GDPR Compliant Email Marketing Software: 10 Questions to Ask

GDPR compliant email marketing software is a platform that lets you meet UK GDPR and PECR, but no tool makes you compliant on its own.

UK GDPR lets you use only a processor that gives "sufficient guarantees" (UK GDPR Article 28).

So the test is whether a provider can answer specific questions in writing. A community theatre in Ipswich moving 4,000 supporters off a spreadsheet, our invented example, needs those answers before its first import.

What makes email marketing software GDPR compliant?

GDPR compliant email marketing software does the processor's share of the work and makes your share easy. You decide who gets emailed and why, so you are the controller. The provider stores and sends on your instructions, so it is the processor.

Since 30 September 2026 the regulator's legal name has been the Information Commission (news release). It is still called the ICO, now short for Information Commission's Office, and publishes guidance at ico.org.uk.

A contract fixes the processor's duties. Article 28 lists what it must cover, from security and sub-processors to deletion when the contract ends (ICO).

The Privacy and Electronic Communications Regulations (PECR) ask one thing of the platform itself. Every email it sends for you must show who sent it and carry a working opt-out, including emails to limited companies, which need no prior consent (ICO).

Choosing whom to email stays with you, not the software. The UK rules on consent and the soft opt-in apply whichever tool you pick.

DKIM and DMARC (the policy for mail that fails authentication) guard your domain against spoofing; judge them as deliverability tools, apart from data protection.

10 questions to ask about GDPR compliant email marketing software

Put these questions to every provider on your shortlist. Ask for each answer with the clause or help page behind it. The right-hand column shows MailGraf's answers, taken from our data processing agreement (DPA) dated 15 October 2026 and our help centre.

Question	A clear answer names	MailGraf's answer
1. Do you offer a data processing agreement under UK GDPR Article 28?	The Article 28 terms, naming UK GDPR as well as the European version	Yes. It is part of our Terms, needs no signature, and we countersign a copy on request
2. Where is our contacts' data stored?	The country of the main database and a list of sub-processors	Servers in Germany, with every sub-processor listed by location (DPA 9.1 and Annex 3)
3. What covers transfers out of the UK?	One mechanism per transfer: UK adequacy, the UK Extension or the International Data Transfer Agreement (IDTA)	UK adequacy first, then the UK Extension for certified US recipients, then the IDTA or UK Addendum (DPA 9.2)
4. How much notice before a new sub-processor, and can we object?	A notice period in days and a right to object	30 days' notice and 15 days to object; if no alternative is found, you can end the affected part of the service with a refund of prepaid fees (DPA 5)
5. What does a consent record contain?	Who, when, how, and the exact wording shown at the time	Method and date; after double opt-in, the confirmation time and internet (IP) address; for forms with a consent box, the sign-up page and the text agreed
6. Can we use double opt-in?	Where it applies and how you see who confirmed	Yes. A form that shows the consent box sends a confirmation email first; once the contact clicks the link, the profile shows Confirmation recorded
7. Can anyone remove the unsubscribe link?	A footer link that stays, plus a one-click unsubscribe header	No. The footer row with your address and Unsubscribe cannot be deleted, and every send carries a one-click List-Unsubscribe header
8. Can we handle access and erasure requests ourselves?	A one-contact export and an erasure that survives re-imports	Yes. Download contact data and Permanently forget sit on each contact profile
9. How fast will you tell us about a data breach?	A number of hours that leaves room for your 72-hour deadline	Within 48 hours (DPA 7.1)
10. What happens to our data when we leave?	An export window and a point when deletion happens	Export at any time in CSV, a spreadsheet format; 14 days after closing to export, then deletion from active systems, with backups expiring on their normal cycle (DPA 11)

The law asks a processor to report a breach "without undue delay", with no hours attached. The controller then has 72 hours to tell the regulator, where feasible, unless the breach is unlikely to put people at risk (UK GDPR Article 33). A provider that commits to a number gives you time to act.

Where your contacts' data lives and how it can travel

Contact data can leave the UK lawfully, so a provider based abroad is not ruled out. Each transfer needs a named transfer mechanism.

The UK's adequacy regulations cover the European Economic Area: the 27 countries of the European Union (EU) plus Iceland, Liechtenstein and Norway (ICO). A database in Germany or Ireland therefore needs no extra safeguard.

