When sending an email from a ticket, you can select all contacts within the CRM. There have been a couple of times that emails have gone to the wrong contacts. Luckily this has not been too serious however I understand how this could have GDPR implications dependent on the contents of the email.
One solution would be for a ticket to limit the contacts you can send an email to. It would ideally list only those linked to the associated company of the ticket.
We’re finding as our database grows this is increasingly a risk, we are getting more instances of human error for instance in selecting a contact with the same forename and emailing them accidentally, which is not good for data protection. I think Steven’s solution would be a great step, or alternatively the sort of warning Gmail gives when you send an email to recipients outside of your domain. So Hubspot could check if the contact you select it outside of being related to the company the current ticket relates to and warn you before sending the email.