GDPR is coming in May 2018: what marketers must do now

The regulation replaces the 1995 Data Protection Directive and the patchwork of national laws built on it. Several parts land squarely on marketing:

• Territorial scope. It applies to organizations outside the EU that offer goods or services to EU residents or monitor their behavior. Retargeting pixels, analytics and email tracking all count as monitoring.
• A higher bar for consent. Consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action. Pre-ticked boxes, silence and inactivity do not count, and consent bundled into terms and conditions is invalid. It must be as easy to withdraw as to give.
• Lawful basis for every processing activity. Consent is one of six bases. Legitimate interests and contract are the others marketers use most, and each needs to be documented.
• Individual rights. Access to their data, correction, erasure, restriction, portability and the right to object to direct marketing, which is absolute.
• Accountability. Records of processing activities, data protection by design, privacy notices written in plain language, and breach notification to the regulator within 72 hours.
• Vendors. Processors such as your email platform, CRM and ad tech must be under contracts with specific terms, and transfers of EU data to the US need a valid mechanism such as Privacy Shield.

The separate ePrivacy Regulation, which would tighten the rules on cookies and electronic marketing further, is still being negotiated and will not be in force by May. Plan for GDPR now and watch ePrivacy.

You cannot comply with rules about data you have not mapped. Build a simple inventory with one row per system or dataset: what personal data it holds, whose, where it came from, what you use it for, who it is shared with, how long you keep it and whether any of it belongs to EU residents. Typical marketing systems to list:

• Email marketing platform and its lists and segments
• CRM and marketing automation
• Web analytics, tag manager and every pixel it fires
• Advertising accounts with uploaded customer lists or retargeting audiences
• Forms, chat tools, webinar and event platforms
• Spreadsheets exported from any of the above and sitting in shared drives
• Agencies and freelancers who hold copies

This inventory becomes the record of processing activities that Article 30 requires, so keep it.

For every row in the inventory, write down the basis you rely on. A few rules of thumb that most guidance, including the UK Information Commissioner's Office draft guidance published this year, supports:

Legitimate interests is attractive because it needs no checkbox, but it requires a documented balancing test, works only where the person would reasonably expect the processing, and never overrides a direct-marketing objection.

Audit every form, checkbox and signup flow against the new standard:

1. Unbundle. A separate, unticked box for marketing. Not part of "I accept the terms."
2. Be specific. Say what they are signing up for and from whom. "Marketing from us and our partners" fails; name the partners or drop them.
3. Record it. Store who consented, when, how, and what wording they saw. Most email platforms are adding fields for this; if yours is not, raise it with them.
4. Make withdrawal easy. One-click unsubscribe in every email and a preference center that works.
5. Review the existing list. Segment EU contacts by consent evidence. Those with clean records stay. Those without get a re-consent campaign in the first quarter of 2018, run while you can still legally email them, and then are suppressed if they do not respond.

Expect a re-consent campaign to retain perhaps 10 to 30 percent of the contacts it is sent to; those who respond are the ones who were ever going to buy.

Website tracking is where many businesses are least prepared.

• Inventory every tag. Export the container from your tag manager and list each pixel, who receives the data and why.
• Decide what needs consent. Analytics configured without advertising features and with IP anonymization is, in most interpretations, low risk under GDPR itself, though ePrivacy may change that. Retargeting pixels and ad-network cookies, which profile people across sites, need consent.
• Implement a real cookie consent mechanism for EU visitors that blocks those tags until consent is given, rather than the passive "by continuing you agree" banner that will no longer be adequate. Several consent-management tools now integrate with the major tag managers.
• Check your ad platforms' terms. Google, Facebook and the major ad networks have begun publishing GDPR terms and tools; read what they require of you as the advertiser, particularly for uploaded customer lists.
• Review data transfers. If US vendors hold EU data, confirm they are Privacy Shield certified or have signed standard contractual clauses, and update your processor contracts.

Rewrite the privacy notice in plain language: what you collect, why, on what basis, how long you keep it, who you share it with and how to exercise rights. Then build the process for requests. A subject access request must be answered within one month, free of charge in most cases, with a copy of all the personal data you hold on that person. Decide now who receives such requests, how they verify identity, and how they search each system in the inventory. Do the same for erasure. Most marketing teams can handle these with a documented procedure and a shared inbox.

Decide whether you need a Data Protection Officer: mandatory where core activities involve large-scale monitoring or sensitive data, and sensible for everyone else to at least name a responsible person.

Run a mock subject access request and a mock breach. Train everyone who touches customer data, especially sales and support staff who export lists. Write down retention rules and start deleting what you no longer need. Keep the inventory current, because compliance is a state, not a launch.

• Waiting for certainty. Final guidance on consent from the Article 29 Working Party is still in draft. Build to the plain text of the regulation and adjust.
• Treating it as a legal problem only. Lawyers can tell you the rules; marketing has to change the forms, the tags and the workflows.
• Scrubbing the entire list in panic. Segment by evidence instead.
• Forgetting the agencies. Your partners hold your data and must be under contract.
• Buying a cookie banner and calling it done. It is one line in a long list.

We begin with discovery: the data inventory across marketing, web and sales systems, the tag audit and a review of existing consent records. We then plan the lawful basis for each activity, the re-consent and form changes, and the technical work on tracking and integrations, in a sequence that fits the May deadline. Build covers forms, preference centers, consent management on the site, CRM and automation changes, and the request-handling process. Then we improve, re-auditing as guidance finalizes and as new tools enter the stack. It is work that joins growth, web and technology, with brand in the room because how you ask for consent says a great deal about the company asking.

A representative engagement is the transformation work we did for a company serving customers on both sides of the Atlantic whose marketing data had accumulated across an email platform, a CRM, several ad accounts and years of exported spreadsheets. We mapped every store of personal data, assigned a lawful basis to each use, replaced bundled signup checkboxes with specific consent and recorded it in the CRM, implemented consent-gated tags for EU visitors and ran a re-consent campaign to the segment that lacked evidence. The list got smaller and the engagement rate on what remained rose, while the team gained a documented process for access and erasure requests that had previously been handled ad hoc.