Compliance checklist for email outreach

Contacts and their sources

• Write down in which countries the recipients are, because their rules apply.
• Decide for each recipient group whether they are private people, sole traders or companies.
• Record the source of every contact (for example a company website, a trade fair, a referral) and the date you collected it.
• Ask for proof of consent and the original source for every contact on a bought or rented list, and do not use the list if they are missing.
• Collect only the fields the email needs, such as name, work address, company and role.
• Leave out sensitive data such as health, religion or political views.
• Check every new contact against your suppression list before importing it.

Lawful basis and records

• Choose the lawful basis for the campaign, consent or legitimate interests, and write it down.
• For legitimate interests, write down the balancing test: your purpose, why email is necessary and why it does not override the person's interests.
• For consent, store who agreed, when, how and to which exact wording.
• Check whether the email marketing rule in the recipients' country needs prior consent, also for business addresses (in Germany it generally does).
• For the existing customer exception, check that the address came from a sale and that you advertise only your own similar products.
• Add the outreach to your record of processing activities, if your organisation keeps one (Article 30 GDPR).
• Name one person who answers objections and data protection requests.

In every email

• Put your real name and your company in the From line.
• Write a subject line that matches the content, with no fake "Re:" or "Fwd:".
• Make it clear that the email is a business offer (in the US it must be identified as an advertisement).
• Include your company's postal address.
• Say where you got the person's address, at the latest in the first email (Article 14 GDPR).
• Point out the right to object, clearly and separately from the rest of the text (Article 21(4) GDPR).
• Link to your privacy notice.
• Offer a simple, free way to opt out, such as a reply word or one click.
• Test that the opt-out link or reply address works before the campaign starts.

Opt-outs and objections

• Stop emailing anyone who opts out or objects as fast as possible, and always within the legal deadline (10 business days under CAN-SPAM).
• Treat "please stop" in a reply as an opt-out, even if the person did not use the link.
• Add every opt-out, objection and hard bounce to a suppression list.
• Keep only the minimum on the suppression list: the address, the date and the reason.
• Make sure an opt-out reaches every tool and colleague who sends, such as the CRM, the email tool and the sales team.
• Log every objection and data protection request with its date and what you did.

Keeping and deleting data

• Set a retention period for contacts who never replied, and delete them when it ends.
• Re-check or delete contact data that is more than a few months old.
• Give access to the contact list only to the people who need it.
• Answer requests for access or deletion without undue delay, at the latest within one month (Article 12(3) GDPR).
• Use only service providers that have signed a data processing agreement with you (Article 28 GDPR).