Have you ever wondered how GDPR affects marketing?
Take British Airways, for example; the company was fined $20m after a data breach.
It’s scary to think this could happen to your business if you don’t correctly protect and handle marketing data.
After all, the ICO is always watching 👀
If you work with B2B data, you must ensure you stay GDPR compliant.
But how?
Read on to find out everything you need to know about GDPR marketing 👇
What is GDPR for marketing?
Let’s start simple.
GDPR standards for General Data Protection Regulation.
GDPR, a European data privacy and protection law, sets standards for how businesses must collect, process, and store individual citizens’ personal data in the EU (European Union) and the EEA (European Economic Area).
The GDPR also sets out specific guidelines for transferring personal data outside of these areas, such as for US-based companies dealing with the data of EU-based customers.
This regulation sets guidelines for all customer-business interactions in marketing, sales, or support.
GDPR marketing sets general guidelines and requirements for marketers collecting, processing, and storing EU citizens’ personal information, such as names and email addresses.
How does GDPR affect B2B marketing?
While the GDPR addresses data protection for individual EU citizens, B2B marketing efforts are not exempt.
Yes, you might be selling to a company, but the people who work within that company (the ones your sales and marketing teams interact with) are individuals, and they have data-related rights that must be protected.
Here’s how GDPR compliance can specifically influence your B2B marketing practices:
Consent requirements
To collect or process personal data for direct marketing purposes (such as an email or job title), you must request explicit GDRP marketing consent, such as checking an opt-in box.
Legitimate interest
In some cases, B2B marketers can collect or process personal data without explicit consent if they can prove they have a legitimate interest.
Data transparency
As a B2B marketer, you must provide clear and transparent information about how you will use an individual’s personal data and the purposes for collecting it.
This information should be made available to the individual should they wish to read it, when they consent to have their data collected, or when they are notified that their data has been collected.
Right to access and erasure
The individuals whose data you collect, store, and process have the right to access that data and to request that you delete it.
Data minimisation
The GDPR requires that marketers only collect personal data relevant to the specific purposes stated and not retain it for longer than necessary.
Data security
Your company must implement appropriate security measures to protect its customers’ personal data from leaks, destruction, alteration, and unauthorised access.
Third-party data
Even if you purchase data from a third-party supplier, you are responsible for ensuring and confirming that the data complies with GDPR requirements.
Some B2B data providers like Cognism make this easy for prospects as the tool follows strict compliance guidelines for both GDPR and CCPA. These include:
- A stringent B2B data verification process.
- Ensures all data is legally sourced and of the utmost quality.
- Provides users with a notified database.
- The ICO regulates it.
- Only provides business emails.
- TPS/CTPS lists in the UK.
- Do Not Call lists in the USA, Canada, Australia and European countries, including Germany, France, Spain, Ireland, Belgium, Croatia, Portugal, Sweden and more.
All of these measures give customers the trust they need to market with confidence.
Just ask Henderson Scott👇
Remember:
Transparency, accountability, and respect for individuals’ privacy rights are key themes in your GDPR compliance marketing and will help you remain compliant.
GDPR marketing consent rules and requirements
One of the core rules of GDPR is to ensure individuals’ opt-in consent before capturing, storing, or processing their data.
The regulation defines consent as:
“Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”
It also provides some clear and helpful rules around marketing GDPR consent:
1. Consent must be freely given
You can’t force someone to consent or back them into a corner, such as by requiring it as a condition of accessing your service.
2. Consent must be specific
You have to present the request for consent in a way that’s obvious that they are giving it. You can’t trick customers into providing valid consent.
3. Consent must be informed
You must tell them clearly what you’re using the data for and why you’re collecting it.
4. Consent must be unambiguous
It cannot be questioned whether the customer has given consent.
5. Consent can be revoked
The individual can take back their user consent at any time.
How does legitimate interest marketing work under GDPR?
Legitimate interest is one of the most critical aspects of GDPR marketing.
Aside from consent, legitimate interest is the most common legal basis for customer communications you’ll use for B2B marketing.
It is also the most flexible of the conditions GPDR provides for legal data processing. Still, your organisation must prove that legal basis and thoroughly justify it in your documentation.
The overarching question to answer is this:
Do you have a legitimate reason for contacting this person that isn’t already covered by another legal basis, such as consent or legal obligation?
Yes, cold outreach can typically be justified as legitimate interest since you have a reasonable reason for contacting them: you have something to sell that could help them.
That said, you should verify that what you’re selling is a potential fit for the person you’re contacting.
For example, cold emailing a stay-at-home mom probably doesn’t count as a legitimate interest if you’re marketing an enterprise sales CRM.
You must also confirm that pursuing legitimate interest does not seriously impact the rights and freedoms of the individuals you’re contacting. Otherwise, you’ll need to find a different legal ground.
