GDPR-compliant marketing means you collect, use and store personal data for marketing only when you have a clear legal basis, tell people what you do, and let them say no at any time. For most SMEs, that comes down to five areas: lawful basis, consent, cookies and tracking, email outreach and vendor contracts. The good news is that none of this requires a legal department. Instead, it requires a few clear decisions, simple records and tools that are set up correctly. This guide explains what the rules say and gives you a practical checklist for your team.
Earlier posts in this series covered your marketing strategy, your ideal customer profile and your marketing budget. Now we make sure the way you reach people is legal and builds trust.
Note: this article is general information, not legal advice. For specific cases, speak to a data protection professional.
Why GDPR-Compliant Marketing Matters for SMEs
The General Data Protection Regulation (GDPR) applies to any organisation that processes personal data of people in the EU. Company size does not change that. So a ten-person firm sending newsletters has the same core duties as a large brand.
The risks are real. According to the European Commission, fines for serious breaches can reach €20 million or 4% of worldwide annual turnover, whichever is higher. However, fines are only part of the picture. A spam complaint, a blocked email domain or a lost enterprise deal can hurt an SME faster.
On the other hand, GDPR-compliant marketing also brings clear benefits:
- Better data quality: people who opt in actually want to hear from you.
- Higher trust: B2B buyers increasingly ask suppliers about data handling before they sign.
- Easier sales: a clean process shortens security and procurement reviews.
Step 1: Choose a Lawful Basis for Each Marketing Activity
GDPR lists six lawful bases in Article 6. For marketing, two matter most: consent and legitimate interests. Therefore, your first task is to map each activity to one of them.
| Marketing activity | Typical lawful basis | Key condition |
|---|---|---|
| Newsletter sign-up | Consent | Clear, separate opt-in |
| Email to existing customers | Legitimate interests (soft opt-in) | Similar products, easy opt-out |
| Analytics and ad cookies | Consent | Given before cookies load |
| B2B outreach to a work contact | Legitimate interests, where national rules allow | Balancing test and opt-out |
| Retargeting and custom audiences | Consent | Covers sharing with the ad platform |
Legitimate interests is not a free pass, though. You need to show that your interest is real, that the processing is necessary, and that it does not override the person’s rights. The EDPB guidelines on legitimate interests explain this three-step test. In practice, write a short assessment and keep it on file.
Step 2: Get Consent Right
When you rely on consent, it must be freely given, specific, informed and unambiguous. The EDPB guidelines on consent give detailed examples. For GDPR-compliant marketing, that translates into a few simple rules:
- No pre-ticked boxes. People must take an active step.
- Separate purposes. A download form should not bundle newsletter consent into the terms.
- Plain language. Say what you will send and how often.
- Easy withdrawal. Unsubscribing must be as easy as signing up.
- Proof. Store when, where and how each person agreed.
For example, a whitepaper form can offer the download without conditions. Then a separate, unticked checkbox invites people to join your monthly newsletter. As a result, your list grows more slowly, but every contact is valid.
Step 3: Set Up Cookies and Tracking Properly
Cookie rules come mainly from the ePrivacy Directive, while GDPR sets the standard for consent. In short, you need prior consent for cookies that are not strictly necessary. That includes most analytics, advertising and social media pixels.
So check how your site behaves on first load. If Google Analytics or Meta Pixel fires before a visitor clicks “Accept”, your setup is not compliant. In addition, “Reject” should be as visible as “Accept” on the first layer of the banner.
A practical setup looks like this:
- Audit your tags. List every script, pixel and cookie on your website.
- Use a consent management platform. Choose one that blocks tags until consent is given.
- Connect consent signals. For example, use Google Consent Mode so tools respect the visitor’s choice.
- Document categories. Explain each cookie group in your cookie policy.
- Retest regularly. New plugins and campaigns often add tags without notice.
Also keep an eye on reform. The European Commission’s Digital Omnibus proposal includes changes to cookie and data rules. Until any changes are adopted and apply, follow the current rules.
Step 4: Run Email and B2B Outreach Within the Rules
Email marketing sits under both GDPR and national rules based on the ePrivacy Directive. As a result, the details differ by country. For instance, some countries treat business email addresses more flexibly than others, while Germany is known for strict opt-in rules.
For consumers, you generally need consent. However, many countries allow a “soft opt-in” for existing customers. That means you may email people who bought from you about similar products, as long as you offered an opt-out at collection and in every message.
