Email: how to be GDPR compliant?
Tags: email, gdpr, deliverability
Published: 2022-10-18 09:41:51

The General Data Protection Regulation (GDPR) that has been effective since May 25, 2018 enforce the notion of consent regarding the processing of customers’ personal data. It impacts marketing and sales procedures. Companies must take action or face fines from the national authorities like [CNIL](https://www.cnil.fr/) (Commission Nationale de l’Informatique et des Libertés) in France or United Kingdom’s ICO (Information Commissioner’s Office), which can carry out checks at any time. Here are some rules for good compliance.

##How to create GDPR compliant email campaigns?


###1. Buying one of your services does not mean explicit consent
Do not sign someone up for an opt-in (newsletter, email marketing etc.) just because they have created an account or subscribed to a service, this is illegal.

###2. Don’t pre-check the boxes to collect your customers consent
The CNIL recommendations are clear, you must obtain [active consent](https://www.cnil.fr/fr/les-bases-legales/consentement) and therefore not pre-check the opt-in boxes. The GDPR adds another layer: consent must be clear, easy to understand and unambiguous.

###3. Keep a record of the consent collected to prove that it exists
No explicit consent, no marketing mail! And yes, it is strictly forbidden. You must be able to prove that your customer agreed to receive your marketing emails. It is recommended that consent be renewed at [regular intervals](https://www.cnil.fr/sites/default/files/atoms/files/ldconsentement_wp259_rev_0.1_fr.pdf), ensuring that the data subject is always well informed about how their data are used and how they can exercise their rights.

###4. Double opt-in rather than single opt-in
To collect consent, the CNIL recommends double opt-in (double confirmation). It is therefore not compulsory, but it is better to prove your good faith.

![An email to complete double opt-in](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5srrj4v1qmz5458ua10e.png) Source : [SendinBlue](https://www.sendinblue.com/blog/double-opt-in/)


###5. Always provide an unsubscribe link and a dedicated address in your emails
It is compulsory, if you have a DPO, mention their name and email. Your customer must be able to request that you stop sending them marketing emails or delete their data at any time.

###6. Service providers must also be compliant with the GDPR
Any third-party tools you use, which are therefore required to process your customers’ information, must be GDPR compliant. This is particularly the case if these third-party tools are outside the European Union with their own regulations, otherwise everything you put in place is obsolete.

###7. Make data collection practices public
Detail in your privacy policies all the uses you will make of the information you collect about your customers.

###8. An updated database
Finally, a small subtlety concerning the updating of consent, you must update the collection of consent but be careful not to shoot yourself in the foot unnecessarily.

The communication channels (emails among others) are dissociated from the [GDPR](https://www.cnil.fr/fr/rgpd-de-quoi-parle-t-on). The GDPR only mentions the processing of personal data, not the channels for doing so.

In B2B (legal entity), it is not necessary to have prior consent to process data and send prospecting emails to companies. The [CNIL specifies](https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique) that prospecting by email is possible without consent under certain conditions and in a measured way. The products offered must make sense to the prospect. It is therefore not necessary to send an opt-in confirmation to your existing database in this case, but rather to send an email inviting them to unsubscribe if they wish.

In B2C (natural persons), a clear opt-in must be obtained. The only place where it is possible to canvass without consent is precisely… in transactional emails! Following a purchase, it is possible to offer the buyer other similar products. As long as the commercial relationship exists, it is possible to offer products (sending invoices, confirming purchases, etc.).

So don’t bother yourself and especially don’t bother your customers unnecessarily with the collection of consent when it is not useful!

**Sources** :

- [https://www.cnil.fr/fr/les-bases-legales/consentement](https://www.cnil.fr/fr/les-bases-legales/consentement)
- [https://www.cnil.fr/sites/default/files/atoms/files/ldconsentement_wp259_rev_0.1_fr.pdf](https://www.cnil.fr/sites/default/files/atoms/files/ldconsentement_wp259_rev_0.1_fr.pdf)