HR data sovereignty: the forgotten piece of the debate, your email server

Digital sovereignty is gradually taking hold in recruiting

Over the past few years, digital sovereignty has taken a growing place in the thinking of HR and recruitment professionals. The policies of the Trump administration have notably helped bring questions of defence, strategic autonomy and digital sovereignty back to the forefront in Europe.

Companies are asking more questions about the technologies their providers use, where data is hosted and the guarantees offered by software vendors.

This is a positive development.

Recruitment professionals handle personal and confidential data every day. It is perfectly legitimate to want to understand better where that information is stored, how it is processed and who can access it.

The discussions mainly focus on three topics:

• Data hosting: is the information stored in France, in Europe or in a third country?
• Technology providers: does the infrastructure belong to European or American companies?
• Artificial intelligence: which models are used, and what data is sent to them?

These questions matter and deserve to be asked.

But as these debates move forward, one element that is central to our digital environment regularly seems to slip into the background.

Our business email server.

The forgotten piece of the debate: your inbox

Let’s take a moment to look at a recruiter’s day.

Every day, they receive applications, talk to candidates, send profiles to clients and share information with colleagues.

A large share of these interactions still goes through email.

And behind these exchanges lies a considerable amount of personal and professional data.

A few examples:

• CVs containing candidates’ identity, contact details and career history.
• Salary expectations and information about current pay.
• Interview notes and skills assessments.
• Information about confidential job searches.
• Reference checks and comments on applications.
• Contract documents and confidential exchanges with client companies.

This data is sometimes as sensitive as the data stored in a recruitment ATS or CRM.

Yet when we talk about HR data sovereignty, we talk a lot about specialised software and relatively little about the infrastructure that hosts our emails.

A business inbox is not just a communication tool: it is also a store of personal data.

And often, a very large one.

Thousands of pieces of HR data kept for years

Unlike an ATS, where data can be structured and tied to retention rules, business email often works like a huge archive.

A CV received four years ago may still be sitting in a conversation.

A candidate assessment may have been forwarded to several people.

Interview notes may survive in an attachment, even though the candidate’s record has been deleted from the recruiting software.

This raises several questions.

How many CVs are currently stored in your firm’s inboxes?

For how long?

Who can access them?

What happens when a candidate asks for their personal data to be deleted?

And when a team member leaves the company, how is the HR data in their former mailbox handled?

These questions are not new. They follow directly from the principles of personal data protection.

GDPR applies to data processing, whatever the tool used.

The distinction matters: deleting a candidate record in your ATS does not necessarily mean every copy of their data has disappeared from the company’s other systems.

Legal retention obligations, and situations in which some data may legitimately be kept, must however be taken into account.

Google Workspace and Microsoft 365: where do they fit in the sovereignty debate?

Today, many companies and recruitment firms use Google Workspace or Microsoft 365 for their business email.

According to a study published by Getlead in 2026, covering in particular 2,751 French business domains, 65% of the domains analysed use Microsoft 365 or Google Workspace as their inbound email infrastructure.

These results show the major place of American providers in business email, a link in the chain that is often forgotten in discussions about HR data sovereignty.

This share applies to the sample studied: it is not an exhaustive measure of the French market, nor a statistic specific to recruitment firms.

Source: Getlead, State of B2B Email Infrastructure 2026.

This does not mean these services are incompatible with GDPR.

Using an American provider is not, in itself, a breach of the European regulation.

GDPR provides several mechanisms to govern data transfers to third countries, including adequacy decisions and standard contractual clauses.

Google and Microsoft also offer contractual commitments and various data location and protection options, depending on their plans.

However, when an organisation wants to go beyond regulatory compliance and strengthen its digital sovereignty, its email deserves the same attention as its ATS or its cloud infrastructure.

Several factors may come into play:

• Where the data is actually located.
• The country where the provider is established.
• The laws the provider may be subject to.
• Possible access to the data from third countries.
• The technical subcontractors involved.
• Dependence on a provider, and the options for migrating.

