'/%3e%3ccircle%20cx='100'%20cy='100'%20r='84'%20fill='%23093e47'/%3e%3ccircle%20cx='100'%20cy='100'%20r='79'%20fill='url(%23teal)'/%3e%3cg%20transform='translate(55,55)'%20stroke='url(%23cmd)'%20stroke-width='11'%20fill='none'%20stroke-linecap='round'%20stroke-linejoin='round'%3e%3crect%20x='27'%20y='27'%20width='36'%20height='36'%20rx='5'/%3e%3ccircle%20cx='13.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='13.5'%20cy='76.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='76.5'%20r='13.5'/%3e%3c/g%3e%3c/svg%3e)
GDPR email compliance refers to meeting the requirements of the European Union's General Data Protection Regulation when you send email to, or process the personal data of, individuals in the EU and EEA. Because an email address tied to a person is personal data, virtually all email marketing and outreach to EU recipients falls under GDPR.
The foundation is having a lawful basis for processing. For marketing email this is usually explicit, freely given consent — a clear opt-in — though B2B outreach can sometimes rely on legitimate interest, provided you document a balancing test and the recipient's rights are respected. Pre-ticked boxes and bundled consent do not qualify.
GDPR also grants individuals rights you must honor: the right to access their data, to have it corrected or erased, and to object to processing, including an unconditional right to opt out of direct marketing at any time. You must be transparent about what data you hold and why, and you must be able to act on these requests promptly.
Practically, compliance means keeping records of consent, using double opt-in where appropriate, minimizing the data you collect, securing it, honoring unsubscribes immediately, and being able to delete a person entirely on request. Penalties for GDPR violations are severe, so any sender with EU contacts should treat these obligations as core operating requirements.