A guide to the GDPR and email marketing
Email marketing campaigns and email newsletters remain top tools for brands to connect with their target audiences, build trust, and drive leads. But if you do business with anyone residing in the European Union (EU) or European Economic Area (EEA), part of your email marketing strategy must include compliance with the General Data Protection Regulation (GDPR).
This regulation affects how organizations collect, store, and use personal data. It follows principles of consent, transparency and data minimization, and aims to give people more control over their personal information.
Because email marketing involves collecting and processing personal data, it’s important to ensure you collect and compile data and process it in a compliant manner. We’ll discuss how the GDPR regulation affects marketing emails, why it’s so important to remain GDPR-compliant, and how to get started.
What the GDPR says about email marketing
The GDPR came into effect in 2018, and has important implications for marketing communication, because marketing departments process so much personal data, from customer satisfaction surveys to interactions with platforms, and events and emails.
“When and where consent is needed, ensure that notifications are clear, consent options are user-friendly and compliant, and new consent is obtained for new purposes or at intervals where required,” notes Adelina Peltea, Usercentrics CMO.
There are seven principles of GDPR that guide and regulate personal data processing. To remain compliant with the GDPR rules in your email strategies, focus on these key areas.
Collect explicit user consent before sending messages
Email marketers can no longer send emails to whomever they wish, whenever they decide, for whatever purposes are part of their marketing strategy. Art. 6 GDPR on the “Lawfulness of processing” lists consent as one of the six legal bases for you to compliantly process data. You must have specific permission before you send an email or collect any private data, and you must explain how the information is being used.
Art. 4, par. 11 GDPR defines consent of the data subject as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”
Some privacy regulations follow an opt-out consent model, but the GDPR requires that your subscribers actively opt in. You can’t assume user consent or use pre-ticked boxes or pre-selected options, and you must present your consent request in clear and plain language. Ensure you check the consent requirements that apply to your specific email marketing activities.
Keep records of user consent
Because consent is such an important part of data privacy and protection, it’s essential to think about what happens after someone has given initial consent.
What if they withdraw consent or unsubscribe? Can you send emails about new offers when someone has only given consent to complete a user survey?
You must have consent for each type of marketing activity, keep records of consent choices over time, and you must delete or amend data if a customer requests it. This means your records and evidence of user consent must be up to date and stored securely.
Records need to include the data processing and consent information provided to the user, their initial consent choices and any subsequent ones, and also note if they have withdrawn consent and you’ve ceased data collection and processing.
Your records should include:
- the date and time of each consent action
- which specific marketing activities the customer agreed to
- all changes and updates to each individual’s consent
Using the right tool goes far to simplify this process and enable ongoing privacy compliance, and storing the data securely is crucial. A consent management platform (CMP) like Usercentrics can simplify this process and help you automate the collection and management of consent in a user-friendly and GDPR-compliant way.
Review your existing email database
Do you have an email database that was started before the GDPR came into effect in 2018? Or even more recent lists for which the purposes may have changed? If so, that database and those lists are also subject to GDPR compliance, because the GDPR applies retroactively.
Part of auditing and updating your email marketing operations regularly involves reviewing your existing database to check whether your current customers’ and subscribers’ consent needs to be renewed. If consent hasn’t already been obtained, you need to prioritize that. You also need to audit your email database to remove any incorrect and unnecessary information.
Data minimization, or ensuring you only collect directly relevant information and only for as long as it’s needed, helps you keep your data organized and GDPR-compliant. There are also additional requirements for consent renewal. You will need to check which of these apply to your business and take proper measures to collect consent for new kinds of marketing activities.
In many cases, EU member states have additional consent requirements, which may be more stringent than those of the GDPR. You should therefore adopt recommended best practices for consent renewal.
What are the penalties for not complying with GDPR email marketing requirements?
Not complying with the GDPR can have major consequences for your business, from GDPR fines of up to EUR 20 million or four percent of annual global turnover (whichever is higher) to the long-term reputational damage that comes from breaking trust or exposing your customers’ information to a data breach.
It’s fairly common for data privacy laws to recommend higher fines for wilful violations, e.g. if you were sending marketing emails knowing consent was expired or perhaps never even obtained.
Peltea explains: “There can be fines and other penalties under many regulations, including legal actions, being ordered to halt certain operations, delete data, or blacklisting, which can seriously curtail your marketing operations.”
Noncompliance can have short- and long-term consequences that are best avoided. It can be daunting to include privacy compliance in your mail strategy, but don’t be discouraged. Follow these five steps to get started with GDPR-compliant email marketing.
