If your email list includes people in Europe, the General Data Protection Regulation is part of your day job, wherever your company is based. The good news is that GDPR is less about banning marketing than about being clear on why you hold data and what people can do about it. This guide explains how GDPR applies to email marketing in practical terms: the lawful bases you can rely on, how consent differs from the “soft opt-in” style exceptions in e-privacy rules, what your sign-up forms and emails must say, how to handle data subject requests and what to document. It is general information, not legal advice; laws and their interpretation change, so confirm specifics with counsel and the regulators’ own guidance.
Two laws, not one. In the EU, GDPR governs personal data, while a separate e-privacy regime (transposed nationally) governs electronic marketing messages. Email marketing usually has to satisfy both. The UK has its own versions after Brexit. Ask your lawyer which apply to your audience.
When GDPR applies to your emails
The GDPR applies to organisations established in the EU and, under its territorial rules, to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour. An Indian store that ships to Germany and emails its customers there can fall within scope. An email address that identifies a person, even a work address, counts as personal data. The terms you will meet are controller (the organisation deciding why and how data is used, usually you) and processor (a vendor acting on your instructions, such as an email platform). See our data processing addendum for how Flowfox acts as a processor.
Lawful bases you may rely on
| Basis | Typical email use | Points to watch |
|---|---|---|
| Consent | Newsletters, promotional campaigns | Must be freely given, specific, informed and unambiguous; withdrawal as easy as giving |
| Contract | Order confirmations, delivery updates, account notices | Only what is needed to perform the contract; not promotions |
| Legitimate interests | Some B2B outreach, fraud prevention, certain customer communications | Needs a written balancing test; people can object; e-privacy rules may still require consent |
| Legal obligation | Statutory notices, tax invoices | Narrow and specific |
For consumer marketing by email, most senders in practice rely on consent, partly because e-privacy rules commonly require opt-in for unsolicited electronic marketing, with a limited exception for existing customers marketing similar products with a clear chance to opt out. The details differ between countries, which is why a single global flow is hard to get right and why a local legal check is worth the cost.
What valid consent looks like
| Requirement | What it means for your form |
|---|---|
| Freely given | Do not make consent a condition of unrelated services; no coercive wording |
| Specific | Separate choices for separate purposes and channels |
| Informed | Say who you are, what you will send, how often and how to withdraw |
| Unambiguous | A clear action: no pre-ticked boxes, silence or inactivity |
| Provable | Record who, when, which form and which wording |
| Withdrawable | An easy way out, honoured promptly |
- Write the consent text in plain language. “Email me offers and news from Brand about travel deals, about twice a month. I can unsubscribe at any time.”
- Use an unticked box or a clear button. The person must act.
- Store proof. Timestamp, IP or source, form version and consent text.
- Link the privacy notice. Explain purposes, retention, rights and contact details.
- Consider double opt-in. A confirmation click provides stronger evidence and cleaner data. See email list building.
Rights people can exercise
GDPR gives individuals a set of rights, including access to their data, correction, erasure in some circumstances, restriction, objection and portability. For marketing, two matter every day. The right to object to direct marketing is close to absolute: when someone objects, you must stop using their data for that purpose. And the right to withdraw consent must be as easy as giving it. Set up an internal route for requests with an owner, a deadline (the regulation sets a default response time of one month, extendable in some cases) and a log. Your platform should let you find, export and delete a person’s profile in one place. In Flowfox the contact profile collects attributes, events and consent so that one search answers a request.
International transfers and processors
If personal data of people in the EU is sent to a vendor or system outside the EU, GDPR requires a valid transfer mechanism, such as an adequacy decision or standard contractual clauses, and these mechanisms have changed more than once. List every tool that touches your email data (platform, analytics, CRM, support desk, data warehouse), where it stores data and what contract covers it. Our security and privacy pages describe how Flowfox handles data, and our guide to the customer data platform explains why a clear map of your data pays off. For background on the regulation itself, see the data protection officer role, which some organisations are required to appoint.
