GDPR and Email Marketing: A Practical Compliance Checklist

The GDPR did not make email marketing illegal in Europe. It made careless email marketing expensive. If you collect addresses honestly, record how you got them and let people leave easily, compliance is mostly a matter of keeping good records. This checklist covers what the rules require in practice, and where most teams slip.

Which laws apply to email marketing in the EU?

Two layers work together. The GDPR (Regulation (EU) 2016/679) applies to any processing of personal data, and an email address that identifies a person is personal data. It also applies to companies outside the EU that offer goods or services to people in the EU.

The ePrivacy Directive (2002/58/EC, Article 13) sets the specific rule for unsolicited electronic marketing, and each country implements it in its own law. In practice it means that sending marketing email to individuals requires their prior consent, unless the soft opt-in applies. The UK has equivalent rules in the UK GDPR and PECR.

Consent, soft opt-in and legitimate interest

A common misunderstanding is that "legitimate interest" lets you email anyone. The GDPR does recognise direct marketing as a possible legitimate interest (Recital 47), but the ePrivacy rules still decide whether you may send the email in the first place. For marketing email to individuals, that leaves two routes:

What makes consent valid

The GDPR defines consent as a freely given, specific, informed and unambiguous indication of someone's wishes, given by a statement or a clear affirmative action (Article 4(11)). For a signup form, that translates into concrete design rules:

• No pre-ticked boxes. The Court of Justice of the EU confirmed in the Planet49 case (C-673/17, 2019) that a pre-ticked checkbox is not valid consent.
• Specific wording. Say what people will receive and roughly how often: "Send me the weekly pricing newsletter", not "I agree to marketing".
• Separate purposes. If you also want to share data with partners or use it for something else, ask separately (Article 7(2)).
• Be careful with bundling. Making a download conditional on newsletter consent is risky: under Article 7(4) and the EDPB's guidance on consent, tying consent to something unrelated can mean it was not freely given.
• Tell people who you are. Link to your privacy notice at the point of signup, with the information Article 13 requires.

For form design that satisfies these rules without killing conversion, see Email Lead Generation: 9 Signup Form Tactics.

Compliance is a lifecycle, not a checkbox

Record: be able to prove it

Article 7(1) puts the burden of proof on you: if you rely on consent, you must be able to demonstrate it. For each contact, keep the exact consent wording they saw, when they gave it, and where (which form, import or integration). Double opt-in is not required by the GDPR, but a confirmed click from the inbox is the strongest evidence you can have, and in some countries, such as Germany, it is effectively the expected standard.

Honor: make leaving effortless

Withdrawing consent must be as easy as giving it (Article 7(3)), and the right to object to direct marketing is absolute (Article 21): once someone objects, you stop, with no balancing test. In practice: an unsubscribe link in every email, one-click unsubscribe headers that Gmail and Yahoo now expect from bulk senders anyway, no login required, and an opt-out that takes effect immediately. A preferences page that lets people reduce frequency instead of leaving is a good addition, not a replacement.

Maintain: keep only what you need

Storage limitation (Article 5(1)(e)) means you should not keep personal data longer than its purpose requires. For email marketing, that argues for a retention period for raw tracking data and a sunset policy for contacts who never engage, which also happens to be good for deliverability. See Re-engagement Emails: How to Win Back Inactive Subscribers.

Export and erase: answer requests on time

People can ask what data you hold about them (Article 15) and ask you to erase it (Article 17). You must respond without undue delay and within one month, extendable by two further months for complex requests (Article 12(3)). Keep the address on a suppression list after an unsubscribe, though: storing the minimum needed to make sure you never email someone again is generally considered legitimate.

Your email platform is part of your compliance

You are the controller of your list; your email platform is a processor acting on your instructions. That relationship has its own requirements:

• A data processing agreement with the platform (Article 28).
• A list of subprocessors and the regions where data is processed, so you can assess international transfers.
• Transfer safeguards where data leaves the EEA, such as Standard Contractual Clauses or the EU-US Data Privacy Framework.
• Security and breach handling: you must notify your supervisory authority within 72 hours of becoming aware of a reportable breach (Article 33), so your platform needs to tell you quickly.
• Tools for data subject rights: export, erasure and consent records you can actually retrieve.

The GDPR email marketing checklist

1. Decide the route for each audience: consent, soft opt-in, or business contacts under your local rules.
2. Use an unticked consent checkbox with specific wording on every signup form.
3. Link your privacy notice at the point of collection.
4. Store consent wording, timestamp and source for every contact.
5. Use double opt-in where proof matters or where it is the local norm.
6. Only mark imported contacts as consented if you can show where that consent came from.
7. Put a working unsubscribe link and one-click unsubscribe headers in every message.
8. Suppress unsubscribes, bounces and complaints permanently, across every list and import.
9. Set a retention period for tracking data and a sunset policy for inactive contacts.
10. Be able to export and erase a contact's data within one month of a request.
11. Sign a data processing agreement with your email platform and review its subprocessors.
12. Write down what you do, in your records of processing activities (Article 30).

How Send Tim helps you stay compliant

Send Tim is built by an EU company, EVIA SOFTWARE SRL in Romania, and treats consent and suppression as rules the system enforces rather than habits it hopes you keep:

• Consent records on every contact: when consent was given and where it came from (signup form, import, API or added by hand), plus the consent wording from your form.
• Double opt-in per list, which a form can follow or override.
• One-click unsubscribe headers on every campaign, an unsubscribe link and a preferences link through the footer merge tags, effective immediately with no login.
• A suppression list that blocks unsubscribed, bounced and complained addresses across every list, segment and import, re-checked before each send.
• Data subject tools: export contacts with their consent trail as CSV, and anonymize a contact in place so reporting stays valid while personal data is gone.
• Retention control for raw delivery events, purged nightly once they pass your window.
• A data processing agreement on request, and every subprocessor and its region listed in our privacy policy.

The details of each feature are in the guide Unsubscribes, suppression and consent.