8. of Transfer II

We send personal data over email, but only within the company, so that should be fine, right?

Threat
	You haven’t restricted access to the mailboxes on the server and administrators can read the content of communications.
GDPR	Chapter 4, Art. 32 - 4.
CCPA & CPRA	CCPA 1798.100. General Duties of Businesses that Collect Personal Information (e)
OECD	Part 2, 11. Security Safeguards Principle

...

Mitigations
	Restrict access to mailboxes on the server Require approvals for access to be granted Encrypt content when on the server