GDPR Email Marketing: A Practical Compliance Guide
Stop repeating the most popular advice in GDPR email marketing. It goes like this: if an email address is public, you can mail it under legitimate interests. That sentence has created more regulatory exposure than any bad subject line ever will.
Public availability answers where you found the data. It doesn't answer whether you may process it, market to it, or keep mailing it after someone objects. Treat compliance as a per-recipient decision, not a per-list policy, and most of the confusion disappears.
Table of Contents
- Separate the Questions Your Team Keeps Merging
- Consent Is a Record You Can Produce
- Score Each Basis Against a Cold Send
- Apply the Three Parts in Order - Legitimate Interest Assessment Per-Record Fields
- Three Cases Every Sender Should Know
- Capture Provenance at Collection - Decide Eligibility Before Enrichment
- Recipient Type and Marketing Rules at a Glance - Build the Decision Into the Row
The Uncomfortable Truth About Public Instagram Emails
A public Instagram email is not permission. A creator may publish an address for brand deals, press, or customer enquiries. That context doesn't give every agency, software vendor, and dropshipper a right to send unsolicited promotions.
You're facing two separate layers. First, you need a GDPR lawful basis for processing the personal data. Second, you must satisfy the electronic marketing rules in the recipient's country. Passing the first test doesn't waive the second.
Separate the Questions Your Team Keeps Merging
The European Commission says organisations using contact lists for direct marketing must keep data up to date, suppress people who object, inform individuals no later than the first communication, and comply with the ePrivacy Directive when email is used, as set out in the European Commission guidance on legal grounds for processing data. Those duties exist before your first send performs well or badly.
- Public means visible: It doesn't mean freely reusable for any commercial purpose.
- Business context matters: A bookings address supports relevant enquiries, not unrelated bulk offers.
- Status unknown means hold: If you can't establish recipient type and jurisdiction, don't guess.
My rule: If a record can't explain its own lawful basis without a salesperson narrating it, the record isn't ready to send.
Better extraction can increase, not reduce, exposure. Enrichment, segmentation, and repeated touches make deliberate targeting easier to evidence. This is why responsible sourcing starts with the principles in HarvestMyData's guide to data collection ethics. Teams working with creators should also understand adjacent disclosure duties through these influencer marketing rules, because outreach, sponsorship, and promotion often overlap operationally.
UK GDPR and PECR in Plain English
In the United Kingdom, UK GDPR and PECR overlap, but they do different jobs. UK GDPR governs lawful processing of personal data. PECR specifically covers direct marketing sent by email, text, or other electronic messages, as explained in the ICO guidance on complying with PECR electronic mail marketing rules.
The diagram below shows why you can't collapse them into one checkbox in your privacy policy.
Consent Is a Record You Can Produce
For unsolicited marketing emails to individuals, the default rule is prior, specific consent. It must be freely given, separate from unrelated terms, clear about the organisation and purpose, and shown through affirmative action such as ticking a box. Silence, bundled terms, and a publicly displayed address don't meet that standard.
The soft opt-in is narrower than sales teams want it to be. You may market similar products or services to an existing customer only when the address was collected during a sale or genuine negotiations, the person could refuse marketing at collection, and every message offers a straightforward opt-out. Someone who merely follows an Instagram account hasn't entered sale negotiations with you.
This short video helps visualise the distinction before you apply it to a live list.
Individuals can object to direct marketing at any time, and you must respect that objection. Don't ask them to justify it. Suppress the address and move on.
Larger organisations that need help translating overlapping duties into operating controls often look at enterprise data protection consulting. Smaller teams still need the same discipline, even if the control lives in a spreadsheet rather than a governance platform.
The Six Lawful Bases and Which Ones Survive Cold Outreach
GDPR gives you six lawful bases. Cold outreach kills most of them quickly.
The comparison below is the fastest way to stop a team inventing a basis because the campaign deadline is close.
Score Each Basis Against a Cold Send
- Consent: Strong when it's specific, informed, and evidenced. Usually absent for extracted prospects.
- Contract: Covers messages needed to perform an agreement, such as delivery or account notices. It doesn't authorise prospecting strangers.
