Unencrypted email can pass through multiple technical intermediaries, any of which may read the content or suffer a breach. It may also traverse other jurisdictions with different legal access rules. That combination creates privacy risk, weakens confidentiality, and complicates compliance with data protection obligations when sensitive personal information is involved.
Why unencrypted email is risky even inside one country
Email is not a point-to-point private channel. Even when both endpoints are in the same country, a message can be relayed by mail servers, spam filters, security gateways, archival systems, and hosted providers that store or inspect the content. If the content is sensitive, any intermediary that can process it also becomes part of the exposure surface, and jurisdiction does not remove that technical reality.
How privacy risk appears in the email delivery chain
Encryption matters because it determines who can actually read the message at rest and in transit. Without it, confidentiality depends on every system in the delivery path behaving perfectly and every provider keeping the content inaccessible to the wrong people. That is a weak assumption for personal data, contractual material, health information, financial records, and internal business discussions.
Country boundaries do not eliminate privacy risk because the message may still move through infrastructures governed by different contracts, retention settings, logging practices, and breach histories. Even where the sender and recipient are domestic, the practical question is whether the message remains protected throughout transfer, storage, indexing, and backup.
Why compliance obligations can still be implicated
Compliance risk arises because many privacy and security obligations are about safeguarding data throughout processing, not just about keeping it inside national borders. The relevant test is often whether the organisation used appropriate technical and organisational measures for the sensitivity of the data, whether it limited exposure, and whether it could justify the chosen control level. The EU General Data Protection Regulation (GDPR) is a clear example of this logic, because its principles and security requirements focus on confidentiality, integrity, and data protection by design.
For practitioners, the compliance issue is not only “was the recipient in the same country?” It is also “could the message be intercepted, over-retained, exposed in logs, or accessed by providers or attackers along the way?” That is why unencrypted email can create a compliance problem even when geography looks simple on paper.
Risk and Threat Considerations
Unencrypted email expands the number of parties and systems that can see sensitive content, so the main risk is silent exposure rather than obvious compromise. The same weakness also creates a breach multiplier: one mailbox, one relay, or one archived copy can expose the message long after it left the sender’s control.
Failure mechanism: Messages travel through intermediary mail infrastructure, storage layers, and security tools that may inspect, log, copy, or retain content in plaintext, and an attacker or misconfigured service can exploit any exposed copy.
Impact: Confidential personal or business data can be disclosed, retention and breach obligations can be triggered, and the organisation may be unable to demonstrate that it used proportionate protection for the information it handled.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while GDPR and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art. 5 — Principles relating to processing of personal data | Plain email can expose personal data across processors and intermediaries, affecting lawful handling principles. |
| Art. 25 — Data protection by design and by default | Encryption choice is a design control for protecting personal data throughout email processing. | |
| Art. 32 — Security of processing | Unencrypted email affects confidentiality controls needed to protect personal data in transit and at rest. | |
| Recommendation — Apply Art. 5 principles to limit exposure and justify the chosen email control for the data class. Build encryption into email handling where confidentiality risk is material. Use appropriate technical measures, including encryption where needed, to secure email content. | ||
| NIST SP 800-53 Rev 5 | SC-13 — Cryptographic Protection | Encryption directly addresses the confidentiality weakness created by plaintext email delivery. |
| AC-4 — Information Flow Enforcement | Email routing and relays are information-flow paths that can widen exposure beyond the endpoints. | |
| Recommendation — Encrypt sensitive email content when confidentiality must be preserved across intermediaries. Restrict information flow paths so sensitive content is not broadly exposed in transit. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | Encryption is the core control for protecting sensitive email content from disclosure in transit or storage. |
| Recommendation — Use cryptography where email confidentiality depends on limiting read access. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Email often leaves protected endpoint space and lands in intermediary storage or archives. |
| PR.DS-02 — Data-in-transit is protected | The question centers on confidentiality during email transmission across multiple systems. | |
| Recommendation — Protect stored email data and copied content wherever it persists. Protect email in transit with encryption or equivalent confidentiality controls. | ||
Practitioner Guidance
What to verify: Check whether the data classifies as personal, sensitive, regulated, or business-critical before relying on plain email. If the answer is yes, require a control decision, not an assumption that domestic delivery is “safe enough.”
Decision rule: If the message would still be harmful if read by a mail relay operator, security gateway, cloud provider, or attacker with access to a copied mailbox, use encryption or a more appropriate secure sharing method instead of standard email.
What good looks like: The organisation can explain where content is protected, where it may be exposed, and why the chosen method is suitable for the sensitivity of the data and the applicable compliance duty. If that explanation is vague, the control is usually weaker than it appears.
Practitioner takeaway: Treat country of origin as only one variable; the real control question is whether the email content stays confidential across the full delivery path and whether that protection is defensible for the data involved.
Related resources from NHI Mgmt Group
- Why do non-human identities create compliance risk even when policies exist?
- Why do non-human identities create PCI compliance risk even when no human logs in?
- Why do patient record privacy failures create both security and compliance risk?
- Why do companion chatbots create compliance risk even when they do not claim to be human?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
