GDPR

The General Data Protection Regulation is the EU's comprehensive data-protection law, in force since 2018. For email marketers, the most relevant provisions concern lawful basis for processing personal data (an email address is personal data), consent requirements, and data subject rights.

GDPR requires a lawful basis to process personal data. For B2C marketing email, the practical basis is consent — typically a clear opt-in. For B2B email, "legitimate interest" can apply, provided the recipient's professional role makes the message relevant and the sender has properly assessed the balance of interests. Pre-checked consent boxes, bundled consent, and assumed consent from inaction are all invalid under GDPR.

Data subject rights include the right to access, rectify, erase, and port their data, and the right to object to processing. In practice, email senders need a working unsubscribe (right to object), a way to provide a copy of the subscriber's data (right to access), and a way to delete it on request (right to erasure). Penalties run up to 4% of annual global turnover or €20M, whichever is higher.