My initial reading of the GDPR doesn't seem to cover cases of consent with regards to inbound e-mails. If I run a corporate e-mail server and store all incoming e-mails on it, I'm storing private data of data subjects (natural persons).
Am I in breach of GDPR if I don't get consent from the data subjects to do so?
I mean, that seems insane, but the definitions for data controller/processor are so broad it is hard to tell where the boundaries are.
Any insight would be appreciated.
Some supporting documentation: The regulation: http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf
Easier to digest white paper: http://cdn2.hubspot.net/hubfs/659257/uk_site/resources/white-paper/white-paper-gdpr-en-uk.pdf