GDPR in email marketing: consent, legal basis and contact import

GDPR in email marketing means that for every contact you must know on what basis you are emailing them, why and for how long. You send commercial messages to new contacts only with their consent, and you can email your own customers with offers of similar products on the basis of legitimate interest. Consent must be active, meaning an unticked checkbox in a form, and it must be provable. In Quanda, you record the legal basis, purpose of processing and validity for every contact. New contacts get them from the form automatically, and you set them for your existing database in bulk with an import.

Key takeaways

1. You set the validity of consent yourself, typically two years. After it expires, the contact does not receive campaigns for that purpose.
2. The person must give consent themselves by ticking an empty checkbox. A pre-ticked checkbox is not consent.
3. You must be able to prove consent. A saved record from the form and address verification through double opt-in help.
4. Quanda records the legal basis, purpose and validity for every contact. You then select campaign recipients by purpose.
5. You set up your existing database in bulk: export, fill in the columns in Excel and import.
6. Do not import contacts whose consent you cannot prove and who are not your customers.

In short: who you may email, what you need and what you risk

• Who you may email: people who have given you consent, and your own customers with an offer of similar goods or services.
• What you need: a legal basis, purpose and validity for every contact, and proof of consent.
• Which legal bases you will use: consent for new contacts, legitimate interest for your own customers.
• What you risk: fines for unsolicited commercial email under national law, fines of up to EUR 20 million under the GDPR, and, well before any fine, spam complaints and poorer deliverability.

What has changed since publication: This article was created in October 2026 by merging two older articles: the guide How to correctly import the legal aspects of personal data processing (GDPR) and the article Marketing vs. GDPR. Is the opportunity to gain new contacts over? We added the rules for commercial messages, the requirements for consent, the import procedure for today's Excel and a table with an example.

What the GDPR means for email marketing

The GDPR is the European Union regulation on the protection of personal data, which has applied since 25 May 2018. It is crucial for email marketing because it concerns the most valuable thing you have: your contacts with existing and potential customers.

Personal data is any information about a person who can be identified directly or indirectly. A name, an email address, a phone number, but also an IP address or an identifier in a system. Processing of personal data is almost anything you do with the data: collecting, storing, retrieving, using it in a campaign, correcting it and erasing it. Sending a newsletter is processing too.

Two roles meet in email marketing:

• The controller determines why and how personal data is processed. With respect to your contacts, you are the controller.
• The processor processes data on the controller's instructions. That is the role of Quanda, which stores contacts and sends emails. The relationship is governed by the data processing agreement, which is part of the terms of service.

When you may send a commercial message by email

A commercial message is any email that promotes your goods, services or company, so a newsletter, a webinar invitation or a discount alert all count. In the EU, you may send one by email only in two cases:

Source: Directive 2002/58/EC (ePrivacy Directive), Article 13(1) and 13(2); GDPR, Article 6 and Recital 47.

A legal basis is the lawful reason on which you process personal data. Article 6 of the GDPR lists six of them, and processing is lawful only if at least one is met. In email marketing, two are enough: consent for new contacts and legitimate interest for your own customers. Recital 47 of the GDPR explicitly states that direct marketing may be regarded as a legitimate interest.

Legitimate interest has its limits, though. Every customer can object to receiving your emails, and under Article 21 of the GDPR you may then no longer process their data for direct marketing. That is why an unsubscribe link belongs in every email.

Business addresses deserve the same care. The address of a specific person in a company is personal data, and under the ePrivacy Directive the rules for legal persons vary by member state, so we recommend getting consent in B2B as well. Why it does not pay to get around the rules by buying addresses is explained in the article Buying an email list: why it doesn't pay off.

How to get consent to send a newsletter

Consent is a freely given, specific and informed indication of wishes by which a person allows you to process their personal data for a given purpose. The simplest way is a checkbox in a form. The checkbox must be unticked, and the person must tick it themselves. A pre-ticked checkbox, consent hidden in your terms and conditions or silence do not count as consent.

A short text next to the checkbox is enough, for example: "Yes, I'd like to receive tips and occasional offers, and I consent to the processing of my personal data for this purpose." Publish the full wording of the consent on your website and link to it from the short text. That way the person can read it before submitting the form.

What the full wording of the consent should include:

• who the consent is given to, that is, the identification of your company,
• which personal data it covers,
• for what purpose you will process the data,
• for how long,
• how the consent can be withdrawn,
• information about the rights the person has in connection with the processing.

