The GDPR – what does it mean in practice for your communication?

What does the GDPR mean?

The GDPR replaced the Swedish Personal Data Act, PUL

GDPR stands for General Data Protection Regulation, an EU regulation that came into force on 25 May 2018. In Swedish it is also called the general data protection regulation or the European data protection law. It replaced PUL, the Swedish Personal Data Act.

Create GDPR-compliant newsletters

What does the GDPR involve?

The GDPR means stronger protection for the individual through considerably stricter requirements on how personal data is handled.

• There must be support in the law for collecting the data.
• Companies must not collect more personal data than necessary – and only for a purpose decided in advance.
• The data must not be kept longer than necessary.
• Each individual has more insight into how their data is handled and stored.

Roughly, the GDPR covers:

• Requirements for new routines and processes for handling personal registers.
• It is not allowed to collect personal data and sell it to third parties.
• Anyone who collects or uses personal data must have a valid legal basis, for example a correct consent.
• It must be clear why personal data is collected, whether it is necessary to collect it and what it will be used for.
• The individual must be able to withdraw their consent at any time.
• Each individual must be able to find out at any time what data each company holds about them.
• Each individual has the right to have their data corrected and moved.
• Each individual has the right to be forgotten, that is, to have their data deleted from a company's register.

What is the difference between PUL and the GDPR?

The difference between PUL (the Swedish Personal Data Act) and the GDPR is significant and has led to a stronger and more comprehensive level of protection for personal data. Here are the main differences:

1. Stricter rules on consent: The GDPR sets stricter requirements for obtaining and being able to prove consent. Organizations must be able to show that consent was given clearly and that it can be withdrawn at any time. Implied consent or pre-ticked boxes are no longer enough.
2. Accountability: The GDPR requires companies to describe clearly the purpose of collecting and processing data, and what they intend to do with it. Transparency in how personal data is used is in focus.
3. Duty to report to the Swedish Authority for Privacy Protection (IMY): Organizations must report data breaches or loss of personal data to IMY within 72 hours, and inform the individuals affected when needed.
4. More oversight and fines: IMY can issue significant administrative fines for violations. The highest amounts can reach 20 million euros or 4 percent of global turnover, whichever is higher.
5. Data protection officer: Larger organizations, public authorities and organizations that handle sensitive personal data must appoint a data protection officer who monitors compliance and acts as a contact person.
6. Data portability: Individuals can request their personal data and transfer it to another service, which gives the individual more control.
7. The misuse rule removed: PUL allowed handling of unstructured personal data as long as it was not offensive. The GDPR requires all processing to be documented and to have a clear purpose.

What are the benefits of stronger data protection for your company?

The stronger data protection under the GDPR has real benefits for your business:

1. Order: documented and organized processing of personal data makes processes more efficient and gives a more structured business.
2. Up-to-date registers: regular reviews give current customer and supplier data, which improves both marketing and business decisions.
3. Protected data: the right technical and organizational measures protect both your customers' privacy and your business secrets.
4. More trust: customers and suppliers who see that you take data protection seriously trust you more, which gives more loyal customers and stronger business relationships.
5. Goodwill and a competitive advantage: clearly following the GDPR builds a good reputation and can be decisive in procurements and partnerships.

What is defined as personal data?

Personal data is any kind of information that can be linked, directly or indirectly, to an identified or identifiable living person: names, pictures, email addresses, phone numbers, IP addresses, DNA, home addresses and more.

What counts as collecting personal data?

Review your business: how are names and email addresses stored on your server and website? Once you know what information you collect, you also need to be able to answer why you do it. A good place to start is how you build your email list – that is where most of your consent handling is decided.

What is a legal basis?

To handle personal data, you need support in the regulation. There are several legal bases to rely on. Further down we look more closely at the two most common in marketing: consent and legitimate interest.

What is the role of a data controller?

You who collect personal data are called the data controller. You are responsible for:

• Understanding that personal data is the person's right. You do not own it, as a company or as an organization. The private individual does.
• Living up to "privacy by default". Do not collect data you do not need.
• Deciding the purposes of the processing.
• Following the principle that silence does not count as consent. Neither do pre-ticked boxes or inactivity.

What does data processor mean?

