GDPR

The GDPR (General Data Protection Regulation) is the European Union’s law on how organisations collect, use and protect personal data about people. The UK keeps its own version, known as the UK GDPR. It matters to marketers because almost every email list, ad audience and analytics report involves personal data, so the rules shape what you can do and how you must do it.

Key Takeaways

• The GDPR applies to personal data, which includes names, emails, IP addresses and cookie IDs.
• It sets seven key principles, from lawfulness and transparency to data minimisation and accountability.
• You need a lawful basis, such as consent or legitimate interests, before you use personal data.
• People have rights, including access, erasure and the right to object to direct marketing.
• In the EU, the most serious breaches can lead to fines of up to €20 million or 4% of global annual turnover, whichever is higher.

What Is GDPR?

In simple terms, the GDPR is a set of rules for anyone who handles information about identifiable people. It covers what you collect, why you collect it, how long you keep it and how you protect it.

However, it also reaches beyond Europe. Article 3 says it applies to organisations outside the EU when they offer goods or services to people in the EU, or monitor their behaviour there. So a US or Nigerian business marketing to people in France may still need to follow it.

For marketers, the key idea is personal data. The UK’s Information Commissioner’s Office (ICO) explains that this can be as simple as a name, but it can also include an IP address or a cookie identifier. In other words, a lot of marketing data counts.

How GDPR Works

The law works through principles, lawful bases and individual rights. First, you follow the principles. Next, you choose a lawful basis for each use of data. Finally, you respect people’s rights and prove that you comply.

The Seven Principles

The ICO lists seven key principles from Article 5:

• Lawfulness, fairness and transparency: use data legally, fairly and openly.
• Purpose limitation: collect data for clear purposes and don’t reuse it in ways that clash with them.
• Data minimisation: collect only what you need.
• Accuracy: keep data correct and up to date.
• Storage limitation: don’t keep data longer than necessary.
• Integrity and confidentiality: keep data secure.
• Accountability: take responsibility, and be able to show you comply.

Lawful Bases

Next, you must have a valid reason, called a lawful basis, for each use of personal data. Article 6 of the EU GDPR lists six: consent, contract, legal obligation, vital interests, public task and legitimate interests. The ICO now lists seven for UK law. It also says you must choose your basis before you start, record it and include it in your privacy information.

Individual Rights

In short, people keep control over their data. The ICO lists rights including the right to be informed, to access their data, to correct it, to have it erased, to restrict processing, to move it and to object. There are also rules on automated decisions and profiling.

GDPR Examples in Marketing

Here are three made-up examples:

• Newsletter sign-up (example): A shop adds a clear tick box for marketing emails and links to its privacy notice. It records when and how each person agreed, so it can prove consent later.
• Data request (example): A customer asks what data a brand holds about them. The team exports the contact’s CRM record, order history and email activity, and sends it securely.
• Ad audiences (example): An agency wants to upload a client’s customer list to an ad platform. First, it checks that the client’s privacy notice covers this use and that the lawful basis fits.

In each case, the business thinks about the person behind the data before acting.

GDPR vs Other Privacy Rules

In practice, marketers often meet several rules at once. Here is a simple comparison:

So GDPR sets the general rules on personal data, while rules like PECR add extra detail for cookies, emails and texts.

Fines and Data Breaches

Under the EU GDPR, there are two fine levels. The higher one, for breaking core rules such as the basic principles, is up to €20 million or 4% of total worldwide annual turnover, whichever is higher. By contrast, the lower one is up to €10 million or 2%.

In addition, breaches have their own rules. Article 33 says that, where feasible, you must report a personal data breach to the regulator within 72 hours of becoming aware of it, unless it is unlikely to put people at risk.

How to Make Your Marketing GDPR-Friendly

Follow these steps to get the basics right:

1. Map your data. List what personal data you hold, where it lives and why you have it.
2. Choose and record a lawful basis. Do this for each use, such as email marketing or analytics.
3. Update your privacy notice. Explain what you collect, why, and people’s rights, in plain words.
4. Get valid consent where you need it. Make it freely given, specific, informed and clear.
5. Collect less. Remove form fields you don’t really use.
6. Set retention periods. Delete or anonymise data you no longer need.
7. Plan for requests and breaches. Know who handles a data request, and how you would report a breach in time.

A Quick Consent Check

Many marketers rely on consent for email marketing, so it pays to get it right. The ICO’s test is that consent must be freely given, specific, informed and unambiguous. So, before you add anyone to a list, ask four short questions. First, did they choose freely, without a pre-ticked box? Second, did they agree to this specific use? Third, did they know who you are and what you’ll send? Finally, can you show a clear action, such as a tick or a click? If the answer to any question is no, then you should fix the form before you send.

Best Practices

A few habits keep you on the right side of the rules:

• Make unsubscribing easy. Respect the right to object to direct marketing at once.
• Check your tools. Make sure email platforms, CRMs and ad tools protect data properly.
• Train the team. Everyone who touches customer data should know the basics.
• Keep records. Accountability means you must be able to show what you did and why.

Common Mistakes to Avoid

First, many marketers think GDPR only applies to big companies or to firms based in Europe. Second, they rely on consent but can’t prove when or how it was given. Third, they collect lots of data “just in case”. Finally, they keep old lists forever. Each of these breaks a core principle, and each is easy to fix with clear habits.

Where You’ll Use GDPR at Work

Privacy knowledge appears in marketing, sales and customer roles. For example, current remote job listings ask for:

• “Working knowledge of CAN-SPAM, CASL, GDPR/UK GDPR, TCPA, and LinkedIn terms of service as they apply to outbound outreach” (Growth Marketing Consultant, B2B Strategy).
• “Familiarity with data privacy regulations (e.g., GDPR, CCPA)” (Customer Success Manager).
• Someone to “Ensure data security in compliance with GDPR and PCI standards” (Customer Care, Tech Brand).

So whether you aim to be a Digital Marketing Manager, Growth Marketer or Freelance Digital Marketer, you’ll need to build campaigns that respect these rules. They shape how you collect and use first-party data in particular.

Learn It in the Full Stack Programme

To run compliant campaigns across every channel, the Full Stack programme covers all four DMSI tracks and all ten courses, with one portfolio project from each. That includes email automation, lead generation and analytics. You also get unlimited 1-on-1 mentoring and a U.S. Project Internship from day one.

For ethical ways to grow your audience, read our guide to email list building.

Frequently Asked Questions

What is GDPR in simple terms?

It is a European law that sets rules for collecting, using and protecting personal data, and gives people rights over their information.

Does GDPR apply to businesses outside Europe?

It can. Article 3 says it applies when a business offers goods or services to people in the EU, or monitors their behaviour there.

Do I always need consent under GDPR?

No. Consent is one lawful basis. Others include contract, legal obligation and legitimate interests. However, some rules, such as those on cookies, often require consent.

What is the maximum GDPR fine?

In the EU, it is up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious breaches.

What rights do people have under GDPR?

They include the rights to be informed, to access, correct and erase their data, to restrict or object to its use, and to data portability.

Sources: ICO: The data protection principles; ICO: A guide to lawful basis; ICO: A guide to individual rights; GDPR Article 83: Fines; GDPR Article 3: Territorial scope; remote job listings on Himalayas.