GDPR for marketing teams: the principles that matter
When it reaches a company outside the Union, the seven principles translated into campaign decisions, the six lawful bases, and Article 21 — written almost literally for direct marketing.
The GDPR has ninety-nine articles and almost nobody on a marketing team is going to read them. Nor do they need to: the day-to-day work turns on a handful, and one of them — Article 21 — is written almost literally for what we do.
This is not legal advice. It is the operational reading of what changes in a concrete campaign. Every article cited comes from the official text of Regulation (EU) 2016/679 on EUR-Lex.
First: does it even apply to you?
The question matters because the most common answer outside Europe is “no, unless…”, and that “unless” shows up more often than expected. Article 3(2) extends the Regulation to controllers not established in the Union where the processing relates to:
- offering goods or services to people who are in the Union — payment required or not — or
- monitoring their behaviour, as far as that behaviour takes place within the Union.
Read it twice, because the second limb is the one that catches a marketing operation. It is not about having an office in Europe: if you target campaigns at European countries, or your site tracks visitors who are there, you are in limb 2 territory.
The seven principles, and what each one bans
The Article 5 principles read as an abstract list. Translated into concrete marketing decisions, each one rules out something that happens every day:
| Principle (Art. 5) | What it rules out in practice |
|---|---|
| Lawfulness, fairness and transparency | Collecting in a way the person would not recognise if you explained it. |
| Purpose limitation | Using for B what you asked for under A. |
| Data minimisation | Asking for a phone number “just in case” on a form that only sends a PDF. |
| Accuracy | Letting a stale database keep mis-segmenting people. |
| Storage limitation | Keeping 2019 leads on the active list because nobody set a retention period. |
| Integrity and confidentiality | Sharing the export over an open channel, or leaving accesses unreviewed. |
| Accountability (Art. 5(2)) | Complying without being able to demonstrate it. |
And there is an eighth that lives not in Article 5 but in Article 25: data protection by design and by default. Its paragraph 2 is the most concrete line in the whole Regulation for a product team: by default, only personal data necessary for each specific purpose should be processed — and that applies to the amount collected, the extent of processing, the storage period and its accessibility.
Six lawful bases, not one
The reflex of asking for consent for everything comes from not knowing the list. Article 6(1) allows six grounds, and only one needs to apply:
- Consent of the data subject for one or more specific purposes.
- Contract: processing necessary to perform it, or for pre-contractual steps the person requested.
- Legal obligation to which the controller is subject.
- Vital interests of the person or of another.
- Public task or exercise of official authority.
- Legitimate interests of the controller or a third party, except where the person’s interests or rights override them — with particular care where they are a child.
For marketing, the ones that matter are the first, the second and the sixth. Legitimate interest is a real basis, not a shortcut: it requires the balancing exercise, and the article itself says it yields where the individual’s rights prevail.
Article 21: the one written for marketing
If you keep only one, keep this. Paragraph 2 says that where data is processed for direct marketing, the person has the right to object at any time, including profiling related to that marketing. Paragraph 3 shuts the door: once they object, the data is no longer processed for those purposes.
Note the contrast with paragraph 1. For other objections the controller can still demonstrate compelling legitimate grounds that override. For direct marketing there is no balancing test: the person objects and that is the end of it.
And paragraph 4 is the one almost nobody implements: that right has to be brought to the person’s attention at the latest at the time of the first communication, explicitly, clearly and separately from any other information. Not a grey line in the email footer mixed in with the legal notice: a block of its own, in the first message.
Article 22 is worth a look too: it gives the right not to be subject to a decision based solely on automated processing — profiling included — where it produces legal effects or similarly significantly affects the person. If you are automating lead scoring with real consequences, that article is looking at you.
What valid consent looks like
Article 7 sets conditions that translate straight into an interface:
- The controller must be able to demonstrate that the person consented. No evidence, no consent.
- If the request sits inside a declaration covering other matters, it has to be presented in a clearly distinguishable way, intelligible and in plain language.
- It can be withdrawn at any time and — the line the web breaks most often — withdrawal has to be as easy as giving it.
That last condition is what dictates how a cookie banner should look: if accepting is a button and rejecting is three clicks deep, the design has already answered the question. On our own site accept and reject are the same size and the same weight, and there is a footer entry to change the decision later.
Where Chile differs
If you are already working through Law 21.719, much of the work counts for both. The differences worth holding on to:
- Lawful bases. The Regulation lists six; the Chilean framework is built on four — consent, contract, legal obligation and legitimate interest — which happen to be the ones marketing uses most.
- The breach clock matches. 72 hours in both, though the nuance differs: Article 33 exempts breaches unlikely to result in a risk, and requires reasons where notification is late.
- The underlying logic is the same. Demonstrable accountability, minimisation, purpose, security and privacy by design. A programme built for one covers most of the other.
Which is why running two separate programmes is a mistake. Build one against the strictest standard that applies to you, and document which obligation came from where.
FAQ
- My company is in Chile. Does the GDPR apply to me? It can. Article 3(2) extends it to controllers outside the Union when the processing relates to offering goods or services to people in the Union, or to monitoring their behaviour as far as that behaviour takes place within the Union. Having European visitors is not the test; targeting them or tracking them is.
- Is legitimate interest a way around consent? It is a lawful basis in its own right (Article 6(1)(f)), not a shortcut. It requires a balancing exercise against the rights and freedoms of the individual, and it fails where those override the interest. It also does not survive an objection to direct marketing.
- Can someone opt out of marketing even if I have a lawful basis? Yes. Article 21(2) gives an unconditional right to object to processing for direct marketing at any time, and 21(3) says the data must then no longer be processed for those purposes. There is no balancing test for this one.
- How long do I have to report a breach? Article 33 requires notifying the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it — unless the breach is unlikely to result in a risk to people’s rights and freedoms. Late notification has to come with reasons for the delay.