{"id":4210,"date":"2018-04-05T13:00:46","date_gmt":"2018-04-05T12:00:46","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=4210"},"modified":"2026-01-29T10:39:19","modified_gmt":"2026-01-29T10:39:19","slug":"gdpr-and-marketing","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/gdpr-and-marketing\/","title":{"rendered":"GDPR and marketing: Here\u2019s what your business needs to know"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tGDPR and marketing: Here\u2019s what your business needs to know\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t

\n\t\t
\n\t\t\t
\n\t\t\t
\n\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tStacey McIntosh<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t<\/div>\n\t\t<\/div>\n\n\n\n
\n
<\/video><\/div><\/div>\n<\/div><\/figure>\n\n\n\n

When the General Data Protection Regulation<\/a> (GDPR) comes into force on 25 May 2018, it will affect all areas of your business. However, one area to especially be aware of is marketing. Preparing a plan for the GDPR and marketing will be important as this is one area where your business comes into contact with a lot of personal data \u2013 from both potential customers and existing ones too.<\/p>\n\n\n\n

When thinking about the GDPR<\/a> and marketing, consider the fact that changes to your processes will probably need to be made across all areas, including email marketing and direct marketing. When planning for the GDPR, marketing consent \u2013 and your processes around it \u2013 is important to look at too.<\/p>\n\n\n\n

Read on for more details on how the new legislation will affect your marketing operations and what you need to do to be compliant with the GDPR.<\/p>\n\n\n\n

How GDPR affects marketing<\/strong><\/h2>\n\n\n\n

There are three key areas that GDPR<\/a> will affect marketing: the personal data that is asked for by marketers; individuals having more control over their personal data and how it is used; and marketers asking individuals for permission as to how they contact them rather than working by assumption. Here, we go into more detail in each area.<\/p>\n\n\n\n

1. Data requests can\u2019t be generic<\/strong><\/h3>\n\n\n\n

Rather than asking individuals for lots of data in the hope that some of it can be used for a future, unrelated task, you will have to be more specific in what you ask for. The GDPR requires you to justify the processing of the personal data that you are getting from individuals. What this change should lead to is marketers only collecting and processing relevant data.<\/p>\n\n\n\n

2. Individuals having access to their data<\/strong><\/h3>\n\n\n\n

With the GDPR allowing individuals to access or have their data removed, as a marketer, you need to make sure that your prospective and existing customers can access their data easily. And if they want to remove consent for their data to be used, this should be easy for them to do to. This comes under the right to be forgotten.<\/p>\n\n\n\n

3. Permission is required, assumptions are out<\/strong><\/h3>\n\n\n\n

This covers opt-ins, opt-outs and consent when communicating with individuals. When managing opt-ins with your prospective and existing customers, assumptions have to go out of the window and gaining permission is vital.<\/p>\n\n\n\n

As part of the GDPR, consent must be \u201cfreely given, specific, informed and unambiguous\u201d and done in a way that offers a \u201cclear affirmative action\u201d.  It\u2019s also worth realising that silence or inactivity from your customers, alongside pre-ticked boxes on forms, no longer constitute valid consent.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

GDPR<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

<\/p>\n

Need help with meeting your GDPR obligations and making sure your businesses processes are working in the correct way? Here’s what you need to know.<\/p>\n

<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tFind out more<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"Working\t\t\t<\/div>\n<\/div>\n\n\n\n

How GDPR affects email marketing<\/strong><\/h2>\n\n\n\n

When it comes to GDPR, email marketing will have to change where the management of email opt-ins and opt-outs are concerned. As highlighted above, you can\u2019t make an assumption that someone wants to receive your new email newsletter and feature a pre-ticked box.<\/p>\n\n\n\n

You need give people an option to opt-in to get your newsletter. Under the GDPR, you can\u2019t have a box that is already ticked and requires a user to opt-out if they don\u2019t want to have an email sent to their inbox.<\/p>\n\n\n\n

If people on your email list want their personal information to be removed, there should be a method in place for them to easily do so. A simple option would be to add an unsubscribe link within the emails that go out to your prospective and existing customers.<\/p>\n\n\n\n

Another form of good practice could be to create a user profile that allows people to manage their email preferences \u2013 it could let them select which emails they would like to receive from your business and ones they don\u2019t want to get.<\/p>\n\n\n\n

