Does GDPR apply to my business?

GDPR applies if you process personal data of EU/EEA residents, regardless of where your business is located. If you have subscribers in Europe or send emails to European email addresses, GDPR applies to you. This includes businesses in the US, UK, Asia, and anywhere else.

What consent is required for email marketing under GDPR?

GDPR requires freely given, specific, informed, and unambiguous consent. This means: no pre-checked boxes, clear language about what they are signing up for, separate consent for marketing (not bundled with terms of service), and records of when and how consent was obtained.

What is the difference between GDPR and CAN-SPAM?

GDPR (EU) requires opt-in consent before sending marketing emails. CAN-SPAM (US) allows opt-out, meaning you can email someone until they unsubscribe. GDPR has stricter data rights (access, deletion, portability). GDPR fines can reach 20 million euros or 4% of global revenue. If you email EU residents, you must comply with GDPR regardless of your location.

Do I need double opt-in for GDPR compliance?

Double opt-in is not explicitly required by GDPR, but it is strongly recommended because it provides clear evidence of consent. A confirmation email with a click-to-confirm link creates a verifiable consent record. Some EU regulators consider it best practice.

How long can I keep subscriber data under GDPR?

GDPR does not specify exact retention periods. Data should be kept only as long as necessary for its stated purpose. For email marketing, this means you should regularly clean inactive subscribers and have a documented retention policy. Two years of inactivity with no engagement is a common threshold for data removal.

What happens if a subscriber requests data deletion?

You must delete their personal data from all systems within one month of the request. This includes your email platform, CRM, analytics tools, backups (where feasible), and any third-party tools that process their data. You may retain data required for legal compliance (e.g., transaction records) but must stop all marketing use.

Is this tool a substitute for legal advice?

No. This tool provides general guidance on GDPR requirements for email marketing. It is educational and informational only. GDPR compliance depends on your specific situation, data processing activities, and jurisdiction. Consult a qualified legal professional for advice specific to your business.

What are Data Processing Agreements and do I need them?

A DPA is a legally binding contract between you (the data controller) and any third party that processes personal data on your behalf (the data processor). If you use an email service provider, analytics platform, or CRM that handles subscriber data, you need a DPA with each one. Most major ESPs provide standard DPAs on request.

Back to Tools

GDPR Email Compliance Checker

Audit your email marketing practices against GDPR requirements with this interactive checklist. Check consent collection, subscriber rights, data processing, and more.

Audit your email marketing practices against GDPR requirements. Answer each question to see your compliance score.

Do you collect explicit opt-in consent before sending marketing emails?

Required

Subscribers must actively choose to receive emails. Pre-checked boxes do not count as consent under GDPR.

Do you use double opt-in (confirmation email) for new subscribers?

Best Practice

While not strictly required by GDPR, double opt-in provides strong evidence of consent.

Do you keep records of when and how consent was obtained?

Required

You must be able to demonstrate that consent was given, including timestamp, source, and what was consented to.

Is marketing consent separate from terms of service or other agreements?

Required

Consent for email marketing must not be bundled with other consents or terms.

Can subscribers unsubscribe with a single click?

Required

Every marketing email must include a clear, easy-to-find unsubscribe mechanism.

Can subscribers request a copy of their personal data you hold?

Required

Under GDPR's right of access, individuals can request all data you hold about them.

Can subscribers request deletion of their data (right to be forgotten)?

Required

Subscribers have the right to request complete deletion of their personal data.

Can subscribers export their data in a portable format?

Required

GDPR gives individuals the right to receive their data in a structured, commonly used format.

Do your emails clearly identify who is sending them?

Required

Emails must clearly show the sender's identity, including company name and physical address.

Do your emails link to your privacy policy?

Required

Include a link to your privacy policy so subscribers can review how their data is used.

Is the purpose of each email consistent with what subscribers signed up for?

Required

Only send emails that match the purpose for which consent was given.

Do you have Data Processing Agreements with your email service provider?

Required

Any third party processing subscriber data on your behalf needs a DPA.

Do you only collect data that is necessary for your email marketing?

Required

GDPR's data minimization principle means collecting only what you need.

Do you have a data retention policy and regularly clean inactive subscribers?

Required

Data should not be kept longer than necessary for its purpose.

Do you have a data breach notification process?

Required

Under GDPR, you must report certain data breaches within 72 hours.

If you transfer data outside the EU/EEA, do you have appropriate safeguards?

Required

Data transfers to countries without adequate data protection require additional safeguards.

Do your signup forms comply with cookie consent requirements?

Required

If your signup forms use cookies or tracking, you need separate cookie consent.

Disclaimer

This tool provides general guidance and is for informational purposes only. It is not a substitute for professional legal advice. GDPR compliance depends on your specific circumstances, data processing activities, and jurisdiction. Consult a qualified legal professional for advice on your compliance obligations.

About GDPR and email marketing

GDPR (General Data Protection Regulation) applies to all organizations processing EU residents' data
Fines for non-compliance can reach up to 20 million euros or 4% of annual global turnover
Consent must be freely given, specific, informed, and unambiguous
Subscribers have the right to access, correct, delete, and export their data
Even if you are outside the EU, GDPR applies if you have EU subscribers

About this tool

GDPR compliance is not optional for any business sending emails to EU residents, and the fines for violations can reach 4% of annual global revenue. This interactive checklist covers the key requirements: consent collection, subscriber rights (access, deletion, portability), email content requirements, data processing agreements, and international transfers. Use this alongside our CAN-SPAM checker for US compliance, and make sure your emails include proper List-Unsubscribe headers. For technical compliance, verify your DMARC, SPF, and DKIM authentication.

Frequently Asked Questions

More Free Tools

View all tools

CAN-SPAM Compliance Checker

Verify your email campaigns meet CAN-SPAM Act requirements. Check for required elements like physical address, unsubscribe links, and proper sender identification to avoid penalties.

List-Unsubscribe Header Generator

Generate RFC 8058 compliant List-Unsubscribe and List-Unsubscribe-Post headers. Required by Gmail and Yahoo for bulk senders since 2024. Get ready-to-use headers and code snippets.

Email Accessibility Checker

Check your email HTML for accessibility issues. Analyze alt text, color contrast, font sizes, heading structure, link text, and more against WCAG guidelines.

Email Color Contrast Checker

Check WCAG color contrast compliance for your email designs. Enter foreground and background colors to get instant accessibility ratings for normal text, large text, and UI components with real-time preview.

GDPR Email Compliance Checker

Consent and Collection

Subscriber Rights

Email Content

Data Processing

International Compliance

Disclaimer

About GDPR and email marketing

About this tool

Frequently Asked Questions

More Free Tools

CAN-SPAM Compliance Checker

List-Unsubscribe Header Generator

Email Accessibility Checker

Email Color Contrast Checker

Consent and Collection

Subscriber Rights

Email Content

Data Processing

International Compliance

Disclaimer

About GDPR and email marketing