GDPR: Marketing is More Than Just Selling
Under GDPR, direct marketing isn't just selling products; it's promoting your 'aims and ideals.' This applies to email newsletters and targeted ads. The biggest footgun is assuming non-profits are exempt—they aren't, and users have an absolute right to opt…
Why it exists
GDPR was created to give individuals fundamental rights and control over their personal data. For marketing, this means ensuring organizations communicate respectfully and transparently, building trust rather than simply exploiting user information for commercial or promotional gain.
The mental model
Think of GDPR not as a blocker, but as a framework for respectful communication. Any time you contact an individual to promote your organization's goals—commercial or not—you are doing 'direct marketing' and must have a lawful basis, like explicit consent, to do so.
How it works
Compliance follows a clear lifecycle. First, IDENTIFY if your activity counts as direct marketing; remember this includes promoting aims and ideals, not just selling. Second, PLAN your campaign with a 'data protection by design' approach, establishing your lawful basis for using personal data before you begin. Third, COLLECT data fairly and transparently, clearly explaining to people how you plan to use their information. Finally, RESPECT people's preferences by honoring their absolute right to object or opt out of direct marketing at any time, and make the process simple.
When to use it
These principles are not optional; they are legal requirements that apply whenever you process the personal data of individuals in the EU and UK for marketing purposes. This includes email campaigns, targeted social media ads, personalized website content, and fundraising appeals.
When not to use it
The rules for direct marketing do not apply to activities that use no personal data, such as a generic, untargeted newspaper ad or a billboard. They also don't apply to purely transactional communications, like an order confirmation or shipping notification, provided these messages do not also contain promotional material.
One canonical example
A non-profit organization sends a monthly email newsletter with updates on its recent activities and includes a 'Donate Now' button. Even though it is not selling a commercial product, this is direct marketing under GDPR. The organization must have a lawful basis (e.g., consent) for every contact on its list and must provide a clear, one-click unsubscribe link in every single email.
Interview question
Under GDPR, which activity is considered direct marketing and requires a lawful basis?
- a.A software company sending an email to existing users about an upcoming mandatory security update.
- b.A non-profit organization sending a personalized email newsletter detailing its recent achievements and including a donation link.Correct
- c.A local business placing a generic advertisement in a community newspaper.
- d.An e-commerce store sending an order confirmation email to a customer after a purchase.
Why? this is the answer
Option B is correct because GDPR defines direct marketing broadly to include promoting an organization's "aims and ideals," even for non-profits, making a personalized newsletter with a donation link direct marketing. The most tempting distractor, Option A, is incorrect as essential service updates are considered purely transactional, not promotional, and thus not direct marketing.
Just read this? Test yourself on what you have been reading.
Read the original → ico.org.uk
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles