GDPR governs how personal data - including email addresses - can be collected, stored, and used, and it applies to any organization processing the data of people in the EU/EEA, regardless of where the sender is based. It is a legal framework, not a deliverability one, but its requirements map closely onto deliverability best practice.
The six GDPR principles, and what they require for email specifically
- Lawfulness, fairness, transparency - you need a valid legal basis (usually consent, or legitimate interest in narrower B2B cases) to email someone, and you must be clear about what you're collecting and why.
- Purpose limitation - data collected for order confirmations can't quietly become a marketing list without a separate basis.
- Data minimization - collect what you need, not everything a form could ask for.
- Accuracy - outdated or incorrect contact data should be corrected or removed, not left to accumulate.
- Storage limitation - don't keep contact data indefinitely with no retention policy.
- Integrity and confidentiality - secure the data you hold, including against the kind of credential compromise that lets an attacker send phishing mail through your legitimate infrastructure.
Where each principle maps to a deliverability metric
| GDPR requirement | Deliverability effect |
|---|---|
| Valid consent before marketing sends | Lower complaint rate - recipients who opted in are far less likely to hit "report spam" |
| Easy, honored unsubscribe | Lower complaint rate - an unsubscribe that works removes the only alternative being a spam report |
| Data accuracy (correcting bad addresses) | Lower hard-bounce rate |
| Storage limitation (removing stale contacts) | Lower spam-trap risk - very old, unmaintained addresses are more likely to have become traps |
| Transparency about sender identity | Builds the kind of trust that supports engagement, which is itself a reputation signal |
Consent vs. legitimate interest
GDPR allows marketing email under two bases most relevant here: explicit consent (an opt-in checkbox, not pre-ticked) and legitimate interest, which in B2B contexts can sometimes cover relevant professional outreach without a prior opt-in - but legitimate interest requires a documented balancing test and an easy opt-out, and it's a narrower exception than many senders assume. When in doubt, consent is the safer basis, both legally and for complaint rate.
The right to erasure and list hygiene
A valid erasure request means removing the contact from active sending lists, not just marking them unsubscribed in one system while a duplicate copy lingers in another export or CRM sync. Beyond the legal obligation, this is good list hygiene regardless - a contact who asked to be forgotten and still receives mail is a near-certain complaint.
A worked example: the compliance gap that becomes a deliverability incident
A SaaS company exports its CRM contact list into an email tool every quarter for a re-engagement campaign. Twelve contacts had submitted erasure requests in the preceding months - each one processed correctly inside the CRM, where the record was deleted. But the email tool's list was a snapshot from the last sync, taken before three of those twelve requests came in, and nobody re-ran the sync before the campaign went out. Those three contacts, who had explicitly asked to stop receiving mail, received the campaign - and one reported it as spam.
That single complaint is a GDPR violation (an upheld erasure request, not honored) and a deliverability event (a complaint against a domain's reputation) from the same root cause: a one-way sync with no verification step before sending. The fix is not a bigger compliance team - it's a pre-send check that diffs the sending list against the erasure log, however that log is kept, every time a list is pulled from a secondary source rather than the live CRM.
A minimal retention and consent record to keep
| Field | Why it matters if audited |
|---|---|
| Timestamp of consent | Proves consent existed at time of first send |
| Consent mechanism (checkbox, form, import) | Distinguishes valid opt-in from an appended or purchased contact |
| Last engagement date | Supports a defensible storage-limitation policy |
| Erasure request date, if any | Proves the request was received and actioned, with a timestamp |
Keeping this four-field record per contact, even in a simple spreadsheet for a small list, is enough to answer most audit questions and catches the kind of stale-sync problem in the example above before it reaches a send.
What not to do
- Don't rely on a pre-ticked consent checkbox - it isn't valid consent under GDPR, and pre-ticked opt-ins correlate with higher complaint rates regardless of the legal question, since the person often didn't intend to subscribe.
- Don't treat legitimate interest as a blanket justification for cold B2B outreach at volume - it's a narrower basis than consent and doesn't cover every commercial email.
- Don't let data retention run indefinitely "just in case" - long-held, unmaintained contact data is where spam traps tend to concentrate.
- Don't process an erasure request in one system and leave the contact live in a connected one - a partial deletion is still a compliance gap and a complaint risk.
MailPilot's role sits on the deliverability side of this overlap: it warms sending domains, checks SPF/DKIM/DMARC against what's live in DNS, and tracks per-mailbox reputation daily - so once your consent and data-hygiene practices are GDPR-aligned, the infrastructure sending that compliant mail is measured too, rather than assumed to be fine.
Ready to reach the inbox every time?
Automated email warmup across real peer mailboxes. Live inbox placement monitoring. Free 7-day trial - no credit card required.
Start free trial