For many organisations, GDPR compliance is still treated primarily as an internal systems issue. Data is stored securely. Access rights are controlled. Employees authenticate before entering sensitive systems. Internal platforms are monitored, and privacy policies are documented. Yet some of the most important data protection risks appear at the exact moment information leaves those systems. That happens every day. A municipality sends citizen information to an external adviser. A law firm asks a client to return identification documents. An accounting firm exchanges payroll or tax information with a customer. An auditor requests evidence from several people outside the organisation. The internal system may be secure. The communication surrounding the information may not be.

This October, Norway’s National Security Month places renewed attention on digital discernment: thinking carefully before clicking links, approving access, sharing files or responding to messages. Coordinated by the Norwegian Centre for Information Security (NorSIS), the campaign highlights how small everyday decisions can carry serious security consequences. For organisations handling personal and confidential information, that same thinking needs to extend to communication with people outside their own systems.

That distinction matters because GDPR responsibility does not disappear when information is sent to someone else. The organisation still needs appropriate technical and organisational measures around how personal data is handled, including when it is communicated externally. Norway’s Data Protection Authority explicitly recognises delivery errors as potential personal-data breaches. Its guidance includes letters, packages and emails sent to the wrong recipient, as well as information being sent to the correct person but accidentally containing data about someone else. That is an important reminder: a data incident does not need to begin with a sophisticated cyberattack. Sometimes, it begins with an ordinary message.

The security perimeter has changed

Traditional information security was built around a relatively clear perimeter. Sensitive information lived inside the organisation. Employees accessed internal systems, and the objective was to prevent unauthorised outsiders from getting in. Modern work does not operate that way. Organisations collaborate continuously with people outside their own infrastructure. Citizens, clients, suppliers, accountants, lawyers, consultants and other public bodies all become part of digital workflows. The result is that personal information constantly crosses organisational boundaries. This creates a second perimeter: the communication layer.

An organisation may have excellent control over who can access a case management system, but much less visibility after a document has been exported and attached to an email. It may know exactly who has permission to open an internal financial system, but have limited insight into what happens after a spreadsheet is downloaded and sent externally. This is why the question “Are our systems GDPR-compliant?” is no longer sufficient. A better question is: Does our compliance model still work when the information leaves those systems?

Encryption solves only part of the problem

Encryption remains fundamental to secure digital communication. Sensitive information should be protected while being transmitted and while stored. But encryption addresses only one part of the lifecycle.

Consider a confidential document sent securely to an external recipient. The transmission may be encrypted, but an organisation may still need to understand who can access the information, whether the recipient is the correct person, whether the file has been viewed and who remains part of the conversation. This is where secure communication differs from simply secure delivery. The objective is not merely to protect information while it moves from A to B. It is to maintain an appropriate degree of control and visibility around the communication itself.

That becomes especially relevant in sectors where confidentiality is central to professional responsibility. Municipalities routinely exchange citizen information. Law firms handle personal, financial and case-related data. Accountants and auditors process payroll, tax records, identification data and company financial information. For these organisations, external communication is not an occasional exception. It is part of everyday operations.

Human error remains a compliance issue

Some of the most damaging privacy failures are remarkably simple. A recent European enforcement case involved a letter containing an individual’s identification number, address and financial information being sent to the wrong person. The matter resulted in regulatory action because the incident had not been handled appropriately after it occurred. The lesson is broader than the individual case. No organisation can completely eliminate human error. Employees will occasionally select the wrong recipient, attach the wrong document or include information in the wrong conversation.

Practising digital discernment is therefore more than recognising suspicious links. In a professional setting, it also means checking that the intended recipient is correct, questioning whether a person needs access and choosing an appropriate channel before sharing confidential material. These are everyday judgements, but they work best when supported by communication tools and processes that make safer choices easier.

The purpose of a strong communication environment is therefore not only to prevent deliberate attacks. It should also reduce the opportunity for ordinary mistakes to become serious data incidents. This is one reason conventional email can become difficult for organisations handling highly sensitive information. Email is efficient, familiar and universal. But it is fundamentally message-centric.

Once a document is sent, copies may exist in several inboxes. Threads can be forwarded. Attachments can become disconnected from the original context. Group conversations can make it difficult to know precisely who has read what. Verji’s own customer proposition reflects this problem. The platform organises communication into dedicated rooms linked to a case, project or company. Only invited participants can access those rooms, while organisations can see who has viewed messages and files. That represents a different model of communication: one where the conversation itself becomes part of the security architecture.

Compliance should follow the information

This idea is particularly relevant to GDPR because personal data is rarely static. It moves through an organisation. It may begin in an internal system, enter a communication platform, be reviewed by an adviser, returned with comments, signed by a client and archived as part of a case. Each stage introduces another set of access decisions. Who should be involved? How is that person identified?

Should they still have access next month? Can the organisation establish who has seen the information? Is the communication history connected to the relevant client or case? Those are governance questions as much as technical ones. Secure communication therefore needs to be treated as part of the broader data-protection environment rather than as a separate convenience tool.

Verji addresses this by providing end-to-end encrypted communication and file sharing, controlled rooms, access-management functionality and BankID signing inside encrypted rooms. The company positions the platform specifically around organisations that exchange personal and confidential information with customers and external parties. More than 300 firms currently use Verji, including accounting, legal and audit organisations. The significance is not that every email must disappear. It is that organisations need to recognise that different categories of communication carry different levels of risk. An invitation to a meeting is not the same as a copy of a passport. A general project update is not the same as a medical record. A marketing document is not the same as payroll information. The communication channel should reflect the sensitivity of what is being shared.

GDPR is ultimately about the full information lifecycle

The broader shift is from thinking about GDPR as a database problem to thinking about it as an information-lifecycle problem. Compliance begins when personal information is collected, but it continues through storage, access, use, sharing and eventual deletion. External communication sits directly in the middle of that lifecycle. Organisations that secure their internal systems but overlook how employees exchange sensitive information may therefore be protecting only one part of the journey. That gap becomes increasingly important as digital collaboration expands.

More organisations are working across locations. More professional services are delivered remotely. More citizens expect to communicate digitally with public authorities. More clients expect to exchange documents without visiting an office. Secure external communication is therefore becoming less of a specialist IT requirement and more of a basic operational capability.

For organisations handling sensitive information, the practical standard should be straightforward. Before information is shared, the organisation should know the recipient. While it is being shared, the data should be protected. After it is shared, the organisation should retain appropriate visibility and control. Because GDPR compliance should not end when information leaves an internal system.

National Security Month offers a timely reminder that digital discernment is both a personal practice and an organisational responsibility. Good decisions before pressing “Send” matter. So do the controls that protect information after it has been shared.

It should follow the information wherever the conversation goes.

Verji Tech develops secure communication technology designed for organisations that need to exchange confidential and personal information with customers, employees and external parties. The platform combines encrypted communication, secure file sharing, controlled participant access and structured communication rooms within a GDPR-focused environment.

Do you want to know more about Verji? Take advantage of the opportunity for a 30-day free trial period.