Summary
You may already know about General Data Protection Regulation (GDPR), but you might still have a few questions about it.
Here is some information about this European law and how it affects your email marketing campaigns.
This article is presented as a resource, it’s not legal advice. If you need more information we recommend that you speak with a lawyer to learn how GDPR affects your company.
What is GDPR (General Data Protection Regulation)?
When the internet was introduced the EU issued the 1995 European Data Protection Directive. As technology advanced it was replaced by GDPR, which was introduced on May 25, 2018 and is a regulation that applies to any data collected, stored and used on citizens of the European Union, even if they are not based there.
Whilst it is a long and complex regulation, we can help you better understand the key factors that you need to observe, up to date as at the time this article was written, August 2021.
The 7 Principles
Article 5 of the GDPR regulation includes the 7 principles to follow, summarised here:
Lawfulness, fairness and transparency — whatever the use of someone’s personal data, it must be lawful, fair, and transparent to that individual.
Purpose limitation — only use the data for the purpose you stated when getting it and it must be legitimate and legal.
Data minimization — limit the use of the data to the absolute minimum for what you need to achieve.
Accuracy — if you save the data, it must be kept accurate and up to date.
Storage limitation — personal data must be safely deleted once you’ve used it for the purpose stated when you collected it.
Integrity and confidentiality — appropriate security must be used when processing the data, ensuring integrity and confidentiality, eg, data encryption.
Accountability — the owner of the business, or “data controller” must be able to demonstrate GDPR compliance with all of these principles.
Let’s take a closer look at some of this to help understand how to apply the regulation in your business.
Purpose
Personal data, identifying data, has to be processed lawfully, fairly, securely, and transparently, meaning the individual for whom it concerns must be aware of its use. Data has to be collected legitimately and you have to be explicit on how you are going to use it, and be able to demonstrate the relevance, limiting the use to that purpose only.
An important fact to remember is that all personal data must be stored securely and cannot be kept longer than it is necessary to complete the purpose for which you collected it in the first place. The owner of the business, the “controller” is responsible for complying with the regulations and must be able to demonstrate compliance.
Conditions of consent
Therefore you have to prove that the individual consented to the processing, when they did, what they were told at that time, how they consented to it, and if they have since withdrawn consent. An opt-in tick box should be used to indicate consent. Moreover, you could also offer a double opt-in, which, whilst not legally required, may increase your email deliverability, with the individual agreeing for you to use their email address and sign up to your emails.
Deleting personal data
Data breaches
Generally, one of the principal reasons for data breaches is when an unauthorised data subject receives personal data by mistake. Moreover, It can happen that there is a modification in the personal data without consent, the technology instruments that contain the personal data were stolen or lost, or accidental action by the controller.
Can I still use email marketing?
This law doesn’t harm email marketing campaigns, it is just a new way to protect more of the consumer’s data. But the service providers always filter those emails considered as spam. So if you do well in email marketing you don’t have anything to worry about, just follow our recommendations.
What the GDPR is to clarify the terms and put them in words. You have to ask your receptors if they want to be in your opt-in in order to be able to have interactions with them. Moreover, you also have to with them the choice to switch and be in opt-out.
Therefore, you may still cold email in a B2B context while respecting some rules:
Do you need professional help to
adapt your email campaigns with the GDPR?
Target your prospect carefully
Be transparent
Don’t use personal information longer than needed
GDPR mostly restricts bulk emailing and spamming, but targeted cold email campaigns are still efficient, in fact, statistics suggest that cold emailing has never been more efficient and widely used among the online sales channels that companies use.
As you see, you do not need consent to email someone as long as the content is highly relevant, that you provide a clear unsubscribe link and reason to contact, and that you don’t overuse your data.
