Ahead of the 25 May have you considered/actioned the following points to make sure your marketing activities will comply with the new General Data Protection Regulations:

• Confirmed your data processing and storage processes and updated your privacy notices accordingly?
• Checked that no-one on your current email, mailing, text or phone lists have asked not to be sent marketing communications, even if they are clients?
• Before embarking on any telemarketing activities checked the recipient has not registered their phone number on either the Telephone Preference Service (TPS) or the Corporate Telephone Preference Service (CTPS), or the Mail Preference Service (MPS) if you intend to send them a marketing mailing?
• Made it easy for people to unsubscribe / opt-out of receiving future marketing communications from you?
• Made the wording used alongside ‘opt-in’ boxes as clear as possible so the recipient knows what they are subscribing to and how their data will be used? You should avoid using pre-ticked opt-in boxes.
• Asked any third party suppliers who may have access to your data for marketing purposes to confirm their processes are GDPR compliant and you are confident they are handling your data legally.
• Updated your letters of engagement to say if and how their data will be used for marketing purposes, but also giving them the option to opt-out of such marketing communications alongside this statement, should they wish to do so.
• Put in place systems for obtaining and documenting consent from new clients, prospects and business contacts to receive future marketing communications from you?
• When gathering information for marketing purposes state what the data will be used for, e.g. to send a white paper the recipient has asked for, to subscribe to a newswire, to be contacted by your business development team etc.

Whilst the GDPR comes into force on 25 May, the regulations surrounding electronic marketing (defined as marketing calls, emails, texts, faxes and cookies) are still being confirmed, so the above may be subject to some changes. The current Privacy and Electronic Communications Regulations (PECR) are set to be replaced and by the ePrivacy Regulations (ePR) later this year/early 2019. Until such time as the ePR has been agreed, businesses should follow both GDPR and PECR when implementing marketing activities.

Further details about GDPR and PECR and their role in marketing can be found in the Information Commissioner’s Office – Guide to Direct Marketing, which was last updated on 6 March 2018.