These questions are now regularly asked of HR software vendors.

Why not ask them of our email providers too?

It is also worth distinguishing the software used to read email from the service that actually hosts the mailbox. Someone can use the Outlook app while their mailbox is hosted by an independent European provider.

What needs examining is therefore the email infrastructure and the conditions under which it is run.

European hosting, GDPR and sovereignty: three different notions

To take this further, it helps to distinguish three concepts that are often lumped together.

GDPR compliance

It covers the obligations that apply to personal data processing: lawfulness, transparency, security, individuals’ rights, retention periods and the oversight of subcontractors.

Data location

It refers to where information is physically stored or processed. An American provider can run data centres in Europe.

Digital sovereignty

More broadly, it refers to control over technologies, infrastructure, dependencies and the legal risks associated with providers.

These three notions are linked, but they are not interchangeable.

Email hosted in France does not automatically guarantee GDPR compliance.

Conversely, email provided by an American company can perfectly well be used in a GDPR-compliant way.

And an organisation can be GDPR-compliant while remaining heavily dependent on foreign technology providers.

This distinction makes it possible to ask the right questions without reducing the debate to a company’s country of origin.

European alternatives to Gmail and Microsoft 365 exist

For organisations that want to strengthen their technological independence, several European providers now offer business email solutions.

Provider	Country of origin	Features
OVHcloud	France	Business email with hosting in France, depending on the plan
Infomaniak	Switzerland	Email and collaboration suite hosted in Switzerland
BlueMind	France	Open-source collaborative email and controlled deployments
Mailo	France	Privacy-focused email hosted in France
Proton Mail	Switzerland	Email with advanced encryption features
IONOS	Germany	Business email and hosting services

These solutions meet different needs, from freelancers to large groups.

The choice should of course take into account the features required, service availability, security, reversibility and integrations with business software.

The contractual and technical guarantees of each offer also need checking: a European provider does not necessarily rule out any involvement of a subcontractor based outside Europe.

The point is therefore not to systematically replace Gmail or Microsoft 365.

It is to treat email as a full part of your data protection and sovereignty strategy.

Towards a global approach to HR data protection

Digital sovereignty should not be approached only through the choice of a piece of software.

In recruiting, data constantly moves between several environments.

A candidate is identified on a sourcing platform.

Their profile is saved in an ATS.

Their CV arrives by email.

Interview notes are shared in a collaboration tool.

Information is sent to the client, sometimes as documents or attachments.

Each step may involve a different provider, a different infrastructure and specific processing conditions.

It is the whole chain that needs examining.

A consistent approach could include:

1. Mapping the tools used to process candidate data.
2. Identifying the providers and subcontractors involved.
3. Checking where data is stored and processed, and any international transfers.
4. Assessing security and confidentiality guarantees.
5. Setting retention and deletion rules that also cover emails and shared documents.

This makes it possible to go beyond a simple list of “French” or “European” software and build a genuine HR data governance policy.

Conclusion: what if we added email to the debate?

HR professionals’ growing interest in digital sovereignty is an excellent thing.

It makes vendors more accountable, raises transparency requirements and better protects candidates’ personal information.

But for this thinking to be complete, it needs to go beyond recruiting software alone.

ATSs, CRMs, sourcing platforms and AI tools are naturally part of the equation.

So are our email servers.

Because behind every business inbox there are sometimes years of exchanges, thousands of CVs and a large amount of confidential information.

And because data protection does not depend only on where we save a candidate record, but also on every tool through which their information passes and is kept.

Next time you wonder about the sovereignty of your ATS or your sourcing solution, perhaps take a few minutes to ask yourself one more question:

And my email server: who hosts it, where is my data stored, and what guarantees does it offer?

It may be one of the most important, and least discussed, topics in our HR digital environment.