5 steps to stay GDPR-compliant in your email marketing efforts
Staying GDPR-compliant with your email strategy is an ongoing process, and should be part of a larger effort to implement Privacy-Led Marketing across all marketing communications and activities.
These five steps can help ensure your email marketing messages build trust with your audiences and minimize the risk of noncompliance.
1. Do an internal audit to ensure you have valid user consent
Whether or not you started compiling your mailing list before the GDPR came into effect, you still need to prove compliance if any of your customers are located within the EU.
You need to have evidence of consent. That includes maintaining a list of where your recipients are located, how you acquired them, and how and when they consented.
Start with an internal audit of your current database to ensure you have this information. If during your audit you find you don’t have valid user consent, make sure you rectify that quickly following the guidance in the next step. Note that you should conduct these audits regularly to maintain compliance.
2. Collect and store valid user consent
User consent is a key part of data privacy. The GDPR states that consent must be “freely given, specific, informed and unambiguous”. It’s also specific about the clarity of consent requests; they must be clearly distinguishable and presented in plain language.
Under the GDPR, people can withdraw their consent at any time and these requests need to be honored quickly. For email marketers, this means you must prove each and every person on your mailing list has clearly consented to receive that communication, and document the consent and subsequent changes.
The best way to do this is with a double opt-in method, or double agreement. Your recipient will receive an email after they register (first opt in). They then confirm registration through a link (second opt in) to that email address. This removes ambiguity and also allows you to check whether the email address they provided is correct.
3. Make it easy for users to opt out of your messages
The GDPR requires that users are able to easily withdraw their consent at any time. You must respect this and delete or amend their data as requested. Opt-outs are most straightforward when you embed an unsubscribe link into every email.
When a user opts out, delete the necessary data and remove them from relevant lists. This ensures you comply with the GDPR’s “right to be forgotten” (Art. 17 GDPR).
Remember to keep a record of opt-outs and update your mailing lists to reflect them. Users may also want to opt out of some marketing purposes and opt in to others. Again, make sure these changes are documented correctly.
4. Have a transparent marketing privacy policy
Customers need to know their data is protected, and that they can trust you to do so. Your privacy policy is one way of communicating this.
Peltea explains: “Be transparent about the company’s identity, any relevant sponsorships or partnerships, what data you collect and how it’s used, instructions for changing or revoking consent and preferences, etc.” Your privacy policy must be clear, use plain language, and be easily accessible.
Your marketing privacy policy isn’t the same as your privacy notice or terms and conditions on your website, as these are two different channels with different purposes. The marketing privacy policy can be a section within the broader company privacy policy, however.
Make sure your marketing privacy policy is regularly updated to stay compliant with regulations and changes in your company’s technologies and operations. This can seem overwhelming, but privacy policy generators can simplify this process and you can automatically update them with Usercentrics.
5. Frequently revise and clean your email lists
You now know more about how important it is to keep your mailing lists compliant and to keep evidence of consent and compliant data collection. This needs to be maintained and updated regularly.
Ensure you clean and revise your lists to ensure that data is correct and complete, and that you’re still using customer data for the specific purpose they consented to. For example, if someone entered their information to purchase a product, you can’t assume they consent to receive marketing emails or sales pitches about a new product; you’ll need to get new consent for those activities.
Keeping your email lists clean and correct can also help you to analyze data and improve your marketing efficiency, as you’ll have the available information to send personalized and targeted emails that are more likely to get a response.
When you perform audits and revise your lists, this is also a good time to review your security practices. As the data controller, it’s up to you to ensure all the data you collect, store and process is kept safe and secure, including when using data processors like third-party vendors or other contractors.
Use security best practices for data transmission and storage, and implement internal access controls to protect customer data within your organization. Examples of technical measures you can use include encryption and pseudonymization, but you must also be able to prove you are using the appropriate security measures for the data you process.
Keep your email marketing compliant and adhere to regulations
Each of your customers probably has an inbox flooded with emails. You want to make sure yours grabs attention, builds your reputation, and generates leads — while staying GDPR-compliant. This shows you are transparent about your data handling practices, that you respect your customers’ data, and that you value their interactions with your brand.
Keeping clean, up to date email databases, ensuring clear and explicit consent, and crafting legally sound and easily accessible privacy policies are steps to help you get up to speed. Stay current with updates to the GDPR and implement needed changes quickly to remain compliant.
A consent management platform like Usercentrics helps make it easier to stay compliant in your email marketing and beyond. It enables consent management at the point of data collection without compromising user experience. Geolocation functionality helps you customize compliance requirements to the relevant region, and thousands of legal templates are available to help you provide clear and accurate information about your data processing.