An email address identifies a person, so a list of them is personal data under GDPR. Sending that list to a verifier makes the vendor your processor, acting on your instructions. The written agreement between you is a legal requirement, not a formality. Our glossary entry on GDPR and email covers the terms in more depth.
Four terms are worth checking before any vendor receives a file. Look for a data processing agreement first. Then find out how long uploaded lists are kept, and whether your data is used for anything besides your own run. Last, ask where the processing physically happens.
Retention is the term that separates vendors most. A service that deletes lists on a fixed schedule holds far less of your risk than one keeping them to feed a shared database. In the second case, your contacts end up inside someone else's product.
Transfers outside the European Economic Area need a legal mechanism, most often standard contractual clauses. That's ordinary and manageable, and it belongs in the agreement you sign, not in a surprise later. Ask the vendor which sub-processors touch the data and where each one runs.
Verification creates no new permission to email anyone. A valid result tells you the mailbox exists and nothing about consent. An address you had no lawful basis to mail stays off limits after it comes back valid, and our acceptable use terms say the same.
A processing record for one cleanup, filled in
Say you're a twelve-person software firm in Dublin about to check 45,000 contacts. Before you upload, add an entry to your record of processing. It takes ten minutes, and it's the document a regulator or a large customer will ask to see.
Purpose: keeping contact data accurate. That's a duty the regulation places on you, since it asks that personal data be kept accurate and up to date. Lawful basis: the one you already hold the list under. Processor: the verification vendor, with the date the processing agreement was signed.
Then the practical lines. Data sent: email addresses only. Retention at the vendor: the number of days you've set, or the vendor's default. Transfer: where the processing happens and which safeguard covers it. Deletion: how you'll confirm the file is gone. If you can't fill in a line from the vendor's documents, that's your next question for them.
Send less: strip the file before you upload it
A verifier needs one column. Your export probably has twelve, including names, phone numbers, job titles and deal notes. Sending all of it is convenient, since the verdict comes back beside the full record. It also gives a third party data it has no use for, and the regulation asks you to avoid exactly that.
The fix is dull and quick. Add a row number to your export, copy the row number and the email column into a new file, and upload that. When results come back, join them to your full file on the row number. The vendor never sees a name.
Pick a vendor that lets you control the rest. With ZapBounce you can delete a job and its results on demand with DELETE /v1/jobs/{id}.
None of this is legal advice. A lawyer who knows your business should review anything you're unsure of.
Related questions
Is email verification legal under GDPR?
Yes, when you have a lawful basis for the addresses and a processing agreement with the vendor. GDPR asks you to keep personal data accurate, which is a purpose verification serves directly.
Does verification need separate consent?
No. Checking data you already hold lawfully is covered by the basis that let you hold it. Verification never creates consent to email anyone, either.
Where does ZapBounce process my list?
ZapBounce is hosted in the United States. A list stays in that region except for the SMTP probe to each receiving mail server. The five sub-processors are listed on the DPA page, and changes are announced 30 days ahead.
Can I use legitimate interest for B2B email?
Often, with a documented balancing test and an easy opt-out in every message. Consumer marketing is held to a stricter standard, so check your country's rules.
Does a valid result mean I can mail the address?
No. Validity is technical and consent is about the person. No check establishes consent, so the lawful basis for sending has to come from you.