Paloma in Sweden AB is an example of a data processor: the party that processes personal data on behalf of the data controller. The data controller and the data processor must draw up a data processing agreement. According to the GDPR, it must include:

• Processes for any data breaches.
• Processes for how any data breaches are reported to the Swedish Authority for Privacy Protection (IMY).
• That we, as the data processor, have the highest security on our servers.
• Documentation of which personal data we store, how we store it and why.

Transfers of personal data to third countries

When personal data is made available to someone outside the EU/EEA, it is called a transfer of personal data to a third country. Under the GDPR, it is only allowed under certain conditions.

What counts as a transfer to a third country?

Publishing something on a website does not count as a third-country transfer if the website is hosted by an internet provider within the EU/EEA. But it does count as a transfer if you:

• Send documents containing personal data by email to a recipient outside the EU/EEA.
• Use a data processor outside the EU/EEA.
• Give someone outside the EU/EEA access, for example read access, to personal data stored within the EU/EEA.
• Store personal data in a cloud service based outside the EU/EEA.

When can a transfer to a third country be allowed?

• When the country, according to the European Commission, ensures an adequate level of protection.
• When you have taken appropriate safeguards, such as BCR (Binding Corporate Rules) or SCC (Standard Contractual Clauses).
• In special situations and individual cases.

Which countries have an adequate level of protection?

See the Swedish Authority for Privacy Protection's list of countries with an adequate level of protection. One example is the USA, where the level of protection is adequate provided that the receiving organization is covered by the EU-U.S. Data Privacy Framework. Read more about transfers to the USA at IMY.

Where do the newsletter tools store your data?

Where the tool stores your data decides whether you need to consider transfers outside the EU/EEA. Paloma, Ungapped and Get a Newsletter store data in Sweden. Rule, Brevo and MailerLite state storage within the EU. Mailchimp has its servers in the USA, which is outside the EU/EEA.

The information comes from the providers' own pages and was checked on 8 October 2026. In our comparison you can see where the newsletter tools store your data, side by side.

What does the GDPR mean for email and email campaigns?

Sending email, newsletters or other communication by email means that you handle personal data in the form of email addresses and often names or other identifying information. That is why all email campaigns are covered by the GDPR. With the right routines, and respect for the recipient's privacy, you can send lawful and effective emails that build trust.

What does the GDPR say about sending email?

Sending email to customers or subscribers is perfectly fine, as long as you follow a few basic rules. Under the GDPR you must have a clear purpose and a lawful basis, for example consent or legitimate interest.

Remember: an email address counts as personal data even if it does not contain a name. For example, info@company.com can be personal data if it can be linked to an individual.

What applies to email lists?

For an email list to be GDPR-compliant, you need to:

• Know exactly where the addresses come from
• Have documentation of how you got consent (or another legal basis)
• Offer an easy way to update or delete data

Are you using bought or old lists without a clear source and consent? Then it is time to clean up, and start over with the methods in our guide on how to build an email list.

What is required for a lawful email campaign?

• A clear purpose (for example information, news, offers)
• Consent that is freely given, informed and active, or another legal basis
• An easy way to unsubscribe in every email
• Secure handling of email addresses and other sensitive data

Tip: use double opt-in to prove that the consent is genuine. The GDPR is not about stopping email but about creating safe and relevant emails. With the basics in order, you can communicate effectively without compromising on privacy.

Checklist of measures to comply with the GDPR

• Make sure everyone in your organization knows about the GDPR and what it means overall.
• Review systematically which personal data your company handles and stores.
• Map carefully which personal data your company actually collects today.
• Make sure there is clear documentation of why you store each piece of personal data and how. Be transparent in your work.
• Delete all unnecessary personal data and unused address lists.
• Set up a process for reporting breaches or security risks to the Swedish Authority for Privacy Protection (IMY) within the 72-hour time frame.
• Appoint a person responsible for matters concerning the right to be forgotten.
• Check that you can show your recipients' consent for your newsletter. If it is missing, you need to obtain it actively.
• Assess whether there is a legitimate interest in sending newsletters or whether you need to renew your process for active consent. A newsletter tool makes it easier to handle consent, unsubscribes and documentation.
• Make sure you understand what consent under the GDPR means and that the recipient always has the right to withdraw their consent.
• Be specific and clear when you ask for consent for different purposes.
• Include an easily accessible unsubscribe link in all your newsletters – more on that in the guide create a newsletter step by step.

