GDPR Compliance for EU Email Senders

What GDPR Requires for Email Marketing

The GDPR (General Data Protection Regulation), in effect since May 2018, is the world's strictest data privacy law. It governs how businesses collect, store, and use personal data of EU residents — and email addresses are personal data.

• Explicit, informed consent (opt-in) Unlike CAN-SPAM's opt-out model, GDPR requires affirmative consent before you send any marketing email. Pre-checked boxes do not count.
• Clear purpose at time of collection You must explain exactly what emails the subscriber will receive. Consent for a newsletter doesn't cover product promotions.
• Easy withdrawal of consent Every email must include a simple way to unsubscribe. Withdrawing consent must be as easy as giving it.
• Data minimization Only collect the personal data you actually need. Requiring a phone number to subscribe to an email list is likely non-compliant.
• Right to access and deletion Recipients can request a copy of all data you hold about them and demand its deletion at any time ("right to be forgotten").
• Record-keeping of consent You must be able to prove when and how each subscriber gave consent, including the specific language they agreed to.
• Data breach notification If your email list or subscriber data is compromised, you must notify the relevant supervisory authority within 72 hours.
• Data Processing Agreements (DPAs) Any third-party service that handles your subscriber data (ESP, analytics, CRM) must have a signed DPA in place.