Yes, email marketing is allowed under GDPR, but you must pick and document a lawful basis, usually consent or legitimate interest, keep timestamped consent records, and implement Article 32 security controls. The immediate priority is a consent audit: review every list, tag each contact with its lawful basis, and preserve evidence showing when and how consent was given. Skipping this step is what turns a routine campaign into an enforcement risk.
TL;DR:
- Conduct a thorough consent audit by tagging each contact with its lawful basis and securely preserving evidence of when and how consent was obtained.
- Ensure active, informed, and granular consent is collected via unambiguous opt-in actions, double opt-in verification, and clear, separate information presentation.
- Maintain proper list management with working unsubscribe links, support for data subject rights, shared suppression, and protection of sensitive categories, especially when handling special data types.
- Implement security controls such as encryption, access restriction, signed webhooks, and regular data retention policies to comply with Article 32 requirements.
- Keep detailed, organized records of all compliance measures, including consent logs, legitimate interest assessments, and audit logs, ready for regulator review and enforcement-proof.
Table of Contents
- Core GDPR principles that shape email marketing
- What valid consent actually requires
- ePrivacy, PECR, and the soft opt-in exception
- Data subject rights and list management
- Security controls under Article 32 for email programs
- Recordkeeping and assessments that prove compliance
- A practical checklist for getting your email program compliant
- How Notix supports GDPR-safe email programs
- Handling special categories of personal data in email communications
- Data breach notification procedures involving email data
- Training and awareness for staff handling email marketing
- International data transfers and their impact on email compliance
- Privacy by design in email communications
- Potential fines and enforcement risk
- Where compliance effort pays off most
- Get your email program compliant without building it from scratch
- FAQ
- Sources
Core GDPR principles that shape email marketing
GDPR gives you six possible lawful bases for processing personal data under Article 6, but in practice email marketing relies on two: consent and legitimate interest. Consent fits most consumer campaigns. Legitimate interest can apply in narrower cases, typically B2B outreach, provided you document a balancing test.
Two other principles constrain what you do with a list once you have it:
- Purpose limitation: data collected for order confirmations cannot silently become a newsletter list.
- Data minimization: collect only the fields you need to send and personalize the message, not every field you might someday want.
- Personal data scope: an email address containing a name or identifier counts as personal data immediately, which means suppression and consent rules apply from the first record.
Segmentation decisions should trace back to the lawful basis you logged for that contact, not just marketing convenience.
What valid consent actually requires
Valid consent is an active, affirmative act, never a pre-ticked box, and it has to be granular enough that a contact can agree to a newsletter without being forced into promotional texts too. The EDPB Guidelines 05/2020 describe consent as requiring clear, plain-language information presented separately from other terms, with demonstrable evidence kept on file.
A practical checklist for capturing and recording consent:
- Use an unambiguous opt-in action, a checkbox left unchecked by default, never inferred from silence.
- Separate consent for each distinct purpose (newsletter, product updates, partner offers).
- Deploy double opt-in or another two-stage verification step, since a confirmed click is far stronger evidence than a single form submission.
- Log the timestamp, the exact wording shown to the contact, the capture method, and, where identity matters, proof of who gave consent.
- Make withdrawal just as easy as giving consent, ideally through the same link or interface used to opt in.
Pro Tip: Store the exact consent text as a snapshot, not just a reference to your current privacy policy, since policies change and old consent needs to be judged against the wording a contact actually saw.
ePrivacy, PECR, and the soft opt-in exception
GDPR sets the general rules for personal data, but ePrivacy law (and, in the United Kingdom, PECR) governs electronic marketing specifically, and it can require consent even in situations where GDPR alone might permit legitimate interest.
- PECR restricts unsolicited marketing emails to individuals unless you have consent or qualify for an exception.
- The soft opt-in exception lets you email existing customers about similar products without fresh consent, provided you collected their details during a sale, gave them an opt-out at collection, and continue offering an opt-out in every message.
- Rules vary by country, so check local implementing legislation before relying on any exception, especially for cross-border lists.