What are the rules for email marketing under GDPR?
The general rules for B2B marketing should be followed when considering GDPR email marketing.
That means you can only use personal data if the individual has provided explicit consent or has a basis for legitimate interest.
Most email marketing is going to fall under the banner of explicit consent.
For people on your mailing list to be on the list in the first place, you’ll have received affirmative consent through the opt-in mechanism when they subscribed.
For instance, your weekly newsletter and monthly product updates, sent to customers, should be covered by consent, provided you collect that consent in a manner compliant with GDPR.
What is the GDPR policy for direct marketing?
SMS and email messages sent directly to prospects or customers, as well as telemarketing and physical mail, must also comply with GDPR.
These are all forms of GDPR direct marketing.
The same broad guidelines apply:
You need the customer’s consent to receive your communications or the ability to demonstrate a legitimate interest.
If you rely on consent as the legal basis for communication, it must be explicit and clear, and you must use an active opt-in consent mechanism (as opposed to pre-checked boxes or assumed consent).
Individuals also have the right to withdraw consent at any time, and you must give them a method for doing this, such as unsubscribing from emails.
If you are relying on legitimate interest, you must demonstrate that you have a reasonable and legitimate cause for contacting that person and providing them with a method for opting out of direct marketing communication.
Some additional requirements apply to both legal bases:
Transparency
You must provide clear and easy-to-understand information about why you’re collecting customers’ data and how you’ll use it.
Data minimisation
You should only collect the minimum amount of data needed to complete your stated purpose and keep it for as long as necessary.
Data security
You are responsible for implementing appropriate data security measures to protect customers’ data from disclosure, alteration, or unauthorised access.
How does GDPR affect digital marketing?
Like with email and direct marketing, running a social media marketing campaign also means considering GDPR.
The big thing with GPDR and social is running ads.
Most social media ads are designed to push traffic from the platform to your website. That means they’ll have to click:
- Click on the ad offer.
- Click to accept your website privacy policy.
- Click on the CTA you’ve designed on the landing page.
It’s not necessarily a dealbreaker, but it takes three clicks to generate a lead, which is a lot of places for prospects to drop off.
The same applies to running retargeting ads. You’ll need to either receive valid consent to process that marketing data when the person is on your website or be able to rely on legitimate interest.
Beyond that, the principles discussed above for GDPR marketing emails and direct marketing can be applied to B2B marketing on social media.
GDPR marketing checklist
Performing an audit to confirm you’re 100% GPDR compliant is always a smart idea.
It’s better to find out for yourself that you’ve got to tighten things up than for the ICO to come knocking on your door!
Here’s a quick GDPR marketing checklist to make sure you’re complaint:
- We’ve conducted a data audit to determine what information you will process and who can access it, using GDPR’s data protection impact assessment template.
- We have a legal basis (such as explicit consent or legitimate interest) for processing and storing customer data.
- We’ve provided information about how we collect and use data in our privacy policy.
- We have reasonable security measures in place, such as data encryption and anonymisation.
- We have an internal security policy that team members can access.
- We’ve established a process for notifying authorities in the event of a data breach.
- We’ve signed data processing agreements with any third parties processing personal data on our behalf.
- We’ve made it easy for customers to request a copy of the information we have about them, to update this data, to request that the data be deleted, or to object to us processing their data
Or you can choose a B2B data provider that’s compliant by default. Here’s what you don’t need to worry about with Cognism:
GDPR-compliant marketing data from Cognism
Cognism makes your safety our business with B2B data that complies with the latest international privacy laws.Here’s how Cognism achieves this:
- Collecting limited B2B data.
- Having a lawful basis under GDPR to collect and process our data (legitimate interest).
- Conducting all relevant assessments to determine lawful bases for data collection and processing.
- Notifying our database in compliance with our transparency obligations under Article 14 of the GDPR. We inform data subjects that we have data on them, explain our processing activities and give data subjects the option to exercise any of their rights, including the option to opt out.
- Having a streamlined opt-out process and a dedicated team that deals with Data Subject Access Requests (DSARs) in due time.
- Holding ISO 27001 and ISO 27701 certificates and being SOC2 type II attested.
- Screening our telephone database against Do Not Call registries in the UK (TPS and CTPS), USA, Germany, Australia, France, Sweden, Portugal, Croatia, Spain, Belgium and Canada. We’re also working to register in more DNC registries around the world.
- Reviewing our processes and mechanisms constantly to improve how we collect, store and process data.
Keen to give Cognism’s compliant B2B data a try? Click the banner to book a demo 👇
The contents of this article are for the purposes of general awareness only. They do not constitute legal or professional advice. The content may have changed since this article was published. Readers should take appropriate professional advice for their own particular circumstances.
