GDPR and email come down to a few practical duties: collect valid consent where it is required, keep records that prove it, make opting out simple, handle privacy requests and sign the right agreements with your providers. This guide explains each duty in plain words for senders who email people in the EEA or the UK. It is general information and not legal advice.
Not legal advice. Laws differ by country and change over time. Use this guide to prepare the right questions and records, and ask a privacy lawyer or your data protection officer to confirm your approach for the markets you serve.
Two sets of rules apply
Sending marketing email to people in Europe touches two laws. People often mix them up, and that is where mistakes start.
| Rule set | What it covers | Where it comes from |
|---|---|---|
| GDPR | How you collect, store, use and delete personal data, including email addresses | EU Regulation 2016/679, with a UK version after Brexit |
| Electronic marketing rules | When you may send marketing email at all, and the opt-out you must give | The ePrivacy Directive as implemented by each country, and PECR in the UK |
A message can satisfy one and break the other. For example, you might hold an address lawfully but still not be allowed to send marketing to it.
Step 1: Decide when you need consent
| Situation | Usual approach | Notes |
|---|---|---|
| New subscriber on your website, individual | Consent | Use a clear opt-in and keep a record |
| Existing customer, similar product, offered opt-out | Soft opt-in where national law allows it | Offer an opt-out each time, and stay within similar products |
| Purchased or rented list | Do not use | You cannot show consent to your own messages |
| Business addresses | Varies by country | Some countries treat them like individuals, others allow B2B with conditions |
| Transactional messages | Not marketing, no consent needed for the message | Keep them free of promotion |
Step 2: Collect valid consent
Regulators and the European Data Protection Board describe consent as freely given, specific, informed and unambiguous. In practice that gives you a short list.
- An action, not silence: an unticked box or a button that clearly means yes. Pre-ticked boxes are not valid.
- Specific: say what people will receive, how often, and from whom.
- Separate: do not bundle marketing consent with terms of service or a purchase.
- Easy to withdraw: withdrawing must be as easy as giving, so link to preferences and unsubscribe in every message.
- No penalty: do not deny a service because someone declined marketing, unless the marketing is the service.
Sample wording for a sign-up form: Yes, send me product news and offers from Example Ltd by email. I can unsubscribe at any time. Link to your privacy notice next to the box.
Step 3: Keep records of consent
GDPR requires you to be able to demonstrate consent. Store enough to answer the question: who agreed, to what, when and how.
| Field | Example | Why |
|---|---|---|
| Email address | name@example.com | Identifies the person |
| Date and time | 2026-06-16 10:42 UTC | Shows when consent was given |
| Consent text | Version 3 of the sign-up wording | Shows what the person agreed to |
| Source | Newsletter form, footer | Shows where it was given |
| Proof of confirmation | Confirmation link clicked at 10:44 | Supports double opt-in |
| Later changes | Unsubscribed on 2026-09-02 | Shows the current status |
Step 4: Make opting out easy
Every marketing message needs a visible unsubscribe link, and mailbox providers also expect the one-click header described in the unsubscribe header guide. Honour requests promptly, do not require a login and do not ask for a reason before processing.
Step 5: Handle privacy requests
| Request | What it means | Typical action |
|---|---|---|
| Access | The person wants a copy of their data | Export what you hold and reply within one month |
| Rectification | The data is wrong | Correct it in all systems |
| Objection to marketing | The person does not want marketing | Suppress at once and keep a minimal record |
| Erasure | The person wants their data deleted | Delete what you can and keep only what the law lets you keep |
| Withdrawal of consent | The person takes back their consent | Stop the processing that relied on it |
Step 6: Know who does what
You usually decide why and how the personal data is used, which makes you the controller. MigoSMTP and similar providers act on your instructions as processors. Article 28 of GDPR asks for a written contract, the data processing agreement, covering instructions, security, sub-processors and what happens at the end of the service. Ask for it, check where your data is stored, and review any transfers outside the EEA or UK and the safeguards used.
| Question to ask your provider | Why it matters |
|---|---|
| Do you offer a signed data processing agreement? | Required when a processor handles personal data |
| Where is the data stored and which sub-processors are used? | Affects transfers and your own notices |
| How long are logs and events kept? | Affects your retention policy |
| How can I export or delete data? | Needed to answer privacy requests |
| What security measures protect the data? | Required by Article 32 |
A quick compliance checklist
- Every sign-up form has an unticked box or clear action and a link to the privacy notice.
- You store consent records and can search them by address.
- Every marketing email has a working unsubscribe link and one-click headers.
- A suppression list stops mail to people who objected or unsubscribed.
- You have a way to answer access and erasure requests within one month.
- A data processing agreement is in place with each provider.
- You review old lists and remove contacts you cannot show consent for.
Questions about data processing? Contact us to ask about the data processing agreement, data location and retention for your account.
Further reading and sources
Frequently asked questions
Does GDPR apply to my email marketing?
It applies if you offer goods or services to people in the EEA, or monitor their behaviour, or if you are established there, wherever the sender is based. The United Kingdom has its own version, often called UK GDPR, with similar rules. If your list includes people in these places, plan for them.
Do I always need consent to send marketing email?
Often, but not always. For individuals, the electronic marketing rules generally require prior consent, with a limited exception for existing customers who bought something similar and were given a chance to opt out. National rules differ, and the treatment of business addresses varies by country, so check the rules for each market you send to.
What counts as valid consent?
Consent must be freely given, specific, informed and unambiguous, and given by a clear action. Pre-ticked boxes, silence and inactivity do not count. People must be told who is asking and what they will receive, and consent to marketing must not be a condition of an unrelated service.
Is double opt-in required?
GDPR itself does not name double opt-in. It does require that you can show consent was given, and a confirmation email is a strong way to prove it and to filter out typos and fake sign-ups. In some countries regulators and courts expect it in practice, so many senders use it everywhere.
What is the soft opt-in?
It is an exception in some countries that allows marketing to existing customers about similar products or services without fresh consent, if they were offered a simple way to refuse when their details were collected and in each later message. It does not cover prospects or unrelated offers, and the details depend on national law.
What records should I keep?
Keep what lets you show consent: the address, the date and time, the consent wording the person saw, the form or page and the way they signed up, and any later changes such as unsubscribes. Keep these records only as long as you need them for that purpose.
How fast must I honour an unsubscribe?
The right to object to direct marketing is absolute, so stop marketing mail to that person promptly. Many providers aim for immediate suppression, and a delay of more than a few days is hard to defend. Never ask the person to log in or give a reason in order to unsubscribe.
Do I have to delete someone when they unsubscribe?
Not necessarily. Unsubscribing and erasure are different requests. To make sure the person is not mailed again, you normally need to keep a minimal suppression record such as the address. If someone asks for full erasure, delete the rest of their data and keep only what you are required or entitled to keep.
Who is the controller and who is the processor?
You decide why and how the personal data on your lists is used, so you are normally the controller. An email provider that sends on your behalf and follows your instructions is normally a processor. Article 28 requires a written data processing agreement between the two, so ask your provider for theirs.
Can I use open and click tracking under GDPR?
Tracking pixels and tracked links collect information from the recipient device. Some regulators treat this as needing consent or at least clear notice, and others accept a legitimate interest approach with transparency. Explain tracking in your privacy notice, and take a conservative approach for markets where regulators have been strict.