GDPR and Fax: What the Rules Allow

The GDPR does not ban fax. It does require that personal data be sent with security that fits the risk, and several European data protection authorities now say that ordinary fax does not meet that bar for sensitive data. Whether a given fax is compliant depends on what you send, who receives it, and how the transmission is protected.

This guide explains what the regulation says, what regulators have said about fax, how the US approach differs, and what to check before you fax anything that contains personal information.

TL;DR

• The GDPR is technology-neutral. No article names fax as prohibited, but Article 32 requires security appropriate to the risk.
• German state regulators in Bremen, Hesse and North Rhine-Westphalia no longer treat unencrypted fax as a safe channel for sensitive data.
• The main risk is the recipient’s end: you often cannot know whether your fax lands on a machine, in an email inbox or in cloud storage.
• The US has no single GDPR equivalent. HIPAA, GLBA and state laws apply by sector and by location.
• For low-risk documents, a fax with delivery confirmation and a verified number is usually reasonable. For health, financial or other special-category data going to the EU, use an encrypted channel or confirm the recipient’s setup first.

What the GDPR actually says about fax

The regulation applies to personal data: any information that relates to an identifiable person. A name and address on a form qualifies. So does a medical record, a tax number or a signed contract. When you send any of these by fax, you are processing personal data, and the GDPR applies if you or the recipient fall within its scope.

There is no rule saying “fax is illegal.” The relevant requirements are general:

• Integrity and confidentiality. Personal data must be handled in a way that protects it against unauthorized access and accidental loss (Article 5).
• Security of processing. Under Article 32, the sender must take measures that fit the state of the art, the cost, and the risk to the people whose data is involved. Encryption is named as one example of such a measure.
• Accountability. You must be able to show that you chose a reasonable method.

Because the standard is risk-based, the same channel can be acceptable for one document and unacceptable for another. A fax confirming a meeting time carries little risk. A fax containing diagnosis details carries a lot.

Why European regulators are skeptical of fax

A fax once felt private: a direct line from one machine to another. That is rarely how it works now. Most phone lines have moved to internet telephony, and many recipients use fax services that turn incoming pages into digital files.

The Bremen data protection commissioner says that fax used to count as a relatively safe method for sensitive personal data, but that this has fundamentally changed. The core problem is the other side: the sender often does not know how the fax is received or where it ends up.

Other regulators agree:

• The North Rhine-Westphalia authority states that fax can no longer be considered an unrestrictedly secure means of communication for data protection purposes.
• The Hesse authority notes that fax remains widespread among public bodies, courts, lawyers and healthcare, yet is now technically insecure because of changes in the underlying technology.
• The Thuringia authority’s 2024 press release points to encrypted email attachments or built-in end-to-end encryption as better options for sensitive data.

These are German state regulators, not a ruling that binds every EU country. They are still a useful signal of how supervisory authorities read Articles 5 and 32. Commentary from a security vendor also notes that courts and authorities treat the combination of fax and sensitive data as a legal risk, because current secure alternatives are widely available.

The unknown destination

The sharpest point is accountability. Suppose you fax a document to an EU clinic. Your transmission may be encrypted from your side. The clinic’s system may then convert the page to a PDF and forward it to a shared mailbox. You cannot see that step, and you cannot show that the data stayed protected. The GDPR expects you to know how personal data is processed. Fax makes that hard.

Misdirected faxes

The other practical risk is a wrong number. A single mistyped digit sends a document to a stranger. Under the GDPR that can be a personal data breach, which may carry a notification duty to the supervisory authority. Check the specific obligations with your data protection officer or counsel, because they depend on the risk to the people affected.

Is fax GDPR compliant? A practical way to decide

Instead of asking whether fax is allowed, ask what the document contains and what could go wrong.

Health data is the clearest example. The GDPR treats it as a special category of personal data that needs stronger justification and stronger protection. If the data subject is in the EU and the recipient has not confirmed how faxes are handled, treat the fax as a risk to be reduced, not a default.

Safeguards that reduce the risk

No checklist makes fax risk-free. These steps make your choice easier to defend.

1. Verify the number. Call the recipient or check an official source before sending. Confirm digit by digit.
2. Send a small test page when the document is sensitive and the number is new, then ask for confirmation of receipt.
3. Ask how faxes are received. A machine in a locked room is different from a fax-to-email gateway. If it is a gateway, ask whether the mailbox is encrypted and who has access.
4. Use a cover page with a confidentiality statement. It does not create security, but it tells a misdirected recipient what to do. See these three ready-to-use confidentiality statements.
5. Send only what is needed. Data minimization is a GDPR principle. Redact fields the recipient does not need.
6. Keep proof of delivery. A confirmation record helps you demonstrate that you took reasonable care.
7. Choose a sending method with transport encryption. Check how the provider protects the connection. Our guide to encrypted online fax and what to check covers TLS and related points.
8. Use the language the recipient needs. If your cover notice or instructions go to a recipient in another EU country, a clear translation avoids confusion about what to do with a misdirected page. A GDPR translation checklist can help you plan that.

For a wider look at how fax compares with email on security, read fax vs email for sensitive documents.

When fax is still the right tool

Some recipients leave you no choice. Courts, government offices, insurers, labs and medical practices in many countries still accept documents mainly or only by fax. In those cases, refusing to fax can be worse than faxing carefully.

The approach that holds up:

• Record why fax was necessary (the recipient requires it, or deadlines leave no alternative).
• Apply the safeguards above.
• Where you have a choice, offer the recipient an encrypted alternative and use it for the most sensitive items.

