GDPR Compliance for Marketing

GDPR Compliance for Marketing

Ensure your marketing activities comply with GDPR requirements for consent, data processing, and privacy rights.

When to Use This Skill

• Designing consent collection flows
• Writing privacy notices
• Auditing marketing data practices
• Handling data subject requests
• Documenting lawful basis

Methodology Foundation

Based on GDPR Articles 6, 7, 12-23 and EDPB Guidelines, covering:

• Lawful basis determination
• Consent requirements
• Transparency obligations
• Data subject rights
• Documentation requirements

What Claude Does vs What You Decide

Instructions

Step 1: Lawful Basis Assessment

Six Lawful Bases (Article 6):

Marketing Activity Mapping:

Step 2: Consent Requirements

Valid Consent Criteria (Article 7):

Consent Record Requirements:

Record for each consent:
- Who consented (identifier)
- When (timestamp)
- What they consented to (purpose)
- How (mechanism)
- What they were told (notice version)

Step 3: Privacy Notice Requirements

Required Elements (Articles 13-14):

Step 4: Data Subject Rights

Rights Framework:

Step 5: Documentation & Records

Required Documentation:

1. Records of Processing Activities (ROPA)
2. Legitimate Interest Assessments
3. Consent records and mechanisms
4. Privacy notices (versioned)
5. Data Subject Request log
6. Breach notification procedures

Examples

Example 1: Marketing Email Consent Flow

Input:

Design a GDPR-compliant consent flow for:
- SaaS product newsletter
- Product updates
- Promotional offers
- Third-party partner offers

Output:

## GDPR-Compliant Email Consent Flow

### Consent Collection UI

---

**Signup Form Fields:**

Email: [________________]

[ ] I agree to receive the monthly newsletter with industry insights [ ] I agree to receive product updates and feature announcements [ ] I agree to receive promotional offers and discounts [ ] I agree to receive relevant offers from our trusted partners

[Sign Up]

By signing up, you confirm you've read our [Privacy Notice]. You can withdraw consent anytime via unsubscribe link or contacting us.

**Design Requirements:**
- All checkboxes unchecked by default
- No "select all" option
- Each purpose separate
- Privacy notice linked, not buried
- No dark patterns

---

### Consent Record Structure

```json
{
  "email": "[email protected]",
  "consents": [
    {
      "purpose": "newsletter",
      "granted": true,
      "timestamp": "2026-01-31T10:30:00Z",
      "source": "signup_form_v3",
      "notice_version": "privacy_v2.1"
    },
    {
      "purpose": "product_updates",
      "granted": true,
      "timestamp": "2026-01-31T10:30:00Z",
      "source": "signup_form_v3",
      "notice_version": "privacy_v2.1"
    },
    {
      "purpose": "promotional",
      "granted": false,
      "timestamp": null,
      "source": null,
      "notice_version": null
    },
    {
      "purpose": "third_party",
      "granted": false,
      "timestamp": null,
      "source": null,
      "notice_version": null
    }
  ],
  "ip_address": "192.168.1.1",
  "user_agent": "Mozilla/​5.0..."
}

---

Email Footer (Required)

---
You're receiving this because you subscribed to our [newsletter/​updates].

Manage preferences: [link]
Unsubscribe from this list: [link]
Unsubscribe from all: [link]

[Company Name]
[Address]
[Contact Email]

---

Preference Center

[Update Preferences] [Unsubscribe from All]

---

Compliance Checklist

• All consents granular (separate checkboxes)
• Checkboxes unchecked by default
• Clear description of each purpose
• Privacy notice accessible
• Withdrawal mechanism clear
• Consent records stored
• Double opt-in implemented
• Unsubscribe in every email
• Preference center available

### Example 2: Legitimate Interest Assessment

**Input:**

We want to email our existing customers about related products. Do we need consent or can we use legitimate interest?

**Output:**

Legitimate Interest Assessment: Customer Cross-Sell

Summary

You can likely rely on legitimate interest (not consent) for emailing existing customers about similar products, but must complete this assessment and offer easy opt-out.

---

Three-Part LIA Test

1. Purpose Test: Is There a Legitimate Interest?

Interest: Promote related products to existing customers Legitimacy: Yes - recognized business interest in customer development Benefit: Revenue growth, customer relationship deepening

✅ PASS

---

2. Necessity Test: Is Processing Necessary?

✅ PASS (with conditions)

Conditions:

• Limit to genuinely related products
• Reasonable frequency (not daily)
• Honor opt-outs immediately

---

3. Balancing Test: Individual Rights vs. Your Interest

✅ PASS

---

Conclusion

Lawful Basis: Legitimate Interest (Article 6(1)(f))

Requirements for Compliance:

1. Document this LIA and keep on file
2. Include in privacy notice: "We may contact existing customers about similar products based on legitimate interest. You can opt out at any time."
3. Easy opt-out: Every email must have unsubscribe
4. Honor preferences: Immediate suppression on opt-out
5. Similar products only: Don't expand to unrelated offerings
6. Reasonable frequency: No more than weekly

---

Template Email Footer

You're receiving this as a valued [Company] customer.

Not interested in product updates?
[Opt out of marketing] | [Manage preferences]

This email was sent based on our legitimate interest in keeping
customers informed about relevant products. See our Privacy Notice
for details and your rights.

---

When This Doesn't Apply

Use consent instead if:

• Products are significantly different
• Customer bought once 2+ years ago
• You acquired data from third party
• Customer previously opted out
• Emails are primarily promotional (not informational)

## Skill Boundaries

### What This Skill Does Well
- Explaining GDPR requirements
- Drafting compliant language
- Creating documentation templates
- Identifying compliance gaps

### What This Skill Cannot Do
- Provide legal advice
- Know your specific jurisdiction nuances
- Guarantee regulatory acceptance
- Replace DPO consultation

### When to Escalate to Human
- Complex cross-border transfers
- Regulatory investigation
- Data breach response
- Novel processing activities

## Iteration Guide

**Follow-up Prompts:**
- "Draft the privacy notice section for [activity]"
- "How do we handle a right to erasure request?"
- "What documentation do we need for [processing]?"
- "Is this cookie banner compliant?"

## References

- GDPR Text (Regulation 2016/​679)
- EDPB Guidelines on Consent
- ICO Direct Marketing Guidance
- CNIL Cookie Guidelines

## Related Skills

- `terms-analyzer` - Terms of service review
- `contract-review` - DPA analysis
- `nda-generator` - Confidentiality

## Skill Metadata

- **Domain**: Legal / Marketing
- **Complexity**: Intermediate
- **Mode**: centaur
- **Time to Value**: 1-2 hours per assessment
- **Prerequisites**: Basic GDPR familiarity