---
title: "GDPR: A Good Idea That is Being Used to Phish Companies | DuoCircle"
description: "GDPR, or General Data Protection Regulation, is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/gdpr-a-good-idea-that-is-being-used-to-phish-companies/"
---

Quick Answer

Phishing attackers are sending fake GDPR compliance reminders to EU employees, claiming their email security is not compliant and demanding immediate action. The lure works because GDPR fines run up to 20 million EUR or 4% of annual worldwide revenue, so the threat feels real, and many employees view it as routine red tape rather than a phishing attempt. Targets are mostly addresses scraped from company websites, with some focus on executives. The goal is credential harvesting via a clever message plus a bogus website. From a technology standpoint these attacks are not particularly advanced, so cloud-based real-time link scanning catches them by ignoring the message content and only evaluating where links point. Cloud phishing protection deploys in about 10 minutes with no hardware or software required.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fgdpr-a-good-idea-that-is-being-used-to-phish-companies%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=GDPR%3A%20A%20Good%20Idea%20That%20is%20Being%20Used%20to%20Phish%20Companies&url=undefined%2Fblog%2Fphishing-protection%2Fgdpr-a-good-idea-that-is-being-used-to-phish-companies%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fgdpr-a-good-idea-that-is-being-used-to-phish-companies%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fgdpr-a-good-idea-that-is-being-used-to-phish-companies%2F&title=GDPR%3A%20A%20Good%20Idea%20That%20is%20Being%20Used%20to%20Phish%20Companies "Share on Reddit") [ ](mailto:?subject=GDPR%3A%20A%20Good%20Idea%20That%20is%20Being%20Used%20to%20Phish%20Companies&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fgdpr-a-good-idea-that-is-being-used-to-phish-companies%2F "Share via Email") 

![Phish Companies](https://media.mailhop.org/duocircle/images/2020/09/spf-record-check-6824.jpg) 

[GDPR](https://en.wikipedia.org/wiki/General%5FData%5FProtection%5FRegulation), or General Data Protection Regulation, _is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area_. It’s a law that gives control of people’s **personal data** back to the people. It includes the right to see all the data a company has on you, as well as the “right to be forgotten.” In other words, _a company that is covered by the GDPR has to delete your personal data at your request_.

Once the GDPR took effect in 2018, _it was incumbent upon companies in the EU to be in compliance with GDPR regulations_. Companies found not to be in compliance could be fined **up to €20 million** or up to 4% of the annual worldwide income. That’s a pretty hefty sum, so GDPR compliance is a pretty important thing. _Then it should come as no surprise that hackers are using GDPR compliance as a lure to phish employees in the EU_.

According to an [article](https://www.helpnetsecurity.com/2020/09/24/phishers-targeting-employees-fake-gdpr-compliance-reminders/) in Help Net Security, “_Phishers are using a bogus GDPR compliance reminder to trick recipients_, employees of businesses across several industry verticals, into handing over their email login credentials.”

[![email security](https://media.mailhop.org/duocircle/images/2020/09/sender-policy-framework-2478.jpg)](https://media.mailhop.org/duocircle/images/2020/09/sender-policy-framework-2478.jpg)

Continuing from the article, “The attacker lures targets under the pretense that their [email security](/) is not GDPR compliant and requires immediate action. For many who are not versed in **GDPR regulations**, _this phish could be merely taken as more red tape to contend with rather than being identified as a malicious message_. In this evolving campaign, the attackers targeted mostly email addresses they could glean from company websites and, to a lesser extent, emails of people who are high in the organization’s hierarchy (execs and upper management).”

The purpose of this **phishing attack** is similar to most others: credential harvesting. Once usernames and passwords are obtained, that’s when the havoc really begins.

[![Phishing Protection](https://media.mailhop.org/duocircle/images/2020/09/spf-record-tester-3471.jpg)](https://media.mailhop.org/duocircle/images/2020/09/spf-record-tester-3471.jpg)

The good news, if there is any, is that _this is not a particularly advanced phishing attack_. Other than the messaging, it’s like most other **phishing attacks**, from a technology standpoint: clever message + bogus website. That means that this attack is easy to spot and defeat for services like [Phishing Protection](/email/phishing-protection) from DuoCircle.

_Phishing Protection is a cloud-based, real-time, link scanning **email security platform**_. What the means is Phishing Protection ignores the message, in this case about GDPR, and _only focuses on the links in the email and the websites they point to_. And if the websites are bogus, the email gets quarantined and the recipient never sees it.

_Cloud-based Phishing Protection requires no hardware, no software and no maintenance_. It sets up in 10 minutes, works with all major email providers and only costs **pennies per user per month**.

If you’re a cost-conscious organization in the EU and you need to be in compliance with GDPR, the fastest and easiest way to make sure that compliance doesn’t leave you vulnerable to phishing attacks is to put Phishing Protection in place. Try it today for **free for 60 days**.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"GDPR: A Good Idea That is Being Used to Phish Companies","description":"GDPR, or General Data Protection Regulation, is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area.","url":"https://www.duocircle.com/blog/phishing-protection/gdpr-a-good-idea-that-is-being-used-to-phish-companies/","datePublished":"2020-09-30T00:05:15.000Z","dateModified":"2025-05-29T12:02:43.000Z","dateCreated":"2020-09-30T00:05:15.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/gdpr-a-good-idea-that-is-being-used-to-phish-companies/"},"articleSection":"phishing-protection","keywords":"","wordCount":498,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/spf-record-check-6824.jpg","caption":"Phish Companies","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"GDPR: A Good Idea That is Being Used to Phish Companies","item":"https://www.duocircle.com/blog/phishing-protection/gdpr-a-good-idea-that-is-being-used-to-phish-companies/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"GDPR: A Good Idea That is Being Used to Phish Companies","item":"https://www.duocircle.com/blog/phishing-protection/gdpr-a-good-idea-that-is-being-used-to-phish-companies/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"GDPR: A Good Idea That is Being Used to Phish Companies","description":"GDPR, or General Data Protection Regulation, is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area.","url":"https://www.duocircle.com/blog/phishing-protection/gdpr-a-good-idea-that-is-being-used-to-phish-companies/","datePublished":"2020-09-30T00:05:15.000Z","dateModified":"2025-05-29T12:02:43.000Z","dateCreated":"2020-09-30T00:05:15.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/gdpr-a-good-idea-that-is-being-used-to-phish-companies/"},"articleSection":"phishing-protection","keywords":"","wordCount":498,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/09/spf-record-check-6824.jpg","caption":"Phish Companies","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```