A Practical Guide to GDPR and Privacy

The General Data Protection Regulation took effect on May 25, 2018, and for marketing teams the practical question wasn’t “is this a good idea,” it was “what exactly do we need to change in our systems.” Here’s how the mechanics work.

Lawful basis: the concept everything else hangs on

Under GDPR, you need a specific legal justification, a lawful basis, before you can process someone’s personal data at all. There are six recognized bases, but marketing teams mostly work with two of them:

• Consent. The person has actively and specifically agreed to a particular use of their data. Pre-ticked boxes and buried opt-outs don’t count; consent has to be a clear, affirmative action, and it has to be as easy to withdraw as it was to give.
• Legitimate interest. You can process data without explicit consent if you have a genuine business reason, it’s balanced against the individual’s rights and they’d reasonably expect it. Sending a follow-up email to an existing customer about a related product often qualifies. Buying a cold list and emailing strangers generally doesn’t.

Getting the basis wrong doesn’t just create legal risk, it determines what you’re allowed to do with the data later. Data collected under consent for one specific purpose can’t simply be repurposed for something else without going back for fresh consent.

What changed for email marketing specifically

Pre-GDPR, many email lists had been built through pre-checked newsletter boxes at checkout, purchased lists or vague blanket consent buried in a terms-of-service page. None of that held up under the new standard. Practically, this meant:

• Consent had to be specific to email marketing, not bundled into agreeing to terms of service generally.
• Existing lists needed to be re-permissioned, or removed, if the original consent didn’t meet the new bar. A wave of “please confirm you still want to hear from us” emails went out across the industry in early 2018 for exactly this reason.
• Every email needed an easy, one-click way to withdraw consent, not a multi-step unsubscribe process designed to create friction.

What changed for analytics and advertising

Cookies and tracking scripts that collect personal data (which, under GDPR, includes things like IP addresses and device identifiers, not just names and emails) needed a lawful basis too. This is where cookie consent banners, largely absent or purely decorative before 2018, became a functional requirement: sites needed to get affirmative consent before non-essential tracking scripts fired, not just disclose that tracking existed somewhere in a privacy policy.

Advertising platforms that relied on granular behavioral targeting had to adjust as well, since much of that targeting depends on tracking data that now required a valid lawful basis to collect and use in the first place.

The rights that come with this

GDPR also gave individuals specific rights that a business needs a working process to honor: the right to see what data you hold on them, the right to have it corrected and the right to have it deleted (the “right to be forgotten”). For a marketing team, this meant knowing exactly where customer data lived, across the CRM, the email platform, the analytics tool and anywhere else, well enough to locate and remove a specific person’s records on request within the required timeframe.

The practical starting checklist

1. Map every place personal data is collected and stored across your marketing stack.
2. Identify the lawful basis for each use of that data, and fix the ones that don’t hold up.
3. Rebuild consent flows so they’re specific, affirmative and easy to withdraw.
4. Add a functional cookie consent mechanism that blocks non-essential tracking until consent is given.
5. Build a real process for handling access, correction and deletion requests.

None of this was about avoiding marketing to European customers altogether. It was about being able to demonstrate, concretely, that every piece of personal data in use had a legitimate basis behind it.

---

More from the Marketing Analytics archive, everything published in 2018 and the Digital Business Marketing Awards.