Under Article 7 of the GDPR, withdrawing consent must be as easy as giving it. The controller must also be able to demonstrate consent. You cannot prove it from memory, but you can with a saved record showing the date and wording.

In Quanda, an active form takes care of this. An active form is a form created in Quanda that you embed on your website and that saves contacts straight into your database. You will find it in the top menu under Forms. You set the legal basis, purpose and validity in the form automation: as the condition, choose Form was submitted with consent, and as the action, Set GDPR details. In it, you choose the legal title, the purpose of processing and the Length of processing of personal data, for example 2 years. Quanda calculates the Valid until date for the contact from the length of processing by itself.

Once the form is submitted, this information is saved with the contact together with the date and time, the source and the name of the form. You will then find the content of the submitted form, including the wording of the ticked consent, in Saved forms.

Tip: Turn on double opt-in in the form. A new contact then confirms their address by clicking a link in a verification email, and you can be sure that the consent was given by the owner of the address. How it works is explained in the article Double opt-in. What is it and how does it work?.

Legal basis, purpose and validity in Quanda

The purpose of processing is the reason why you process personal data, for example sending business and advertising messages or sending news. Validity is the date until which you process the data for the given purpose. The legal aspects of processing are three pieces of information on a contact: legal basis, purpose and validity. Quanda records them for every contact, and one contact can have several sets of them, for example consent to receive news and, at the same time, legitimate interest as a customer.

Legal bases as available in Quanda, where the field is called Legal title:

1. Administrator's legitimate interest
2. Compliance with legal obligations
3. Performance of a contract or negotiation of its conclusion
4. Consent to the processing of personal data
5. Public interest
6. Vital interest

Purposes of personal data processing as available in Quanda. You use the number of the purpose in the import:

For every contact, you will find the legal basis, purpose and validity in the contact detail, in the Sending settings section. You can also add them there manually with the Create a new button, together with the email status.

When you prepare a campaign, open the Advanced Filter on the Recipients page and in the Purpose of personal data processing field select the purpose the campaign relates to. Quanda then keeps only the contacts with this purpose among the recipients, and you filter them by tags as usual. This way you never send a campaign to anyone you may not email for that purpose. Quanda removes contacts with the status Do not send, for example after unsubscribing or after consent has expired, from the recipients by itself, even if you do not select a purpose in the filter.

Caution: Until you set anything for your contacts, they all have the default purpose Not set (default), with no legal basis or validity. The email status stays as it was previously saved for the contact. Put your records in order before you start sending. For an existing database, you can do it in bulk with an import.

How to import legal basis, purpose and validity of contacts into Quanda

A bulk import is the fastest way to set the legal basis, purpose and validity for contacts you already have in Quanda. The procedure has seven steps.

Step 1: Sort your contacts

Before you open Excel, divide your database according to the basis on which you email each group. Typically, you end up with three groups:

• Existing customers: legal title Administrator's legitimate interest, purpose no. 2 Sending business and advertising messages, validity for example 2 years.
• Prospects whose consent you can prove: legal title Consent to the processing of personal data, purpose according to what they signed up for, validity according to the text of the consent.
• Prospects whose consent you cannot prove: do not import them. You have no legal basis to email them, and no field in the table will fix that.

Caution: This division is only an example. For your company it may look different depending on what you sell, which products you offer and how you obtained your contacts.

Step 2: Export your contacts

Export your contacts from Quanda to a CSV file. You will find the export button at the very bottom of the Contacts page. The export contains all columns, including the ones you do not fill in, and the columns for personal data processing.

Step 3: Open the export in Excel

Open a blank workbook in Excel, go to the Data tab, choose From Text/CSV and select the downloaded file. Set File origin to 65001: Unicode (UTF-8) and Delimiter to Comma, then click Load. You can tell the encoding is right when accented characters display correctly in the preview. You will find the detailed procedure in the help article Export of contacts and preparation for their import.

Feel free to delete the columns you do not need, so the table is easier to read. Keep the Email (main email) column, which Quanda uses to match contacts during the import, and these columns:

• Contact owner verified with Double opt in
• Purpose of processing of personal data
• Email status
• Valid until
• Legal Title: Authorized Interest of Administrator
• Legal title: Performance of legal duty
• Legal title: Performance of a contract or negotiation of its conclusion
• Legal title: Consent to the processing of personal data
• Legal title: Public interest
• Legal title: Vital interest

Step 4: Fill in legal basis, purpose and validity

Write the values into the columns for legal basis, purpose and validity according to the table: the legal basis as true or false, the purpose and email status as numbers and the validity as a date.