To comply with the GDPR, we at Paloma have carried out a thorough review of how we handle personal data and set up solid processes, routines and quality assurance systems. We have also developed our platform further so that our customers can easily comply with the GDPR, whether they work with events, newsletters or other communication tools.

Create GDPR-compliant newsletters

Examples of practical measures Paloma has taken

• Introduced a user-friendly subscription form for collecting email addresses for the newsletter. The consent text can be adapted to your needs, and no boxes are pre-ticked.
• Built consent features into ticket purchases and seat booking in our event platform. When participants buy tickets or book seats, they easily give their consent to the necessary storage.
• Implemented automatic, scheduled deletion of address lists to eliminate unnecessary storage and minimize risks.
• Introduced restrictions for text messages to ensure compliance with the stricter consent requirements for that channel.
• Developed a user-friendly feature for requests to be forgotten.

As a Swedish company and cloud service (SaaS), we store all data in Sweden with our hosting partner Cygate, part of the Telia group. That gives you peace of mind, since the risk of data transfers to third countries is eliminated.

At Paloma we take the GDPR very seriously and work continuously so that you can feel safe when you use our tools for events, newsletters, email marketing and surveys. You will find more details about Paloma and the GDPR in our help center.

When it comes to social media, companies are now responsible for both their own posts and other users' posts on platforms such as Facebook, YouTube, Instagram and LinkedIn. Your ability to moderate content affects the degree of responsibility. If your company is active on social media with a larger following, dig deeper into what applies there.

In depth: consent under the GDPR

Under the GDPR, consent means a freely given, specific, informed and unambiguous agreement from the person concerned to the processing of their personal data. Consent can be given in writing, electronically or orally. Pre-ticked boxes or similar solutions are not allowed.

What does it mean that consent must be freely given?

The person concerned must have a clear and obvious option to refuse consent. If consent is not freely given, it is considered invalid. That is why pre-ticked boxes are not allowed.

How does consent covering several purposes work?

If you collect personal data for very different purposes, consent must be obtained for each specific purpose. If you collect email addresses for a newsletter about running and later start a newsletter about sailing, you must get new consent for the sailing newsletter. So be clear about what the customer is consenting to, in the consent confirmation too.

What information must be included for a valid consent?

The consent must be clearly specified: which processing is carried out and for what purpose. The party collecting the data must also identify itself to the person concerned. The following must be included when you ask for consent:

• The purpose or purposes of processing the personal data.
• Which personal data is processed.
• Your company's name, address, phone number, company registration number and email address, as well as any recipients or parties with access to the data.
• Contact details for any data protection officer.
• Information about the obligation to disclose the personal data if the person concerned requests it.
• The right to request correction of their personal data.
• The right to withdraw consent and how to do it.
• The right to be forgotten and how to request it.
• Which safeguards are taken for any transfer outside the EU and how the person concerned can get information about it.
• When the consent stops being valid.

It is better to ask once too often than once too seldom. If the processing has several purposes, each purpose must be specified and consent obtained for each one.

Can someone give consent for other people, for example as a guardian?

In exceptional cases, one person can give consent for someone else, for example as the guardian of minors who cannot give legal consent themselves.

What does unambiguous consent look like?

You may not use personal data for purposes the people concerned have not consented to. If you operate in several product areas, you must know what customers have consented to: addresses from the newsletter about equestrian sports must not be used for emails about golf clubs. New consents are needed there.

What are the differences between PUL and the GDPR when it comes to consent?

The GDPR sets much higher requirements for documentation: consent must be provable afterwards. Pre-ticked boxes are not valid consent. Transparency increases: the person concerned has the right at any time to find out what data a company holds, to have it corrected and to be forgotten. There are also administrative fines for violations.

How do I write consent texts?

To make collecting consents easier, Paloma has developed a consent form and a template for consent texts. In our guide on the GDPR and newsletters you will also find a ready-made example of a correct consent text and GDPR-compliant forms.

Is it possible to collect personal data without consent?