What to document
| Record | Purpose |
|---|---|
| Record of processing activities | Shows what data you hold, why and for how long |
| Consent log | Proof of permission per contact |
| Legitimate interests assessment | Where you rely on that basis |
| Data processing agreements | With each processor |
| Retention schedule | When data is deleted or anonymised |
| Request handling log | Who asked, what you did and when |
| Data protection impact assessment | For higher-risk profiling or large-scale processing |
Personalization and profiling
Behavioural segmentation and personalization are lawful when handled openly, but they raise the bar. Tell people in your privacy notice that you use their activity to tailor messages. Avoid inferring sensitive characteristics, such as health or religion, from browsing. For decisions with legal or similarly significant effects made solely by automated means, GDPR adds extra safeguards. Marketing emails rarely reach that threshold, but check any use of scoring that could limit access to offers or prices. Our guides to behavioral segmentation and marketing personalization show ways to keep personalization useful and respectful.
A worked example (invented)
A fashion retailer in Jaipur ships to the EU and holds 18,000 EU contacts. A review finds three issues. First, a legacy sign-up form bundles newsletter consent with account creation. Second, the footer link goes to a preference page that only works on desktop. Third, the team cannot tell which contacts came from a bought list that predates the current owners. The retailer fixes the form with separate consent choices, rebuilds the preference page for mobile, and sends a re-permission email to the 4,000 contacts with no recorded source; those who do not confirm within 30 days are suppressed. It also adds a data request process with a named owner. The company, numbers and timeline are invented, but the pattern is typical.
B2B email and work addresses
A common myth is that GDPR does not apply to business email. It does: a work address such as asha.verma@company.com identifies a person, so it is personal data. What differs is how e-privacy rules treat corporate subscribers, which varies between countries; some are more permissive for messages to company addresses, others are not. If you do B2B outreach in Europe, document your reasoning, include your identity and a clear opt-out in the first message and stop at once when someone objects. Keep prospecting data to what you need, such as role and company, and note the source of each record. Our guide to lead generation strategies covers building a pipeline responsibly, and first-party data explains why collecting directly from people is usually safer than buying lists.
Another practical point: regulators publish guidance and enforcement decisions that show how rules are applied in practice. For the e-privacy side, see the background on the ePrivacy Directive. Reading a few decisions from the authority in a country you target, such as its published fines and reprimands, teaches more about expectations than any summary can. Treat those documents as the authoritative source and this guide as a map to find your questions.
Common mistakes
- Relying on legitimate interests for everything. E-privacy rules often still require opt-in.
- Bundled consent. One tick for many purposes is weak.
- No proof. A list without history is hard to defend.
- Ignoring processors. Contracts and transfers need checking.
- Treating GDPR as a one-off project. Review it when your tools or audience change.
GDPR rewards senders who can explain, in one clear sentence, why a person is receiving a particular email.
Keep consent, source and requests in one profile. Record permission per channel and answer data requests from one place.
Read next: email compliance checklist, consent management, DPDP Act for marketers and the blog.
Frequently asked questions
Does GDPR apply to email marketing outside the EU?
It can. GDPR may apply to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. Ask a lawyer how it applies to your business.
Do I need consent for every marketing email under GDPR?
Not always under GDPR alone, but e-privacy rules in many EU countries require opt-in for unsolicited electronic marketing, with limited exceptions for existing customers. Check the rules in each country you target.
What is valid consent under GDPR?
Consent must be freely given, specific, informed and unambiguous, shown by a clear action, recorded and as easy to withdraw as to give.
Is double opt-in required by GDPR?
GDPR does not require double opt-in by name, but it provides strong proof of consent and reduces fake addresses, so many senders use it. Some national authorities recommend it.
Can I rely on legitimate interests for email marketing?
Sometimes, such as certain B2B contexts, with a documented balancing test, but e-privacy rules may still require consent for the message itself. Get local advice.
How long do I have to respond to a data subject request?
The default is one month from receipt, which can be extended in some cases. Confirm the current rules with the regulator’s guidance.
Is this article legal advice?
No. It is general information. Laws and guidance change, so confirm with qualified counsel and official sources.