GDPR - Storage and processing of student email addresses
<p>I'm writing some software for use in a school. An essential function of the software is to email students using their school provided email account.</p>

<p>My question is, does GDPR apply to the storage and processing of solely student email addresses?</p>

<p>The email addresses are of the format <code>&lt;student-id&gt;@&lt;schooldomain&gt;.sch.uk</code>.</p>

<p>I will not be storing any PII that can link the email address to any particular individual, further than their student ID number, and this will be accessible only to individuals (teachers) who already have access to full student records in other computer systems.</p>

<h2>The email address <em>is</em> PII</h2>

<p>1 student, 1 email address. The email address itself uniquely identifies someone so it's PII.</p>

<blockquote>
<p>I'm writing some software for use in a school.</p>
<p>... full student records in other computer systems.</p>
<p>does GDPR apply to the storage and processing of solely student email addresses?</p>
</blockquote>
<p>The school has a range of computer systems, now including yours that processes email addresses only.</p>
<p>Even though your system does not by itself allow to identify persons by email address, the school (which is the data processor and controller here) easily can. GDPR applies to the storage and processing done by processor as a whole, not to individual system units within its infrastructure.</p>
<p>Surely, you won't be saying that GDPR applies to one table in the database but not the other? Same here, just slightly bigger scale.</p>

privacy gdpr