- Legal obligation: Applies when law requires processing. Your pipeline target isn't a legal duty.
- Vital interests: For protecting life. It has no credible role in sales outreach.
- Public task: For public authorities and official functions. Private lead generation doesn't qualify.
- Legitimate interests: The only commonly arguable basis for some business contact processing, but it requires a documented balancing test.
Don't oversell that last point. A lawful basis under GDPR doesn't override an applicable ePrivacy or PECR consent requirement. That's the distinction I see missed most often in list reviews.
Direct marketing may be a legitimate interest in some circumstances. It does not automatically qualify every marketing activity.
If consent is your basis, prove who gave it, when, how, and for what sender and purpose. If legitimate interests is your basis, document the assessment before sending. Teams building audit evidence can check AuditReady's compliance evidence toolkit for a useful perspective on lawfulness documentation.
Delivery quality won't rescue an unlawful list. Pair legal screening with the operational discipline in HarvestMyData's cold email best practices guide, then remove records that fail either test.
Running the Legitimate Interest Assessment on a Single Record
A legitimate interest assessment is a three-part technical test. It isn't a sentence in your privacy notice saying you value business development.
The European Data Protection Board warns that direct marketing may constitute a legitimate interest in some circumstances but doesn't automatically qualify every activity under Article 6(1)(f), as explained in the EDPB guidelines on legitimate interest. Run the test on an individual record and keep the result with that record.
Apply the Three Parts in Order
- Identify a genuine interest: State the concrete purpose, such as contacting a venue's events manager about a directly relevant booking service.
- Prove necessity: Explain why processing this address is necessary and why a less intrusive route won't achieve the same purpose.
- Balance the impact: Weigh your interest against expectations, rights, message relevance, frequency, enrichment, and likely intrusion.
Ask why this person would reasonably expect contact from you. A public business address can reduce privacy expectations, but it doesn't eliminate them. Bulk extraction, country enrichment, profiling, or an unrelated offer increases intrusion and weakens necessity.
Legitimate Interest Assessment Per-Record Fields
| Field | Purpose | Example |
|---|---|---|
| Lawful basis | Shows the basis relied upon | Legitimate interests |
| Assessment version | Links the record to the test used | LIA v2.1 |
| Jurisdiction | Applies the correct marketing rule | United Kingdom |
| Notice status | Shows transparency has been given | First-contact notice sent |
| Objection timestamp | Records when rights were exercised | Date and time logged |
| Suppression flag | Prevents future sends permanently | Suppressed, immutable |
If the assessment fails, don't send. If prior consent is required in that jurisdiction, a polished balancing test won't substitute for it. Obtain valid consent or delete the prospect from the campaign.
What Real Enforcement Looks Like
Regulators don't begin by admiring your intentions. They ask for consent evidence, suppression records, and an explanation of why each recipient was mailed.
Three Cases Every Sender Should Know
In March 2017, the ICO fined Flybe £70,000 after it sent marketing email to people who had asked not to receive electronic marketing, and fined Honda £13,000 because it couldn't demonstrate recipients had consented, according to the ICO guide explaining what PECR covers and its enforcement context. Honda is the lesson many teams miss. Claiming permission existed wasn't enough when the records couldn't prove it.
ZMLUK Limited shows the third-party data problem at scale. Between January and July 2023, it sent more than 67 million marketing emails using data obtained from a third party. Presenting people with 361 possible partner organisations, without letting them choose who could contact them, didn't create specific and informed consent.
- Flybe teaches suppression discipline: An objection must stop future marketing.
- Honda teaches evidential discipline: If you can't demonstrate consent, treat consent as absent.
- ZMLUK teaches specificity: Bundled partner permission doesn't identify a sender clearly enough.
The UK regulator can impose monetary penalties of up to £500,000 under PECR, with separate GDPR exposure for transparency, lawful basis, rights, and accountability. Don't wait for an inquiry to discover your list has no provenance.
Building a Compliant Data Pipeline From Extract to Send
Build three control layers between extraction and send: collection provenance, marketing eligibility, and suppression status. If any layer is missing, the campaign isn't ready.
