Substack has implemented and utilizes several contractual and technical safeguards to protect the personal data we process. This includes measures such as our Privacy Documents, employing data encryption methods, and conducting data transfer impact assessments of third-party vendors and service providers.
However, it is ultimately the responsibility of a Publisher to ensure that they have a lawful basis to, first, import an email subscription list. Publishers should seek the advice of independent legal counsel to ensure that the importation of personal data falls within one of the six lawful basis categories. For more information on the lawful basis of importing email subscription lists, Publishers may view this resource.