Yes, if there is another legal basis. When marketing companies, products, services or activities, legitimate interest can be a possible basis. It requires a careful assessment that there is a legitimate interest.

What counts as a legitimate interest?

Under the Swedish Marketing Act, balancing of interests means that in some cases you can store personal data without consent when you market specific products. Under the GDPR the assessment is in principle the same, and direct marketing can be a legitimate interest. The assessment is made individually in each case, after balancing the interests.

The processing is only lawful if it is necessary for your business and the interests, rights and freedoms of the person concerned do not outweigh it, for example if the person is a child. You must state the legitimate interest clearly, know why you process the data before you collect it, and always stop direct marketing if the person objects.

May you email your customers without consent?

Yes, in many cases. You may send email marketing to existing customers without prior consent if the address was collected at a purchase, the content concerns your own similar products and every email has an easy way to unsubscribe. This is sometimes called soft opt-in and follows from the Swedish Marketing Act, with legitimate interest as the legal basis under the GDPR.

This is one of the most common questions we get, and the uncertainty means that many companies refrain from emailing their customers for no reason. Here is how it fits together.

Two laws work together

The Swedish Marketing Act governs the email itself: when you may send advertising by email and what it must contain. The GDPR governs the personal data behind it: on which legal basis you store and use the address. You need support in both, but if you do it right under one, the other usually follows.

The customer exception: three conditions that must all be met

1. The address came from the person themselves in connection with a purchase of goods or a service from you.
2. You market your own, similar products to what the person bought. Not other companies' offers, and not a completely different business area.
3. It is easy to say no, both when the address is collected and in every email – in practice a clear unsubscribe link.

If you meet all three, your existing customer base can in most cases be emailed today. What you may not do is stretch the exception too far: a customer who bought a ticket has not said yes to advertising for something completely different.

What applies to email to companies?

The starting point for B2B is softer. Advertising to a legal person, such as info@ or a role address, does not require consent. A personal work address, on the other hand, belongs to a natural person, and there serious senders rely on a balancing of interests: the email should be relevant to the recipient's professional role, the sender clear and unsubscribing easy. Be extra careful with sole traders, where the business address and the private person are the same thing. The test question for every B2B email: why is this relevant to this particular role?

Legitimate interest in practice

On the GDPR side, the legal basis for customer emails is normally legitimate interest. The GDPR itself mentions direct marketing as an example of an interest that can be legitimate. Three things are required of you: a documented balancing of interests, information about the processing in your privacy policy, and that objections are respected right away. Anyone who objects to direct marketing has an unconditional right to be spared. Unsubscribing is therefore not a courtesy but a right, and it must take effect immediately.

Three myths about consent and email

• "We need consent from everyone." No. The customer exception and legitimate interest exist precisely for existing relationships. Many refrain from sending emails for no reason.
• "If they have not unsubscribed, anything goes." No. Silence is not consent for new contacts. The exception applies to customers, not to anyone who has not protested.
• "B2B is unregulated." No. Personal work addresses are personal data, and relevance plus easy unsubscribing apply there too.

A quick test before you press send

• Every address has either consent or a customer relationship covered by the exception
• The content concerns your own, similar products (for the customer exception)
• A clear sender and an unsubscribe link in every email, and unsubscribes take effect right away
• The balancing of interests is documented
• Bought or borrowed lists: never

Would you rather build your list with active consents from the start? Read the guide on how to build an email list. And a good first email to new subscribers is an automatic welcome email.

How does the lawyer answer questions about the GDPR?

What are the consequences of not following the regulation?

A company that breaks the legal requirements can get administrative fines of up to 20 million euros or 4 percent of the parent company's global turnover, whichever amount is higher. The Swedish supervisory authority, the Swedish Authority for Privacy Protection (IMY), exercises considerably stricter supervision than under PUL, and has issued substantial fines against both companies and public authorities.

The regulation aims to ensure a high level of protection for citizens, adapted to technological developments, and to protect privacy in line with the European Convention's right to respect for private life.

What is the definition of personal data?

Personal data is information that can be linked, directly or indirectly, to an identified or identifiable living person: names, pictures, IP addresses, DNA and similar.

What are the big changes?

