We are a B2B company and our application stores e-mail addresses provided by our clients. These e-mail addresses are required for us to discharge services. Our clients or our staff with appropriate privileges can view these e-mail addresses after logging into their account in the application. Do we have to mask these e-mail addresses or implement other similar techniques for conforming with GDPR?
GDPR requires you to protect the personally identifiable information that you store, and to limit access to it. As a lot of people will have their name in their email address, one should regard emails as personally identifiable.
You should limit the access to email addresses, so that it is only viewed when needed, by as few people as possible, taking into account the time and cost needed to implement these safeguards.
Article 25 states:
Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.
Based on this, I would argue that yes, you should mask the email addresses of the users so that they are only visible to staff when needed. If the staff logs into the system for the sole purpose of viewing the email addresses, I would argue that you don't have to make any changes. But if the staff uses this system all the time, giving them access to this information also when not needed, you might have to make some changes.