The United States is covered only in part. The UK Extension to the EU-US Data Privacy Framework (DPF) applies to US businesses that have self-certified to it. Their status on the DPF list must also be active (ICO).

The ICO adds that this UK arrangement stands apart from the EU one. It would not fall automatically if a European court struck down the EU version.

Elsewhere, the transfer needs a safeguard such as the IDTA. Since the Data (Use and Access) Act 2025, the check behind that safeguard is called a data protection test (ICO). It asks whether protection after the transfer is "not materially lower" than in the UK.

European hosting does not settle the matter. Sending, address checks, error monitoring and AI features often run on separate services.

Our own list shows it. The MailGraf database is in Germany, yet three of the six sub-processors in our DPA are in the United States. Each of those three relies on the UK Extension or the IDTA.

So ask for the sub-processor list itself, not a line about European servers. We sell email software, not legal advice: treat these answers as the start of your checks. Bring in a data protection adviser for unusual data such as health records, which our DPA (clause 3.4) accepts only with written agreement in advance.

What a consent record should prove

Good consent evidence shows who agreed, when, how, what they were told and whether they have withdrawn since. Those are the five points the ICO expects your records to cover (ICO consent guidance).

The "what they were told" point is where platforms differ most. The ICO's failing example is a time and date linked to an IP address, plus a link to your current sign-up form. Forms get edited, so today's version cannot show what someone read last spring.

In MailGraf, a contact's Consent details shows the Consent method and the Recorded on date. After double opt-in it also shows the Confirmed time and IP address.

For people who joined through a form with a consent box, Consent proof adds the page they signed up on and the text they agreed to. We save that text at the moment of sign-up. Editing the form later leaves earlier records as they were.

Download consent record turns the record into a PDF, which you can send to a subscriber or to the regulator.

Imported contacts are recorded as single opt-in, based on your permission declaration, and show No confirmation record (consent status and confirmation records). That label only means no confirmation click is on file.

The Ipswich theatre's spreadsheet contacts would arrive this way, so the theatre should keep its old sign-up sheets and form wording.

UK law does not require double opt-in. Still, a click on the confirmation link is strong evidence that the address owner signed up. Our comparison of single, double and soft opt-in shows where each fits.

Open tracking belongs in the same conversation. The ICO says tracking pixels in marketing emails fall under PECR's separate rules on storage and access technologies (ICO). Ask whether you can switch the open-tracking pixel off; in MailGraf, Open tracking sits under Settings on a campaign's Review step, while link clicks are always tracked.

Does your current tool keep only a tick and a date? You can create a MailGraf account from the pricing page.

Unsubscribes, access requests and erasure

Every marketing email needs a way out that keeps working after imports, migrations and erasure requests. ICO guidance asks you to put people who object on a suppression list and to check it before sending (ICO).

The usual failure is a re-import. An old spreadsheet goes back in, and people who unsubscribed last year start getting emails again.

Ask each provider what happens when an unsubscribed address arrives in a new file. In MailGraf, an import never resubscribes a contact who unsubscribed, so they stay out of every campaign and automation.

Erasure has the same trap in reverse. If a platform wipes every trace of a person, nothing stops the address returning with the next upload.

MailGraf separates the two actions on a contact profile. Delete removes the record, and the address can be added and emailed again.

Permanently forget deletes the personal data and keeps only a hashed form of the address on the block list. That address gets no email, even if someone imports it later (read a contact profile).

An access request starts from the Contact actions menu: Download contact data puts everything held about that contact into one file.

Some people want fewer emails rather than none. A preference centre with pauses and topics can keep them, as long as the unsubscribe link stays beside it.

Is Mailchimp GDPR compliant?

Mailchimp can be used in line with UK GDPR. The conditions are a valid transfer mechanism and your own work on consent.

Its data processing addendum, effective 26 September 2024, relies on the DPF, including the UK Extension, for data it receives in the US. Its fallback is the EU standard contractual clauses with the UK Addendum.

Two checks stay with you. Look the company up on the DPF list yourself, because certification has to be renewed every year. Then read the sub-processor terms: Mailchimp's addendum gives five calendar days to object to a new sub-processor, where ours gives 15.

If you decide to move, switching from Mailchimp to MailGraf starts with your unsubscribed contacts, so nobody who left is emailed again.