GDPR

​

What is GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation that governs how personal data is collected, processed, and stored. It took effect on May 25, 2018, and is one of the strictest data protection laws in the world. For email sending, GDPR sets strict rules about consent, data handling, and the rights of your recipients.

​

Who does GDPR apply to?

GDPR applies to you if:

• Your business is based in the EU/EEA
• You process personal data of individuals in the EU/EEA — regardless of where your business is located
• You send emails to recipients in the EU/EEA

If you have any EU/EEA subscribers or users, GDPR applies to your email sending.

​

Key principles for email

​

1. Lawful basis for processing

You need a lawful basis to send someone an email. For email marketing, the relevant bases are: Consent — the recipient has explicitly opted in to receive your emails. This is the most common and safest basis for marketing emails. Legitimate interest — you have a genuine business reason to contact the person, and their privacy rights don’t override that interest. This is harder to rely on and requires a documented assessment. For transactional emails (order confirmations, account notifications), the lawful basis is typically contract performance — the email is necessary to fulfill a service the recipient signed up for.

​

2. Explicit consent for marketing

GDPR requires explicit, informed, freely given consent for marketing emails. This means: Must do:

• Use a clear opt-in mechanism (unchecked checkbox, separate signup form)
• Explain what the recipient is signing up for (“Weekly product updates from SendKit”)
• Keep records of when and how consent was obtained

Must not:

• Use pre-checked checkboxes
• Bundle consent with terms of service (“By creating an account, you agree to receive marketing emails”)
• Use vague language (“We may contact you from time to time”)

​

3. Right to withdraw consent

Recipients must be able to withdraw consent as easily as they gave it. In practice, this means:

• Every marketing email must have an unsubscribe link
• Unsubscribing must be a one-click or two-click process
• Withdrawal must be processed promptly

​

4. Right to access

Recipients can request a copy of all personal data you hold about them. For email, this includes:

• Their email address and any associated data (name, preferences)
• Email sending history
• Consent records
• Any tracking data (opens, clicks)

​

5. Right to erasure (Right to be forgotten)

Recipients can request that you delete all their personal data. When a request is received, you must:

• Delete their contact record
• Remove them from all lists
• Delete any associated tracking data
• Confirm deletion to the recipient

​

6. Right to data portability

Recipients can request their data in a commonly used, machine-readable format (like CSV or JSON) so they can transfer it to another service.

​

Consent records

GDPR requires that you can prove consent was given. For each subscriber, you should store: If a recipient disputes their consent, you need this evidence.

​

Double opt-in

Double opt-in is a two-step process:

1. Recipient enters their email in your signup form
2. They receive a confirmation email with a link
3. They click the link to confirm their subscription

While not strictly required by GDPR, double opt-in is strongly recommended because:

• It proves the email address owner actually consented (not someone else using their address)
• It creates a clear consent record
• It reduces bounces and fake signups
• Regulators view it favorably

​

Data processing agreements

If you use a service like SendKit to send emails, you’re a data controller and SendKit is a data processor. GDPR requires a Data Processing Agreement (DPA) between controller and processor. A DPA defines:

• What data is processed
• How it’s processed
• Security measures in place
• What happens to data when the agreement ends

​

Email tracking and GDPR

Open tracking (via pixel) and click tracking collect personal data (the recipient’s behavior). Under GDPR:

• You should disclose tracking in your privacy policy
• Consider whether tracking is necessary (data minimization principle)
• Provide a way for recipients to opt out of tracking

​

Checklist for compliance

• Marketing emails only go to recipients who explicitly opted in
• Consent was recorded with what, when, and how
• Every marketing email has a working unsubscribe link
• You can process data access, erasure, and portability requests
• A Data Processing Agreement is in place with SendKit
• Your privacy policy covers email data collection and tracking
• You don’t use pre-checked checkboxes or bundled consent

​

FAQ