GDPR checklist for email marketing (12 points)

Run these twelve checks before every email campaign: consent, unsubscribes, your contact lists, vendors and a final review. If one fails, do not send. The list helps you catch common gaps. It is not legal advice, and the rules depend on where your contacts live.

Which rules apply to you

The GDPR covers personal data across the EU and EEA. The UK has its own version of the GDPR and PECR for electronic marketing. Many EU countries add national rules for commercial email. Read the GDPR text on EUR-Lex, check the rules in each country where your contacts live, and confirm edge cases with a qualified adviser.

Consent and sign-up (checks 1 to 4)

1. Every contact has a record of consent. Store when, how and with what wording they agreed. Under Article 7(1) of the GDPR, you must be able to show consent.
2. No pre-ticked boxes. Consent needs a clear action. Silence or a pre-ticked box is not consent (Recital 32).
3. Each purpose gets its own choice. If consent is asked for together with other terms, the request has to be clearly separate (Article 7(2)).
4. People see what they sign up for at the point of sign-up. Who you are, what you will send, how to unsubscribe and how to use their rights (Article 13).

Unsubscribes and preferences (checks 5 and 6)

5. Unsubscribing takes one click and no login. Nobody should have to sign in or pay to leave a list.
6. An unsubscribe applies to every list and every automation. Someone who opted out should not get a welcome email or a cart reminder the next day.

Your lists (checks 7 and 8)

7. Do not buy lists without proof of origin. Ask the seller how each address consented. If they cannot show it, do not use the list.
8. Know which rule applies to each recipient. In the EU, marketing email consent comes from national laws based on the ePrivacy Directive, and they differ. Many of those national laws ban unsolicited commercial email unless the person agreed, with exceptions for some existing customers. The UK applies PECR.

Vendors and data rights (checks 9 to 11)

9. Every vendor that processes data for you has a contract. Your email tool, CRM and form builder need a data processing agreement (Article 28 of the GDPR).
10. You can delete one person everywhere. Know where their data sits (CRM, email tool, forms, exports) and how fast you can remove it. Requests generally need an answer within one month (Article 12(3)).
11. Only the right people can export or send. Set permissions by role. In Flowgration, permissions are set per module, per user or per role.

Before you send (check 12)

12. Review each campaign before it goes out. Right segment, opted-out contacts excluded, sender identified, a working unsubscribe link and a subject line that matches the content.

How to use this list

Run the full list once a quarter and before any large send. Record the date and who checked. If you cannot tick a point, write down why and when you will fix it. That record helps if someone complains.

Frequently asked questions

Do I need consent to email past customers?

Often not, but it depends on the country and the content. Many EU rules allow marketing about similar products to existing customers, with a clear way to opt out. Check your local rules before you send a new type of campaign.

Is double opt-in required by the GDPR?

No. The GDPR does not require double opt-in. It does require you to be able to prove consent. Double opt-in is one practical way to do that and to remove mistyped addresses.

What is a consent log?

A record for each contact: the date, the source form, the wording they accepted and any later withdrawal. It is your evidence if someone says they never agreed.

Can I email a generic business address?

Check your local rules. Many countries treat business addresses differently from personal ones, and the line is not always clear. Handle generic inboxes with the same care as personal ones until an adviser confirms your case.

What if someone asks me to delete their data?

Act without undue delay and within one month. Delete the person from your CRM, email tool and forms. If you need to avoid contacting them again, keep only a suppression entry.

Does this checklist make me compliant?

No. It helps you spot common gaps. Compliance depends on your data, your purposes and your country. For fines or data breaches, talk to a lawyer or your data protection officer.

For the CRM side of GDPR, read GDPR and CRM compliance. For the technical side of sending, see email deliverability: SPF, DKIM and DMARC. For how we handle security, see security.