GDPR: Marketing is More Than Just Selling
Under GDPR, direct marketing isn't just selling products; it's promoting your 'aims and ideals.' This applies to email newsletters and targeted ads. The biggest footgun is assuming non-profits are exempt—they aren't, and users have an absolute right to opt…
WHY IT EXISTS: GDPR was created to give individuals fundamental rights and control over their personal data. For marketing, this means ensuring organizations communicate respectfully and transparently, building trust rather than simply exploiting user information for commercial or promotional gain.
THE MENTAL MODEL: Think of GDPR not as a blocker, but as a framework for respectful communication. Any time you contact an individual to promote your organization's goals—commercial or not—you are doing 'direct marketing' and must have a lawful basis, like explicit consent, to do so.
HOW IT WORKS: Compliance follows a clear lifecycle. First, IDENTIFY if your activity counts as direct marketing; remember this includes promoting aims and ideals, not just selling. Second, PLAN your campaign with a 'data protection by design' approach, establishing your lawful basis for using personal data before you begin. Third, COLLECT data fairly and transparently, clearly explaining to people how you plan to use their information. Finally, RESPECT people's preferences by honoring their absolute right to object or opt out of direct marketing at any time, and make the process simple.
WHEN TO USE IT: These principles are not optional; they are legal requirements that apply whenever you process the personal data of individuals in the EU and UK for marketing purposes. This includes email campaigns, targeted social media ads, personalized website content, and fundraising appeals.
WHEN NOT TO USE IT: The rules for direct marketing do not apply to activities that use no personal data, such as a generic, untargeted newspaper ad or a billboard. They also don't apply to purely transactional communications, like an order confirmation or shipping notification, provided these messages do not also contain promotional material.
ONE CANONICAL EXAMPLE: A non-profit organization sends a monthly email newsletter with updates on its recent activities and includes a 'Donate Now' button. Even though it is not selling a commercial product, this is direct marketing under GDPR. The organization must have a lawful basis (e.g., consent) for every contact on its list and must provide a clear, one-click unsubscribe link in every single email.
Read the original → ico.org.uk
Get five bites like this every day.
Tezvyn delivers a daily feed of 60-second tech bites with quizzes to lock in what you learn.