GDPR - Service storing other people&#39;s clients&#39; emails
<p>I am working on a service that allows people to import data regarding their sales within a particular platform.
This data is imported in an excel format (CSV) and contains all sales informations for a particular person or company. 
It contains also all the different email addresses of their customers that I would then store in my database for statistic purposes regarding users.</p>

<p>Would this be violating the GDPR compliance?</p>

<p>Of course, I won't make use of any of those emais at all. They are just a way for my users to get relevant information for them such as "number of customers per month", "average purchases per customer" etc.</p>

<p>There's no other way I have to identify their customers than by storing their email. There's no such thing as a customer id.  </p>

<p>It seems you are processing personal data (email addresses are identifiable). Then you do have to comply with the GDPR. But what you are trying to do can be done compliantly – this doesn't have to be a GDPR violation.</p>

<p>Core question would be who the Data Controller is – who determines the purposes for which this data is processed. It seems that in this B2B scenario, you wouldn't be the Controller but merely a processor. This can simplify your compliance requirements, for example you wouldn't be responsible yourself for responding to data subject requests. You would however have to sign a data processing agreement with the Controllers (your clients), and can't hire subprocessors on your own. The relevant details are in <a href="https://gdpr-info.eu/art-28-gdpr/" rel="nofollow noreferrer">Art 28</a>.</p>

<p>Note that where the Controllers are not subject to the GDPR (for example because they are established outside of the EU and aren't processing data from persons in the EU), then merely processing the data in the EU doesn't make this processing subject to the GDPR. Whether GDPR applies depends solely on the relationship between the Controller and Data Subject, not on the location of the Processor.</p>

<p>Things are different if you determine the purposes of processing and would therefore be a Controller. This might be the case if you want to combine data from multiple sources, or if you are using the data for your own purposes. It would also be the case if you accept data directly from Data Subjects. But such a scenario would be more complicated for everyone involved. For example, your clients (who are Controllers as well) would now need a legal basis that allows them to share the data with you.</p>

<h2>Yes</h2>

<p>An email address is personal data all by itself.</p>

gdpr european-union email