I would think of it this way: 1. Are you processing their email address? 2. For what purposes? Why do you need it at all? (You might do many different instanc

I would think of it this way: 1. Are you processing their email address? 2. For what purposes? Why do you need it at all? (You might do many different instances or types of processing for one purpose.) 3. What's your lawful basis for processing their email address for each purpose? So "in the database" would not be what they're looking for. But if it's in the database because you need to a) log them in, and b) send transactional/account-related emails, then that's what you say. I wouldn't bother them with how specifically or technically you make that happen, unless it involves third parties or something like that, because that isn't really what they asked for. So: 1. Yes, I have it. 2. To identify you to the service, let you sign in, and send account-related messages like password reset codes. 3. Performance of a contract under Article 6(1)(b), providing the service they signed up for. But again, I'm not a lawyer. Article 15, on access requests: https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ How to interpret Article 15: https://gdpr-info.eu/recitals/no-63/ https://gdpr-info.eu/recitals/no-63/