Can we send a newsletter to existing clients?

The exception applies when you obtained the contact during a sale, you are offering your own similar products or services, and every email lets the recipient opt out easily. Already at the point of collecting the contact, the person must be informed that they will receive such messages.

The exception does not apply to contacts obtained from an event list, public sources or a partner's database. In those cases, consent is required. For the rules on electronic marketing, see Article 81(1) and (2) of the Law on Electronic Communications.

Consent must be freely given, specific, informed, and expressed through a clear affirmative action. A pre-ticked box is not valid. Consent written into a contract as one of its terms is also not valid, because it is not freely given.

You must be able to prove consent: when, how, and for what the person gave it. In practice this means a record in your system with the date, the form used, and the text shown at the time. Without this record, consent means nothing in a dispute.

It is worth cleaning the list: long-inactive recipients increase risk and reduce results. If a contact no longer has any connection to your business, it is better to remove them than to keep them indefinitely.

Marketing is described in the record of processing activities as a separate process: the purpose, the legal basis (consent, or legitimate interest under the existing-client exception), the categories of data, the retention period, the sending platform used, and its location.

If you use a marketing platform, it is a processor and you need a contract with it. If the platform's servers are outside the European Economic Area, this must be visible in the record together with the legal basis for the transfer.

The first mistake is a purchased address list, or one obtained from a partner. Such a list almost never has valid consent, and the burden of proof falls on the sender, not the seller.

The second is a single blanket consent covering all future activities. Consent must be specific, so a new channel or substantially different content often requires fresh consent.

The third is an opt-out button that leads to a login screen or only works after several steps. Opting out must be as easy as subscribing, and must take effect immediately.