Every day, HR departments across Germany email passport scans, salary letters, and visa documents to relocation agencies — and every one of those emails is a GDPR violation waiting to happen.
When a company hires an international employee, the paperwork is immense. Passport copies, biometric photos, degree certificates, employment contracts with salary figures, police clearance records, birth certificates, proof of health insurance — all of it needs to move between the employee, the HR team, a relocation agency, possibly a destination service provider, an immigration lawyer, and eventually a government authority.
For most companies, the default tool for all of this is still email.
That needs to change — and the law already says so.
The legal reality HR teams are ignoring
Germany's Conference of Data Protection Authorities — the DSK — published binding guidance that leaves no room for interpretation: when personal data carries high risk, such as identity documents and financial information, end-to-end encryption is mandatory. Standard email doesn't meet this requirement. Not with Outlook. Not with Gmail. Not even with basic TLS transport encryption, which a December 2024 ruling by the Schleswig-Holstein Higher Regional Court found insufficient for sensitive data.
The GDPR provisions are stacked against email-based workflows. Article 32 explicitly names encryption as a required security measure. Article 5 demands that personal data be processed with appropriate confidentiality safeguards. Article 25 requires data protection to be built into processes by design — not patched on as an afterthought.
Passport copies are especially sensitive. They can reveal ethnic origin through the photograph, carry biometric data on embedded chips, and are a prime target for identity theft. Germany's own Identity Card Act restricts how copies may be made and stored. And yet, full unredacted passport scans routinely sit in email inboxes, sent folders, and backup servers — retained indefinitely, accessible to anyone with mailbox access, and impossible to track or delete.
What's actually at stake
The fines are no longer theoretical. The Dutch Data Protection Authority hit Uber with a €290 million penalty for transferring driver identity documents to US servers without adequate safeguards. Hamburg's DPA fined H&M €35.3 million for mishandling employee data that became widely accessible after a configuration error. In the UK, the Ministry of Defence was fined for a single email error — using “To” instead of “BCC” — that exposed personal data of 245 Afghan nationals in a relocation programme.
But fines are only part of the picture. Under GDPR Article 34, if encrypted data is breached, companies are exempt from notifying every affected individual. If unencrypted data is breached — as it inevitably is in email — companies must notify both the supervisory authority and every person whose data was exposed. For a company that just emailed 30 employees' passport copies to a relocation agency using standard email, a single compromised mailbox triggers 30 individual breach notifications, regulatory scrutiny, and lasting reputational damage.
The most common breach vector isn't sophisticated hacking. It's a mistyped email address. The UK's Information Commissioner's Office reports that human error causes roughly 90% of data breaches, with email auto-complete mistakes leading the list. One wrong recipient, and an employee's passport, salary, and home address are in a stranger's inbox — with no way to recall them.
The relocation agency problem
Traditional relocation agencies compound these risks. Many still operate through chains of email correspondence, forwarding documents between multiple parties with no encryption, no access controls, and no audit trail. The European Relocation Association (EuRA) has warned its own members that email-based document sharing is “no longer acceptable” in the global mobility industry.
The liability structure makes this especially dangerous for employers. Under GDPR Article 28, the company hiring the international employee remains the data controller — and bears primary responsibility for how every service provider in the chain handles that employee's data. If the relocation agency emails a passport copy to a sub-contracted destination service provider using unencrypted email, it is the hiring company that faces regulatory consequences.
Data Processing Agreements are supposed to prevent this, but they only work if the agreed security standards are actually enforced. When the entire workflow runs through email, there is no mechanism for the employer to verify compliance. No logs, no access records, no deletion confirmations — just a chain of forwarded messages scattered across multiple organisations' mail servers.
A better approach already exists
The technology to solve this problem is readily available. Modern relocation platforms offer secure document portals with end-to-end encryption, granular role-based access controls that limit who can view each document, comprehensive audit trails that log every access event, and automated retention policies that delete data when its purpose has been fulfilled.
For HR teams managing international hires, this means employees upload their documents once to a secure portal. Each party in the process — immigration lawyer, relocation consultant, government liaison — sees only the documents they need, for only as long as they need them. Every access is logged. When the visa is approved, documents are automatically archived or deleted according to a defined schedule.
This isn't a luxury feature. It's what the GDPR requires. The DSK guidance states explicitly that when email encryption requirements cannot be met, organisations “must use an alternative communication channel.” Purpose-built platforms are that alternative.
What HR departments should do now
The regulatory trajectory is clear. German courts are affirming that TLS encryption alone is insufficient. Data protection authorities are increasing both the frequency and severity of enforcement actions. The cost of secure alternatives has dropped to a fraction of what a single GDPR fine would cost.
HR teams supporting international employees should take three immediate steps. First, audit existing relocation workflows to identify every point where sensitive documents are transmitted via email. Second, require that all relocation service providers demonstrate GDPR-compliant document handling — not just in a contract clause, but in their actual technical infrastructure. Third, transition to a platform-based approach that replaces email chains with encrypted, access-controlled, auditable document exchange.
The era of emailing passport copies is over. German regulators have said so, German courts have confirmed it, and the tools to do it properly are already here. The only remaining question is whether your organisation will make the switch proactively — or wait until a breach forces the issue.