For B2B cold outreach, stay careful. First, check the rules in each target country. Then keep messages relevant to the person’s role, identify your company clearly and include an easy opt-out. Finally, respect every objection at once. Under Article 21, a person’s objection to direct marketing is absolute.
Avoid bought contact lists. You usually cannot prove how the data was collected or whether people agreed. The European Commission explains the conditions for using data received from third parties.
Step 5: Manage Vendors, Records and Data Rights
Your marketing stack processes personal data on your behalf. That includes your CRM, email platform, analytics tool and agency. Therefore, GDPR-compliant marketing also depends on your vendors.
Start with these basics:
- Data processing agreements (DPAs): sign one with every processor, as Article 28 requires.
- International transfers: check where data goes and which safeguards apply, such as Standard Contractual Clauses.
- Records of processing: keep a simple register of what data you hold, why and for how long.
- Retention rules: delete inactive leads after a period you can justify.
- Data subject requests: agree who answers access and deletion requests, typically within one month.
In practice, a shared spreadsheet is enough for many SMEs. What matters is that it stays current and that someone owns it.
GDPR-Compliant Marketing Checklist for SMEs
Use this checklist before you launch a new campaign or tool. It also works well as a quarterly review.
- Every marketing activity has a documented lawful basis.
- Forms use unticked, purpose-specific consent boxes.
- Consent records show who agreed, when and to what.
- Non-essential cookies load only after consent.
- Every email includes a working one-click unsubscribe.
- All marketing vendors have signed a DPA.
- Your privacy notice matches what you actually do.
- Old or inactive data is deleted on schedule.
Common Mistakes to Avoid
Even well-organised teams make a few recurring errors. So watch out for these:
- Copying a template privacy policy that does not describe your real tools.
- Treating B2B data as out of scope. A named work email is still personal data.
- Importing event or trade fair lists into your newsletter without valid consent.
- Forgetting ad platforms. Uploading customer lists for custom audiences needs a clear basis.
- Setting it and forgetting it. Websites change, so compliance checks must repeat.
A later post, Email Marketing & Automation Without Breaking GDPR, goes deeper into automation flows.
Who Owns GDPR-Compliant Marketing in Your Team?
Compliance fails most often when everyone assumes someone else is responsible. Therefore, give each task a clear owner, even in a small team.
| Area | Typical owner | Review rhythm |
|---|---|---|
| Cookie banner and tags | Web developer or agency | Every release |
| Forms and consent records | Marketing lead | Quarterly |
| Vendor DPAs | Managing director or operations | When adding a tool |
| Data requests | One named contact | As they arrive |
In addition, keep the whole team informed. For example, a short onboarding session helps sales staff understand why they cannot add business cards to the newsletter. Similarly, a one-page internal guide helps new hires follow the same rules. Because GDPR-compliant marketing touches several roles, a monthly ten-minute check-in also keeps small issues from growing. As a result, compliance becomes a routine rather than a last-minute project.
FAQ
Does GDPR-compliant marketing apply to B2B companies?
Yes. GDPR protects individuals, and a business contact such as a named work email is personal data. However, national ePrivacy rules for B2B email vary, so check each target country.
Can I use legitimate interests instead of consent for marketing?
Sometimes. Recital 47 says direct marketing may be a legitimate interest. Still, cookies and most consumer emails need consent, and you must document a balancing test.
What is the fastest way to start with GDPR-compliant marketing?
Begin with your website. Fix the cookie banner, clean up forms and sign DPAs with your main tools. Then build your records of processing step by step.
Do small companies need a Data Protection Officer?
Not always. A DPO is mandatory mainly when core activities involve large-scale monitoring or sensitive data. Even so, name one person who owns data protection questions.
Build GDPR-Compliant Marketing Into Your Systems
GDPR-compliant marketing works best when it is built into your website, forms and tools from the start, rather than added later. Webie Global supports European and international businesses with web development, SEO and digital marketing, CRM solutions and dedicated teams. We work in English with clear processes, GDPR-aware practices and flexible engagement models. Explore our services.
If you want a second pair of eyes on your consent setup or marketing stack, contact our team at huyen.dang@webieglobal.com.
Series navigation — Marketing from Zero to Hero: Previous: Marketing Budget Planning for SMEs · Next: Building Your Marketing Tech Stack.