A compliant approach separates those controls and stores provenance, intended purpose, jurisdiction, and evidence of consent or another applicable exception for every address, consistent with the ICO guidance on other requirements for electronic mail marketing.
Capture Provenance at Collection
For each record, store the source URL, collection timestamp, profile context, intended purpose, jurisdiction, and lawful-basis field. Add the assessment outcome where legitimate interests is claimed. Don't reconstruct provenance from browser history after a complaint arrives.
Where a team uses HarvestMyData to turn public Instagram audiences into structured CSV or Excel files, that export is only the start of the workflow. Add your compliance fields before the file reaches a CRM or sending tool.
Decide Eligibility Before Enrichment
Classify each recipient as a consumer, sole trader, corporate role account, or existing customer. Then apply the relevant consent, soft opt-in, or other national rule. Enrichment should never be used to manufacture relevance after eligibility has already failed.
- Run suppression before every campaign: Don't rely on last month's cleaned file.
- Make unsubscribe immediate: A delayed suppression queue creates avoidable sends.
- Preserve objection records: Suppressing without deleting the flag prevents accidental re-imports.
- Keep one controlled source: Fragmented spreadsheets make inconsistent decisions inevitable.
Understand the wider collection context through HarvestMyData's overview of website scraping legality. Lawful collection, lawful processing, and lawful email marketing remain separate gates.
Recipient Type and Jurisdiction Decide the Rules
Stop asking whether your list is compliant. Ask whether this recipient, in this jurisdiction, for this message purpose, is eligible.
In the UK, email marketing to individuals, sole traders, and some partnerships generally requires consent or a narrow soft opt-in, while corporate subscribers are treated differently. In the EU, unsolicited direct marketing email generally sits under national ePrivacy implementations requiring prior consent, subject to local rules and exceptions.
Recipient Type and Marketing Rules at a Glance
| Recipient Type | UK PECR | EU ePrivacy | US (CAN-SPAM) |
|---|---|---|---|
| Consumer | Prior consent or qualifying soft opt-in | Generally prior consent, subject to national implementation | Opt-out model, with state privacy duties to consider |
| Sole trader | Generally treated like an individual | Often individual protection, depending on national law | Business address may still be personal data under state laws |
| Corporate role account | Corporate subscriber rules may apply, with opt-out required | National rules vary for legal persons and role accounts | Commercial email duties and opt-out still apply |
| Existing customer | Soft opt-in only if all conditions are met | Similar-customer exceptions vary by member state | Existing relationship doesn't remove identification and opt-out duties |
Build the Decision Into the Row
Tag recipient category and jurisdiction on every record. Route unknown records to hold, not to a low-volume test. Volume doesn't cure an unlawful basis, and a small send still creates an unhappy recipient who can complain.
The United States isn't a free zone either. CAN-SPAM works differently from European opt-in regimes, and state privacy laws can change how business contact data is handled. Use the strictest applicable workflow your record triggers, rather than letting the sender's location decide.
The 2026 Compliance Checklist and What's Coming Next
Before the next campaign, verify each record's lawful basis, recipient type, jurisdiction, notice status, and suppression flag. Test the unsubscribe yourself and confirm it prevents the next send immediately.
- Provenance complete: Source URL, timestamp, and profile context are stored.
- Eligibility decided: Consent, soft opt-in, or another valid route is documented.
- Assessment retained: Any legitimate interest claim has a versioned record.
- Suppression applied: The current list has been checked before sending.
- Notice ready: Your first communication explains who you are and why you're contacting them.
AI-driven enrichment will make weak balancing tests harder to defend because profiling becomes easier to show. Treat GDPR email marketing as a documented operating discipline, and remove records you can't defend.
Turn public Instagram audiences into structured contact files you can screen, document, and suppress before outreach by using HarvestMyData for follower, following, hashtag, commenter, and liker exports. Build your per-record compliance fields into the workflow from the first file, not after the first complaint.
We built HarvestMyData to handle all of this for you.
No proxies, no code, no account needed.