Data subject rights and list management
Every marketing email needs a working unsubscribe link and clear sender contact details, no exceptions. Beyond that, your list management has to support the broader set of rights GDPR grants contacts.
- Access and erasure requests: verify the requester's identity, then respond within the statutory timeline, removing or exporting their data as required.
- Objection handling: once someone objects to marketing processing, suppress them immediately rather than waiting for the next campaign cycle.
- Shared suppression: apply the same suppression list across transactional and marketing sends, since a contact who unsubscribed from promotions should not still receive unrelated marketing-flavored transactional content.
- Address screening: distinguish personal addresses from generic ones (like info@ or support@) in your records, since adding any personal identifier to a generic-looking address can pull it back into personal data territory.
Security controls under Article 32 for email programs
Article 32 requires technical and organizational measures appropriate to the risk, and for email programs that translates into a specific set of controls rather than a vague security policy.
- Encrypt data in transit and at rest, including consent logs and list exports, not just the message content.
- Restrict access to subscriber lists and consent records to staff who need it, and log who accessed what.
- Use signed webhooks for event data so you can verify that delivery and engagement events have not been tampered with.
- Automate suppression so unsubscribes and bounces propagate instantly rather than depending on manual list cleanup.
- Set a retention policy for inactive contacts and old consent records, and dispose of expired data securely rather than letting lists accumulate indefinitely.
Recordkeeping and assessments that prove compliance
Regulators judge compliance by what you can show, not what you claim. Keep consent records with at minimum the contact's identifier, timestamp, exact consent wording, capture source, and IP address where relevant.
- Run a Legitimate Interest Assessment whenever you rely on legitimate interest, documenting the purpose, necessity, and balance against the individual's rights.
- Run a Data Protection Impact Assessment when processing is large scale, involves sensitive categories, or uses new technology with higher risk.
- Schedule periodic audits of your lists and consent logs, comparing current practice against your documented lawful basis for each segment.
Supervisory authorities tend to ask for these records first in any inquiry, so having them organized before you need them matters more than having them perfect.
A practical checklist for getting your email program compliant
Treat this as a rollout sequence rather than a wish list.
- Audit every list and tag each contact with its lawful basis, removing or re-permissioning anyone without a documented basis.
- Deploy double opt-in for new signups and add clear, separated consent text to every form.
- Turn on suppression automation so unsubscribes, bounces, and objections apply across both marketing and transactional sends.
- Sign your outbound webhooks and enable encrypted storage for lists and logs.
- Enable audit logging for who accesses consent records and when.
- Schedule your first LIA or DPIA for any list relying on legitimate interest or involving sensitive data.
- Train marketing and support staff on consent handling and rights requests.
- Review vendor and processor contracts to confirm they include GDPR-compliant data processing terms.
Pro Tip: Start with the list audit before touching templates or automation, since fixing consent gaps after a campaign has already gone out does not undo the exposure.
How Notix supports GDPR-safe email programs
We built our platform around the operational pieces this checklist demands rather than leaving them to a patchwork of plugins. Double opt-in is built into our contact books, so two-stage verification for consent capture is standard rather than a custom build. Suppression is unified across marketing and transactional sends, which keeps your list management consistent with the shared-suppression requirement above.
- Signed webhooks let you verify event authenticity for audit purposes.
- Our security controls and 99.9% uptime SLA support the availability and integrity expectations behind Article 32.
- Audit logs give compliance officers a record to show supervisors without reconstructing history from scattered systems.
These features map directly to the controls above rather than replacing the judgment calls your legal team still needs to make.
Handling special categories of personal data in email communications
Special categories under GDPR, health data, religious belief, sexual orientation, trade union membership, and similar sensitive attributes, require extra caution in email marketing because inferring or storing them raises your risk profile sharply. A fitness brand that infers a health condition from purchase history, or a dating platform that reveals sexual orientation through segment names visible in list exports, can trigger special-category obligations even without collecting the data directly.
The safest approach is to avoid inferring or storing special-category data in email systems unless you have an explicit, narrow legal basis for it, such as explicit consent collected specifically for that purpose. If your email platform's segmentation logic creates tags that reveal sensitive characteristics (a segment literally named after a health condition or religious holiday), treat that segment itself as special-category data requiring the same protections as the underlying field.
