GDPR sharing customer email with colleagues

[Kieron Smith]

Our internal sales team are receiving emails from customers and then passing them on to external sales people for info or following up.

We see this as a reasonable business requirement but some of our employees are seeing this as a breach of GDPR. IS this the case?

 

[Mike Kilby PC.dp]

Providing you have either contracts with the external sales or Data Processing Agreements that clearly set out the conditions of processing, retention, purpose etc,

and you have mentioned in your Privacy Policy the same purpose, means and controls of this sharing,

This should be fine.

If those are not in place, it is unlawful sharing of data under GDPR

 

[Kieron Smith]

OK, sorry I should of explained the internal sales team and external sales people are employed by the same group/company entity.

 

[Mike Kilby PC.dp]

In that case, if they are employed by the same company there’s no issue, it’s internal.

If they are separate companies which are part of the same group, you ought to have inter-group sharing agreements as here would technically still be a controller/processor relationship.

 

[Kieron Smith]

Thank you for your advice.

 

[Paul Kelly ICHYB]

Is your business registered with the ICO?

Also, are your staff aware of their obligations under GDPR?