What do you need to do with existing marketing data?<\/strong><\/h2>\n\n\n\n

When it comes to existing databases for marketing leads, there are two tasks that need to be undertaken, at least, prior to the GDPR\u2019s implementation:<\/p>\n\n\n\n

    \n
  1. Legally review the consent that was used originally and see if it\u2019s compatible with the GDPR\u2019s requirements.<\/li>\n\n\n\n
  2. If your existing consent isn\u2019t sufficient and your team doesn\u2019t have another lawful basis for the processing of the data, you will have to contact each and every one of the individuals in the database to seek new consent or refrain from processing the data.<\/li>\n<\/ol>\n\n\n\n

    If after that you don\u2019t receive fresh and specific consent for the purposes that you want to process the data, then you need to suppress or delete the individual\u2019s data.<\/p>\n\n\n\n

    Estimates suggest the requirements highlighted above could reduce marketing databases by as much as 75%. However, on the positive side, that means the individuals who do respond with fresh consent to your requests will prove to be more valuable to your businesses as they are willing to have you engage with them.<\/p>\n\n\n\n

    However, it\u2019s worth remembering that consent is only one possible requirement for lawful processing. If you have an ongoing contract in existence between your business and a customer or client \u2013 or it is likely to do so soon \u2013 you don\u2019t necessarily have to get consent.<\/p>\n\n\n\n

    One example of this could be where that processing is required for the performance of a contract or in the legitimate interests of your business and\/or the customer. <\/strong><\/p>\n\n\n\n

    GDPR and marketing consent<\/strong><\/h2>\n\n\n\n

    When it comes to GDPR marketing consent, you will need to create new processes that are compatible with the legislation. They will be required for when it comes to dealing with personal data from individuals and it may involve getting consent.<\/p>\n\n\n\n

    Remember, assuming consent or using a single consent across all processing activities will not be allowed. The same goes for using a pre-ticked box on a website or email form to assume an individual is giving you consent.<\/p>\n\n\n\n

    When it comes to purchasing marketing leads, you\u2019ll have to make sure that the consent of each individual complies with the GDPR. That means they have been given clear and individual consent for their details to be sold on like this. However, as most people are unlikely to agree to this happening, the transfer, sale or purchase or marketing leads will probably become a rare activity. <\/strong><\/p>\n\n\n\n

    Marketing and dealing with customer enquiries<\/strong><\/h2>\n\n\n\n

    Under the GDPR, customers and clients will have rights allowing them to know what your business is doing with their data. It\u2019s worth realising that individuals will also have the right to withdraw consent, which is subject to certain exemptions. And in some cases, they will have to absolute right to withdraw consent from certain uses of it \u2013 one such example is direct marketing.<\/p>\n\n\n\n

    Your business will need to put procedures in place to deal with this \u2013 and perhaps staff too, such as a data protection officer<\/a>. Then your employees will have to perform certain tasks, such as clearing future marketing lists or documenting requests against your internal suppression list.<\/p>\n\n\n\n

    \n\t
    \n\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t\t\t

    GDPR webinar<\/h2>\n\n\t\t\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t

    Join us for a live webinar so you have a better understanding of GDPR, which came into force on 25 May 2018, and learn about how the legislation can benefit your business.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tFind out more<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"Here\t\t\t<\/div>\n<\/div>\n\n\n\n

    GDPR and data minimisation<\/strong><\/h2>\n\n\n\n

    The days of the \u201cfishing expedition\u201d side of marketing, where a checkbox or questionnaire is presented with a view to somehow using the data that\u2019s collected in the future are coming to an end. According to the GDPR, you won\u2019t be allowed to get lots of data from an individual without having the justification to do so.<\/p>\n\n\n\n

    Your new processes will require your business \u2013 and your marketing team \u2013 to show what data you are collecting and explain what it is that you intend to do with it. As part of those processes, you might need to get consent for using the data in a specific way. And remember, you should document when you intend to suppress or remove the data. <\/strong><\/p>\n\n\n\n

    How your marketing team can prepare for the GDPR<\/strong><\/h2>\n\n\n\n

    There are three things you can do to make sure your team is ready for the GDPR:<\/p>\n\n\n\n