Send GDPR-compliant newsletters and get it right from the start
Can you send newsletters under the GDPR? Yes – if you do it the right way. Here we go through what the law means, how to collect consent and which routines you need to communicate safely, legally and personally with your recipients.
What is GDPR?
GDPR stands for General Data Protection Regulation, the EU's data protection law. It took effect in 2018 and affects how every organization collects, stores and uses personal data. Its purpose is to strengthen the protection of the individual: people should know what data is stored, why, for how long and how it can be deleted.
How does GDPR affect sending newsletters?
When you send newsletters, you handle personal data (such as email addresses and names). To be allowed to send newsletters, you need a legal basis – usually consent or legitimate interest.
- Consent: the recipient has actively said yes to receiving newsletters.
- Legitimate interest: can be used for an existing customer relationship and similar products or services; the recipient must be able to unsubscribe easily.
What counts as personal data?
Any information that can be linked to a person: name, address, email, phone number, IP address, photos, customer or membership numbers and more.
How to send GDPR-friendly newsletters
1) Collect consent the right way
Use sign-up forms where subscribers actively choose to receive newsletters. Turn on double opt-in so that the address is confirmed by email.
2) Inform clearly
Describe what the subscription involves (for example news, tips or offers) and how often you send emails.
3) Store data securely
Use a solution where all information is stored within the EU – preferably in Sweden. Paloma stores data on Swedish servers (Telia Cygate).
4) Always make it possible to unsubscribe
Every email you send must have a clear link for ending the subscription.
Example: a correct consent text
“I agree that [company name] stores my details in order to send me newsletters in accordance with the GDPR. I can unsubscribe at any time via the link in the email.”
Avoid pre-ticked boxes – consent must be freely given and active.
The difference between consent and legitimate interest
The GDPR allows several legal bases, but for newsletters consent and legitimate interest are the most common.
- Consent: the safest and most transparent route. You can show when and how consent was given.
- Legitimate interest: can work if the recipient is already a customer and the emails are about similar services or products. Always tell them how to unsubscribe easily.
Our recommendation: if you are unsure, choose consent. It is the clearest option, both legally and for the relationship.
Want to know when you can email customers without consent? Read more in our big GDPR guide.
Examples of GDPR-compliant forms
Heading: Subscribe to our newsletter
Text: We send news, tips and inspiration once or twice a month. You can unsubscribe at any time.
Fields:
- Email address
Once the recipient has confirmed by email (double opt-in), you have fully valid consent.
What to include when you ask for consent
- The purpose of storing the data
- Your company's name and contact details
- Who has access to the data (if other parties are involved)
- How the person can access, correct or delete their data
- How long the data is kept
- The right to withdraw consent
- Whether data is processed outside the EU (and how it is protected)
- Contact details for your data protection officer (if you have one)
Get started with GDPR and newsletters (checklist)
- Map out which personal data you handle today
- Delete data that is not necessary
- Document the purpose of every data collection
- Make sure you have valid consent for every address on your newsletter list
- Have a clear routine for deleting data on request (“the right to be forgotten”)
- If there is a data breach: report it to the data protection authority (IMY in Sweden) within 72 hours
How to avoid GDPR fines with newsletters
Common reasons for complaints:
- No proof of consent
- Pre-ticked checkboxes
- No unsubscribe link
- Emails sent after someone has unsubscribed
Paloma helps you avoid this with clear consent flows, automatic handling of unsubscribes and logs.
How Paloma helps you comply with the GDPR
- Double opt-in in sign-up forms
- Customizable consent texts
- Automatic handling of unsubscribes
- Storage in Sweden with Telia Cygate
- A “right to be forgotten” flow and role-based permissions
FAQ: newsletters and GDPR
Can I send newsletters without consent?
No, not in Sweden. You need active consent from the recipient, or an existing customer relationship that justifies the emails. All communication must meet the GDPR's requirements for a legal basis.
What does double opt-in mean?
Double opt-in means that the recipient confirms their subscription via a link in an email. It ensures that no one signs up someone else by mistake – and that your consent is traceable and valid under the GDPR.
Do I need an unsubscribe link in every newsletter?
Yes. The GDPR requires that recipients can easily withdraw their consent. In Paloma, the unsubscribe link is added automatically to every email you send.
How long can I keep contact details?
As long as you have a clear and current legal basis, such as active consent or an ongoing customer relationship. When that basis ends, the personal data must be deleted or anonymized.
How does Paloma help me comply with the GDPR?
Paloma stores all data on Swedish servers and has built-in consent support, double opt-in, consent logging and secure handling of unsubscribes – so you can communicate safely and legally.
Which rules apply to newsletters?
Two sets of rules apply: the GDPR and the Swedish Marketing Act. In practice, you need a legal basis for your emails (usually consent), a clear sender, an unsubscribe link in every newsletter and routines that make sure you do not keep data longer than necessary.
What should a consent text include?
It should say who is collecting the data, what it will be used for, how often you plan to get in touch and how to unsubscribe. Also link to your privacy policy, and leave the box unticked until the person ticks it themselves.
Can you buy email lists?
It is rarely compatible with the GDPR, because the recipients have not given their consent to you specifically. Build your own list with sign-up forms and double opt-in instead. It will be smaller, but the people on it actually want your emails.
Where are my contacts stored in Paloma?
On servers in Sweden. Hosting is provided by Telia Cygate, which is certified to ISO/IEC 27001.
Create a free newsletter
Create your first newsletter in minutes. The free account gives you 250 emails a month with an unlimited number of contacts.
Create a free account