Preguntas frecuentes
Does GDPR apply to my business if I am not based in the EU?
Yes, if you have subscribers who are EU or UK residents, GDPR applies to how you handle their personal data regardless of where your business is based. This is one of the most misunderstood aspects of GDPR. If you have any meaningful number of European subscribers, you should treat your entire email operation as GDPR-compliant rather than trying to apply different rules to different segments. The practical approach is to adopt GDPR best practices universally since they represent good data handling anyway.
What is the legal basis for sending marketing emails under GDPR?
For marketing emails, the most straightforward legal basis is explicit consent, meaning the subscriber actively opted in specifically to receive marketing from you. Legitimate interest is another valid legal basis but is harder to justify for email marketing and more likely to be challenged. Pre-ticked checkboxes or implied consent from a purchase do not constitute valid GDPR consent. You need a clear, affirmative action from the subscriber, ideally through a dedicated opt-in checkbox with plain language explaining what they are signing up for.
What should my GDPR-compliant email signup form include?
Your signup form should include a clear statement of what content you will send and how often, an unchecked consent checkbox with plain language, a link to your privacy policy, and ideally a double opt-in confirmation step. Do not bundle email consent with terms of service acceptance. The consent statement should be specific, not vague. Something like "I consent to receiving weekly marketing emails from Company Name about X topic" is much stronger than "I agree to receive communications."
How long can I keep subscriber data under GDPR?
GDPR does not specify exact retention periods, but it requires that you only keep personal data for as long as necessary for the stated purpose. For email marketing, this generally means you should suppress or delete subscribers who have not engaged in an extended period, particularly if you cannot identify a legitimate ongoing reason to retain their data. Documenting your retention policy in your privacy policy protects you and demonstrates compliance. Most organizations use 12 to 24 months of inactivity as a reasonable threshold for deletion or re-consent outreach.
What is a Data Processing Agreement and do I need one?
A DPA is a contract between you as the data controller and your email platform as a data processor that governs how they handle the personal data you share with them on behalf of your subscribers. Under GDPR Article 28, you are legally required to have a DPA with every third-party service that processes personal data on your behalf, which includes your email platform. Most platforms include this in their standard terms or have a DPA available to sign on request. Check your specific platform and sign it if you have not already.
Can I use pre-purchased or third-party email lists under GDPR?
No, purchased lists are almost certainly non-compliant under GDPR for marketing purposes. Consent must be specific to your business and your communications. Consent given to a data broker to "share with marketing partners" does not constitute valid consent to receive emails from you specifically. Using purchased lists to EU residents exposes you to significant GDPR fines. The only compliant path is building your list through direct, explicit consent collection from people who knowingly sign up to hear from your organization.