GDPR Q47

How does GDPR affect email marketing?

Q47. How does GDPR affect email marketing?

Category: Marketing

Email marketing must follow both GDPR and PECR rules to respect individuals’ preferences and privacy.

In simple terms

Obtain valid consent or rely on a limited soft opt-in/legitimate interests for B2B.
Provide easy unsubscribe options in every email.
Keep records of consent and honour opt-outs promptly.

Lawful basis

For individuals, consent is usually required. For existing customers, the PECR soft opt-in allows marketing about similar products if an opt-out is provided.

Record when and how consent was obtained.
Conduct LIAs for legitimate interests-based marketing.
Keep consent separate from terms and conditions.

Delivering compliant campaigns

Use double opt-in where possible, personalise frequency, and include clear unsubscribe links.

Remove unsubscribed contacts immediately from all systems.
Monitor bounce and complaint rates to maintain list quality.
Review third-party email platforms for security and compliance.

Practical steps to take

Audit mailing lists and remove contacts without a lawful basis.
Configure templates with required company information and unsubscribe links.
Implement an automated opt-out workflow.
Regularly review consent logs and marketing preferences.
Provide training for marketing teams on PECR and GDPR.

Real-life examples

Welcome series

A retailer sends a welcome email only after double opt-in confirmation and includes a preference centre.

Business newsletter

A B2B firm relies on legitimate interests, keeps an LIA on file, and honours opt-outs within 24 hours.

Helpful reminders

Keep suppression lists to avoid re-mailing opted-out contacts.
Be cautious with purchased lists—usually they are not compliant.
Document third-party processors involved in campaigns.

Key takeaway

Respect inboxes—clear permission, transparent messaging, and instant opt-outs keep your campaigns lawful.