If a contact has several purposes, write them into a single cell separated by commas, for example 2,5. The Valid until column then takes two dates, and each Legal title column takes two true or false values, always in the same order as the purposes.

For the customer and the prospect with consent from step 1, the columns will look like this:

In the other Legal title columns, leave the value false for both contacts.

Step 5: Save the file

Ideally, save the finished table as an Excel workbook in XLSX format. If you want CSV, choose CSV UTF-8 (comma delimited) and open the file in Notepad before importing. Excel takes the delimiter from the Windows regional settings, and in many European regional settings it saves semicolons instead of commas, which the import does not accept. Nor does it accept the MS-DOS and Macintosh CSV variants.

Step 6: Import the contacts

Upload the file through Bulk Contacts Import, just like any other import. For import priority, choose the imported contacts, otherwise Quanda would skip existing contacts and the changes would not take effect. You will find more about the import options in the help article Contact import guide.

Step 7: Check the result

Open a few contacts at random and check in their detail that the legal basis, purpose and validity are correct. Then create a campaign, select the purpose and see how many recipients are offered.

Tip: With a large database, do a test import of a few rows first. An error in the order of values is hard to find in a table with thousands of rows.

What to do when consent expires

Once the date in the Valid until column has passed, the contact gets the status Do not send (consent expired) for that purpose. It will no longer be included in campaigns for that purpose, while its other purposes remain valid.

Set yourself a reminder and send your contacts an email asking them to renew their consent well in advance. Renewed consent keeps the contact for you together with its whole history.

Unsubscribing and recipients' rights

Every commercial message must contain an unsubscribe link. When recipients click it, they can unsubscribe from one purpose of processing or from everything at once. An unsubscribed contact will not be among the recipients of your campaigns, whatever tags it has.

Do not delete unsubscribed contacts. If you did, you would lose the sending history as well as the information that the person does not want your emails, and you could add the contact again by mistake in your next import. It is a different situation when someone explicitly asks you to erase their data. Such a request needs to be assessed, because another law may require you to keep some of the data.

Under the GDPR, every person in your database has the right to know what data you hold about them, to have it corrected, erased or its processing restricted, to obtain a copy of it, to object and to lodge a complaint with their national data protection authority. You handle a copy of the data by exporting the contact, and a correction directly in its detail. You will find an overview in the online course GDPR and email marketing in practice.

How to get new contacts with GDPR in place

You will keep getting new contacts with GDPR in place if you give people a reason to share their contact and show them the consent form at the right moment. How many you gain depends on three factors:

• Traffic. Nothing affects the number of new contacts more than how many people visit the page with your form.
• The exchange. The more valuable the thing you offer in exchange for a contact, the more contacts you gain. It can be an ebook, a checklist, a discount or a webinar invitation. What works in B2B is described in the article Lead magnets in B2B marketing: what brings in quality leads.
• The form. The content, design and timing of the form decide how many visitors actually leave their contact. According to our measurements at several Quanda customers, an animated form collects up to two and a half times more contacts than a form in a fixed place. A poorly timed form, on the other hand, puts most people off. More in the article Animated forms: a vending machine for new contacts.

For our customers, it can also go quickly. The travel agency Delfín travel collected up to 130 contacts a day on its best days with a simple sliding form, and more than 50,000 email addresses over roughly five years.

Downloading an ebook does not in itself entitle you to send a newsletter. If you also want to send people other emails, offer a separate unticked consent checkbox in the form.

Checklist: GDPR in email marketing

Before you send your next campaign, check consent, records, unsubscribing and validity.

• The form has an unticked consent checkbox and a link to the full wording.
• The full wording of the consent states the controller, the data, the purpose, the validity, withdrawal and rights.
• New contacts confirm their address through double opt-in.
• Every contact in Quanda has a legal basis, purpose and validity.
• I offer customers without consent only similar goods or services.
• I select campaign recipients by the purpose of processing.
• Every email contains an unsubscribe link.
• Before validity ends, I send a request to renew consent.

Conclusion

The GDPR asks something quite reasonable of you: to know whose data you hold, why you hold it, on what basis and for how long. When you record this for every contact, you can stay calm during an inspection and when a recipient asks where you got their address. Quanda makes sure your campaign goes only to the people you may email.

You can go through the whole topic step by step in the free online course GDPR and email marketing in practice. This article is not legal advice, so have the wording of your consent and privacy policy checked by a lawyer. And if you are not sure how to handle the import, get in touch, we will be happy to help.