Practical steps include stripping sensitive attributes from list exports sent to third-party tools, naming segments generically rather than descriptively, and restricting who can view segment definitions. When a campaign genuinely requires sensitive targeting, explicit consent for that specific purpose, recorded separately from general marketing consent, is the only safe lawful basis. Review any A/B testing or personalization logic that touches sensitive attributes with the same scrutiny you apply to the sending list itself, since a well-intentioned personalization feature can quietly create a special-category processing activity nobody documented.
Data breach notification procedures involving email data
A breach involving your email list, whether it is a leaked database of subscriber addresses or a compromised sending account used to exfiltrate consent records, triggers GDPR's notification clock. You generally have 72 hours from becoming aware of a breach to notify your supervisory authority unless the breach is unlikely to result in risk to individuals.
For email-specific incidents, the assessment hinges on what was exposed. A leaked list of addresses alone carries lower risk than a leak that includes consent text, IP addresses, or behavioral data tied to sensitive inferences. If the breach is likely to result in high risk to affected individuals, you also need to notify those individuals directly, not just the regulator.
Build a breach response plan specific to your email infrastructure before you need it: know which systems hold consent records, who has access to your sending platform's API keys, and who makes the call on whether a given incident meets the notification threshold. Document the incident regardless of whether it crosses the notification threshold, since that record itself becomes evidence of your organizational diligence if a regulator asks later. Revoking compromised API keys and rotating webhook signing secrets immediately limits the scope of ongoing exposure while you investigate.
Training and awareness for staff handling email marketing
Consent rules only hold up if the people building campaigns understand them, and most email compliance failures trace back to a marketer who did not know a segment lacked a documented lawful basis rather than a deliberate violation. Training should cover what counts as valid consent, how to recognize when a list segment needs re-permissioning, and who to escalate a data subject request to.
New hires touching email tools need this before they get list access, not after their first campaign goes out. Refresher training matters too, since ePrivacy interpretations and regulator guidance shift, and a policy that was compliant two years ago may need adjustment. Include customer support staff in this training as well, since they are often the first to receive an unsubscribe request, an access request, or a complaint, and mishandling that first contact creates downstream compliance gaps.
Keep training records as part of your broader compliance documentation. If a supervisory authority asks how you prevent consent violations, a documented training program with dates and attendance is concrete evidence of organizational measures, the kind of proof that distinguishes a one-off mistake from systemic negligence.
International data transfers and their impact on email compliance
If your email platform, CRM, or marketing automation vendor stores or processes data outside the jurisdiction your contacts are in, international transfer rules apply, and email marketing teams often overlook this because the transfer happens inside a vendor's infrastructure rather than through an obvious action your team takes.
Under GDPR, transferring personal data outside the European Economic Area requires an adequacy decision, Standard Contractual Clauses, or another approved transfer mechanism. This matters for email programs because many popular sending and automation tools operate on infrastructure spread across multiple countries, and a consent record collected from an EU resident but processed on servers elsewhere still falls under this requirement.
Review your vendor contracts specifically for data location and transfer mechanism clauses, not just general data processing terms. Ask where consent logs, list exports, and engagement data actually live, and confirm the vendor has a valid transfer mechanism in place for each jurisdiction your contacts are in. This becomes more complex for global lists spanning multiple regions, since a mechanism valid for one transfer corridor may not cover another, and the specific requirement depends on where your contacts are located and where your processor operates.
Privacy by design in email communications
Privacy by design means building consent and data protection into your email workflows from the start, not bolting them on after a complaint. For email programs specifically, this shows up in concrete choices: forms that default to unchecked consent boxes, templates that build in an unsubscribe link rather than requiring a marketer to remember to add one, and list architecture that separates purposes so a single opt-in cannot silently cover unrelated uses.
Default settings matter as much as the underlying policy. A signup form that pre-selects every marketing category by default violates the spirit of granular consent even if a technical opt-in box exists somewhere. Privacy by default means contacts start with the minimum processing necessary and have to actively choose to expand it, not the reverse.