That record is your accountability evidence. It shows you weighed the risk instead of ignoring it.

How the US approach differs

Many of our readers send faxes from the US, so the contrast matters. The US has no single law like the GDPR. According to an FTC statement, protections follow the type of data and the entity involved: the HIPAA Privacy Rule for patient health information, the Gramm-Leach-Bliley Act for financial information, and COPPA for children’s online data. Different agencies enforce them, and state laws such as California’s add further requirements.

For fax, HIPAA is the rule most people meet. HHS says in its guidance on faxing patient information that the Privacy Rule lets providers disclose health information to another provider for treatment by fax, but that covered entities must have reasonable safeguards in place. That is more permissive in tone than the German regulators, but it still expects care. HHS also lists a case where a doctor’s office mistakenly faxed records to the wrong recipient and had to revise its faxing procedures.

The practical point: a fax can satisfy HIPAA’s reasonable-safeguards standard and still raise questions under the GDPR if the data subject is in the EU. If you handle both, apply the stricter expectation. For US healthcare detail, see our pages on HIPAA fax rules and fax privacy laws. A HIPAA fax cover sheet template is also available.

Marketing faxes and consent

The GDPR is not the only regime. Unsolicited marketing by fax falls under separate e-privacy rules. In the UK, the ICO explains that business-to-business marketing faxes are generally allowed to companies unless the number is registered with the Fax Preference Service or the business has opted out, while sole traders and some partnerships require consent. Marketing faxes must identify the sender. Rules differ by country, so check the local regulator before a campaign.

This guide is about operational faxes, such as forms, filings and records. Those do not need marketing consent, but they still need a lawful basis and appropriate security.

Our perspective

We run a pay-per-page fax service, so people ask us whether fax can be made safe. Our answer is that fax is a transport, and the risk sits in how it is used.

We see three habits that cause most problems. People send to a number they have not checked. They send entire documents when one page would do. And they keep no proof that the fax arrived. All three are fixable without any special technology.

The service itself should help. That is why we build in encryption for transmission, automatic retries when a line is busy, delivery confirmation and status tracking, and a refund when a fax fails. None of that replaces your own obligations under the GDPR, HIPAA or another law. It gives you a clean record of what was sent and whether it arrived, which is the evidence regulators ask for.

We also think senders should be honest about the limit. Once a fax reaches the recipient, we do not control their equipment. If the content is highly sensitive and the recipient can accept an encrypted channel, use it. If they can only accept fax, send it with care and document your reasoning.

— Engin

Sending a fax when you need delivery proof

If you need to fax a form or record and want a clear trail, PerPageFax lets you send without an account or subscription for $0.50 per page. You upload a PDF or common image file, pay at checkout, and get delivery confirmation. Failed faxes are refunded, and automatic retries run before a fax counts as failed. You can also prepare documents with the free PDF tools, including a faxify tool that makes a PDF fax-ready. For fax within the US, start on the US fax page.

Choosing a fax provider with data protection in mind

Whatever you use, ask providers the questions a regulator would ask you:

• Is the connection encrypted in transit, and how is that stated?
• What happens to the document after sending, and for how long is it kept?
• Do you provide delivery confirmation and a record of the attempt?
• What is the policy when a fax fails?
• Is pricing clear, with no hidden fees that push you toward a plan you do not need?

If you handle regulated records, read how secure online fax for regulated documents is evaluated. If you must keep copies, the fax archive requirements guide explains retention. For legal weight, see whether faxes are legally binding.

FAQ

Is fax GDPR compliant?

The GDPR does not prohibit fax. Compliance depends on whether the way you send the data is secure enough for the risk, as Article 32 requires. German regulators consider unencrypted fax inappropriate for sensitive data such as health information, so for low-risk content it can be fine and for high-risk content it usually needs added safeguards or another channel.

Can I fax health data to someone in the EU?

It is possible, but it is high risk. Health data is a special category under the GDPR, and you often cannot see how the recipient handles incoming faxes. Confirm the number, ask how faxes are received, and use an encrypted alternative where the recipient accepts one. Ask your data protection officer or a privacy lawyer if the case is complex.

Does the US have a GDPR equivalent?

No. The US has sector laws such as HIPAA for health information and GLBA for financial data, plus state laws like California’s. Different agencies enforce them. If you also handle data of people in the EU, the GDPR can apply on top of those rules.

What should I do if I fax personal data to the wrong number?

Try to contact the recipient and ask them to delete or return the pages, and record what happened. Under the GDPR a misdirected fax can be a personal data breach, which may require notifying your supervisory authority within a set time. Talk to your data protection officer or counsel promptly to assess the notification duty.

Sources

• Art. 32 GDPR, security of processing
• Bremen data protection commissioner: Telefax ist nicht datenschutzkonform
• LDI NRW: Übermittlung personenbezogener Daten per Fax-Nachrichten
• Hessen data protection: Übermittlung personenbezogener Daten per Fax
• TLfDI Thuringia press release on fax, 2024
• FTAPI: Fax, data protection and GDPR
• HHS: Can a physician’s office fax patient medical information?
• HHS: Enforcement example, physician revises faxing procedures
• FTC statement on US and EU privacy approaches
• ICO: Business-to-business marketing

Recommended

• HIPAA Fax Rules: Can You Fax Medical Records?
• Fax Privacy Laws: 3 Safeguards for Healthcare
• Secure Sensitive Documents: Fax or Email
• Secure Online Fax for Regulated Documents