Replacing the fax machine with an online fax service: a UK vendor checklist

An online fax service looks like a small purchase, but it carries a large data protection footprint. It sits between your organisation and everyone who sends you documents, so each page lands on a third party's systems. Treat it as a vendor decision, not as a like-for-like swap for a piece of office hardware.

This checklist is written for an organisation in England buying such a service. The legal references are to the UK GDPR, which the Information Commissioner's Office (ICO) says primarily applies to organisations located in the United Kingdom. It is general guidance, not legal advice. It was checked against the sources listed at the end in October 2026, and the ICO marks several of those pages as under review following the Data (Use and Access) Act, so confirm the current wording before relying on a detail.

What to take away

Why this is a vendor decision

With a fax machine, a document stays in the building until someone picks it up. With an online service, incoming faxes are commonly delivered as a file to an email address or a web portal, and you send outgoing ones by uploading or attaching a digital document. Copies now exist on the provider's servers, in its logs and perhaps in its backups.

Editorial suggestion: match the depth of your checks to the harm a leak would cause. Before you look at any provider, write down who faxes you, what the documents contain and who in your organisation needs to see them. That short list sets how far the rest of this checklist needs to go. For a tiered way of scaling evidence to impact, see our proportionate vendor due diligence checklist.

Controller and processor: who is responsible

Your organisation determines the purposes and means of handling the documents, which normally makes it the controller. The fax provider stores and transmits them for you, which normally makes it a processor. The role follows the facts of the service, so read how the provider describes its own position. Editorial suggestion: expect the provider to be a controller for its own billing and account records, and check that its terms keep the two roles apart.

The ICO's data security guidance says you must choose a processor that provides sufficient guarantees about its security measures. It adds that your written contract must stipulate that the processor takes all measures required under Article 32, and that you should ensure the processor makes available the information needed to show compliance, which can include letting you or an authorised third party audit and inspect it.

The ICO's page on contract content explains what Article 28(3) of the UK GDPR requires a processor contract to contain:

If a provider offers nothing beyond a tick-box acceptance of general terms, there is a gap to close before you sign, or a reason to shortlist someone else. For the wider picture of how contract clauses fit together, see our guide to reading a productivity software contract.

Security questions to put to the provider

The ICO describes confidentiality, integrity and availability as the three key elements of information security, and says there is no "one size fits all" solution: what is appropriate depends on your circumstances and the risks of your processing. It recommends encryption, with a suitable policy, where you store personal data or send it over the internet, and it expects appropriate access controls. It calls Cyber Essentials a good starting point while noting that it only provides a base set of controls.

Turn those expectations into questions:

The NCSC says its cloud security principles are designed to help you choose a cloud provider that meets your security needs, and that they apply to software-as-a-service as well as platforms. There are 14. Several translate directly into fax questions:

The NCSC also states that you will separately need to consider how you configure your cloud services securely. Choosing a good provider does not finish that job, so test the account settings yourself before real documents go through.

Where the documents are stored

Get a written statement of the locations where documents are processed and stored, covering backups and any support staff who can reach them. Request the same for each sub-processor.

The ICO's brief guide to international transfers gives a three-step test. A transfer is restricted when the UK GDPR applies to the processing, you are initiating the transfer to an organisation outside the UK, and that organisation is a separate legal entity. The rules apply to all restricted transfers, even small, infrequent ones.

Each restricted transfer must be covered by UK adequacy regulations, appropriate safeguards or an exception. Where adequacy regulations cover the destination, no additional safeguard is needed. Where they do not, the safeguards listed in Article 46 are the next route, and the ICO gives as examples its international data transfer agreement (IDTA), the international data transfer addendum and UK binding corporate rules. If you rely on a safeguard you must also complete a transfer risk assessment. If there is no adequacy regulation and no safeguard, an Article 49 exception must apply, and if none does the ICO says you must not make the transfer.

Our guide to UK and EU trade rules for operations software looks at suppliers that are based in the EU. Whatever the provider's location, a firm answer naming the regions and the transfer mechanism is easier to assess than a general assurance.

Retention and deletion

Some online fax services keep a searchable archive. That makes old documents easy to find, but it also accumulates personal data that you are responsible for managing.

The ICO's storage limitation guidance says the UK GDPR does not dictate how long you should keep personal data. You must be able to justify the period, based on your purposes. You can keep data while a stated purpose still applies, but you should not keep it indefinitely "just in case". The ICO wants standard retention periods set out in a policy or schedule wherever possible, and personal data erased or anonymised when no longer needed. It also says that taking data offline is not the same as deleting it, because you are still processing it. If it is appropriate to delete data from a live system, you should also delete it from any backup of that system.

Put these points to the provider:

On backups, the ICO's processor contract guidance accepts that data in backups or archives may not be deleted immediately when a contract ends. That is acceptable only if appropriate safeguards are in place, such as putting the data immediately beyond use, the retention period is appropriate and the data is deleted as soon as possible afterwards.

Editorial suggestion: treat the provider's archive as a staging area rather than a filing cabinet. Save any fax you must keep as a business record into your normal filing system, then delete it from the service. Our article on UK GDPR and ICO retention rules for productivity software explains how to build the retention schedule that such a routine belongs in.

Breaches and impact assessments

The ICO's breach guidance says a reportable personal data breach must be notified to the ICO without undue delay and no later than 72 hours after you become aware of it. If you take longer you must give reasons for the delay. A processor that suffers a breach must tell you without undue delay as soon as it becomes aware, and you then assess whether to notify the ICO. You must record every breach, whether or not it has to be reported.

Because the provider's notice is what starts your own assessment, ask what notification period the contract sets and who at the provider will contact you.

Article 35 of the UK GDPR requires a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to individuals' rights and freedoms. The ICO's guidance lists large-scale processing of special category data as a case where a DPIA is automatically required, and says that individual professionals processing patient or client data are not processing on a large scale. If you plan to fax health records or similar sensitive material in volume, read the ICO's DPIA guidance before you sign.

Costs, contract length and exit

No price is quoted here, because plans differ between providers and change often. Compare offers against the way you actually fax, and have every figure confirmed in writing before you commit.

Editorial suggestion: look at what the plan includes for pages sent and received, what extra numbers or archive exports cost, whether you can take your fax number with you, and what notice and minimum term apply. Also check that the contract gives you the choice of deletion or return of your data when it ends. That matters most for data protection, since the ICO says the choice belongs to the controller.

Common questions

Is an online fax service safer than a fax machine?

Possibly, but it depends on the provider and your own settings. Work through the questions above instead of assuming. The ICO's position is that security measures should be appropriate to the risk.

If the provider is breached, are we still accountable?

Yes. The ICO's guidance says that as the controller you are responsible for what the processor does with the data, which is why the guarantees and the contract matter.

Do we need a DPIA?

Only where the processing is likely to result in a high risk. Editorial suggestion: treat the occasional routine document as lower risk than sensitive records sent at scale, then read the ICO's guidance and take advice if you are unsure.

Sources

• A guide to data security, Information Commissioner's Office
• What needs to be included in the contract, Information Commissioner's Office
• Storage limitation, Information Commissioner's Office
• A brief guide to international transfers, Information Commissioner's Office
• Personal data breaches: a guide, Information Commissioner's Office
• When do we need to do a DPIA, Information Commissioner's Office
• The cloud security principles, National Cyber Security Centre