This principle extends to how you build new features. Before adding a personalization engine or a new tracking pixel to email templates, ask what data it collects, whether the collected contacts consented to that specific use, and how you would suppress it for someone who objects. Building this review into your development process, rather than treating it as a compliance afterthought, is what privacy by design actually asks for.
Potential fines and enforcement risk
Supervisory authorities can impose fines up to €20 million or 4% of global annual turnover, whichever is higher, for serious GDPR infringements, according to research summarizing GDPR enforcement provisions. Email marketing violations, particularly sending without a valid lawful basis or ignoring unsubscribe requests, have been among the more common enforcement triggers because they are easy for a regulator to verify and easy for a complainant to document.
The risk extends beyond the headline fine figure. Regulatory investigations consume staff time, damage sender reputation with mailbox providers, and can result in corrective orders that restrict processing entirely while remediation happens. A guide on avoiding major fines under UK data protection law underscores how documented controls, not just good intentions, are what regulators look for when assessing whether an organization took reasonable care.
Treating Article 32 security measures and consent recordkeeping as a baseline operational requirement, rather than a project to revisit after an incident, is the most reliable way to keep enforcement risk low. The organizations that face the largest penalties are typically the ones that lacked any documented basis or controls at all, not the ones that made a defensible judgment call and can show their reasoning.
Where compliance effort pays off most
If you only fix three things this quarter, fix your consent records, your suppression automation, and your security controls, in that order. Consent records are what a regulator asks for first, suppression gaps are what generate the most complaints, and security controls are what prevent a minor list leak from becoming a reportable breach.
Compliance and marketing effectiveness are not actually in tension here. A clean, well-documented list with granular consent performs better than a bloated one anyway, because engaged contacts who clearly opted in open and click more than contacts dragged along from a vague signup years ago. Start with the list audit, not the template redesign.
If you run into an edge case this framework does not cover clearly, document your reasoning and your source, and treat that document as part of your compliance record going forward.
— Paul
Get your email program compliant without building it from scratch
We designed our platform so the hardest parts of this checklist, double opt-in, unified suppression, signed webhooks, and audit logging, come configured rather than hand-built. 
If you are managing consent across marketing and transactional sends, our Email API gives you double opt-in contact books and shared suppression out of the box, backed by a 99.9% uptime SLA and transparent pricing so your compliance budget stays predictable. Our Pro plan starts at $15 per month, with a Free plan available for smaller lists and custom Enterprise agreements for higher volume. Check pricing to see which tier fits your current list size.
FAQ
Is email GDPR compliant?
Email marketing itself is permitted under GDPR as long as you have a documented lawful basis, typically consent or legitimate interest, and you meet the security and rights obligations in Articles 6 and 32. Compliance depends on how you collect, record, and manage that consent, not on the channel itself.
What does GDPR compliance mean?
GDPR compliance means processing personal data on a documented lawful basis, limiting use to the stated purpose, applying appropriate security measures, and honoring data subject rights like access, erasure, and objection. For email specifically, it means your consent records, suppression lists, and security controls can withstand a regulator's review.
Is Gmail GDPR?
Gmail, as an email service, is covered by Google's own data processing terms and security measures for the infrastructure it provides, but using Gmail does not make your marketing emails automatically compliant. Compliance for your campaigns depends on your own lawful basis, consent records, and list management practices, regardless of which provider delivers the message.
Is giving out an email address a breach of GDPR?
Sharing someone's email address with a third party without a lawful basis or appropriate disclosure can constitute a GDPR violation, since an email address tied to an identifiable person is personal data. Whether it counts as a reportable breach depends on context: internal sharing within a documented processing purpose differs from an unauthorized disclosure to an outside party.
Sources
- Guidelines 05/2020 on consent under Regulation 2016/679 — EDPB
- Regulation (EU) 2016/679 (GDPR) — EUR-Lex
- Electronic mail marketing — ICO
- General Data Protection Regulation (GDPR) — Syracuse research summary