More insight for citizens: the right at any time to find out what data a company holds, to have it corrected and to be forgotten, that is, deleted from the company's register.

How is consent worded in the regulation?

Consent is defined as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."

How is processing of customers with several purposes handled?

All processing of personal data must have a legal basis. For active customers in both B2B and B2C relationships, the contractual relationship can be the legal basis, and as a main rule, relevant emails to people in B2B relationships can be sent with legitimate interest as the basis. The safest option, though, is to use consent as much as possible. Consent is also in line with the principle of inbound marketing: people who have agreed to receive information are interested and open to the message. Always give the mandatory information about the processing when consent is obtained. Those who succeed best with their marketing within the framework of the GDPR are those who integrate the information into their normal customer communication.

Why is legitimate interest a complicated legal basis?

Using legitimate interest for email marketing can be complicated, especially in B2B relationships. The Swedish Authority for Privacy Protection (IMY) has previously approved guidelines from the industry organization SWEDMA for deciding what counts as a legitimate interest (the guidelines may be updated). As a main rule, collecting email addresses in B2C relationships without consent is prohibited, but an exception is made for soft opt-in, where collection and sending can take place under certain conditions in connection with a sales discussion. The assessment is more flexible in B2B relationships, where it is normally considered legitimate to send marketing by email to people in their professional role. Be aware of the limits, though, especially when it comes to sole traders. A structured answer to when you may email without consent is in the section above.

How long may you keep personal data based on legitimate interest?

There are no specific time frames. Have routines for weeding out and deleting data when it is no longer relevant or can be considered outdated. If possible, consider converting data based on legitimate interest into consents, for a stronger basis to keep the data longer.

Why should you be extra careful with customer profiling?

Technical tools for customer profiling are becoming more and more sophisticated, and the GDPR has forced big data collectors such as Google and Facebook to change their data collection and profiling. The GDPR sets strict requirements for companies that do profiling. If you use your own analytics tools for profiling, at whatever level, you need to know how to comply with the regulation.

What applies now to the misuse rule?

The earlier exception for unstructured personal data, the misuse rule, disappeared with the GDPR. To publish a picture of a person on social media in a channel your company controls, the company must ensure a valid consent for the publication.

What should be considered when storing data on servers outside the EU?

The matter is regulated in the data processing agreement. If personal data is sent outside the EU/EEA, the receiving country must have an adequate level of protection under the GDPR; otherwise additional agreements based on the EU's standard contractual clauses are required. For the USA, the receiving organization must be part of the EU-U.S. Data Privacy Framework. It is the company's responsibility to check whether its suppliers meet the GDPR's requirements.

20 quick tips about the GDPR

1. Appoint someone responsible for data protection matters, even if you do not have to have a formal data protection officer.
2. Map every place where personal data exists: email lists, CRM, events, forms, spreadsheets.
3. Delete what you do not need. The least possible data is the best possible protection.
4. Document the legal basis for every register.
5. Use double opt-in for all new subscribers.
6. Never have pre-ticked consent boxes.
7. Write consent texts in plain language, not legalese.
8. Never buy address lists.
9. Make sure the unsubscribe link is in every email and works right away.
10. Document the balancing of interests if you email customers with legitimate interest as the basis.
11. Keep registers up to date: remove bouncing addresses and inactive contacts regularly.
12. Choose suppliers that store data within the EU/EEA, preferably in Sweden.
13. Sign data processing agreements with all suppliers that handle your personal data.
14. Have a routine for the right to be forgotten, and test that it works.
15. Have a process for reporting data breaches to IMY within 72 hours.
16. Train everyone who works with emails, events or customer data in the basics.
17. Only ask for the data you need in forms: the email address is often enough.
18. Review your consents when you expand the business into new product areas.
19. Be extra careful with children and sensitive personal data.
20. Do an annual GDPR review with the checklist above – it goes a long way.

Frequently asked questions about the GDPR

Communicate safely and GDPR-compliantly

With the basics in place, the GDPR is not a brake but a quality stamp on your communication. Create a free account and send newsletters with double opt-in, consent handling, automatic unsubscribing and storage in Sweden built in from the start.

Create a free account

This guide is general guidance, not legal advice. If you are unsure in a specific case, check with a lawyer.