GDPR in Email Marketing [2026]: 5-Step Guide - Mailtrap

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. You’re established in the EU or UK. Office, subsidiary, single employee, doesn’t matter the size. “You offer goods or services to people in the EU or UK. Free or paid.” You monitor the behavior of people in the EU or UK. Tracking, retargeting, behavioral analytics on EU visitors. All of it.

   In GDPR territorial scope

2. You offer goods or services to people in the EU or UK. Free or paid. Whether you have a euro pricing option, a translated landing page, or just a checkout that accepts EU customers. That still counts. “You monitor the behavior of people in the EU or UK. Tracking, retargeting, behavioral analytics on EU visitors. All of it.” Quick example. You’re a US-based SaaS company headquartered in Austin. You don’t have a single employee in Europe. But your signup form accepts anyone, you have customers in Berlin and Dublin, and your marketing automation fires welcome sequences to all of them.

   In GDPR territorial scope

3. Three tests. If any one of them is true, GDPR applies to you: “You’re established in the EU or UK. Office, subsidiary, single employee, doesn’t matter the size.” You offer goods or services to people in the EU or UK. Free or paid. Whether you have a euro pricing option, a translated landing page, or just a checkout that accepts EU customers. That still counts.

   In GDPR territorial scope

4. A quick note for anyone coming from the US side: GDPR is not CAN-SPAM. CAN-SPAM is opt-out. You can email someone who never asked, as long as you give them a way to leave. GDPR is opt-in. You’re not allowed to email someone for marketing purposes unless they’ve actively agreed to it. Two completely different philosophies, and confusing them is how a lot of US companies end up with surprise fines. “If any one of them is true, GDPR applies to you:” You’re established in the EU or UK. Office, subsidiary, single employee, doesn’t matter the size.

   In GDPR territorial scope

5. Suppressed/unsubscribed contacts: Keep a minimal record (just the email, hashed if possible) on a suppression list so you don’t accidentally re-add them later. Delete everything else. “Bounced addresses: Hard bounces must be removed immediately, and also soft bounces, after a defined retry window.” It’s important to remember that ISPs watch your engagement rates.

   In Bounce handling

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.