. The key is to demand both simultaneously, as qualified registered electronic delivery solutions with integrated encryption architecture allow.
The trend in regulatory compliance is clear: reduce the use of traditional email to transmit sensitive data and replace it with secure communication systems with authentication, integrated encryption, and complete traceability.
Not as a limitation, but as the smartest way to operate in a digital environment where trust, security and legal validity are inseparable.
Want to know how Legalpin can help you certify your business communications with full legal certainty and complete GDPR protection? Contact our technical and legal support team, available 24/7.
