GDPR follows the person, not the company. If some of your customers are in the EU or the UK, it applies to you regardless of where you are based. General information here, not legal advice.
Two laws, not one
This is the part most summaries omit. GDPR governs processing personal data. ePrivacy governs electronic marketing communications, and it is stricter. For marketing messages to individuals, ePrivacy generally requires prior consent — so "legitimate interests" is not a route to marketing on WhatsApp, even where it might justify holding the data.
Choosing a lawful basis
- Contract — order confirmations, delivery updates, service notices. Necessary to perform what the customer asked for.
- Consent — all marketing. Freely given, specific, informed, unambiguous, and as easy to withdraw as to give.
- Legal obligation — where a statute requires the communication.
- Legitimate interests — useful for fraud prevention and security; not a workaround for marketing consent.
The "soft opt-in" exists in some jurisdictions for existing customers marketing similar products, but its scope is narrow and it varies by member state. Do not rely on it across a multi-country list without checking each market.
Rights, and the timeline
Access, rectification, erasure, restriction, portability, objection, and rights around automated decision-making. You have one month to respond, extendable by two more for genuinely complex requests. Free of charge.
Portability is the one businesses are least ready for: providing the data in a structured, machine-readable format. A screenshot is not compliance.
International transfers
If EU personal data reaches servers outside the EEA, you need a transfer mechanism — an adequacy decision, or Standard Contractual Clauses plus a transfer impact assessment. That includes your messaging platform, your CRM, your analytics and your hosting. Know where each one processes data before someone asks.
Records and accountability
GDPR requires you to demonstrate compliance, not merely achieve it. In practice that means a record of processing activities, documented lawful bases, retention schedules, processor agreements, and evidence of consent where consent is the basis.
What this means for a message send
- Segment by jurisdiction — EU and UK contacts have different requirements from the rest of your list.
- Marketing goes only to explicit consent, with the consent record attached.
- Transactional messages ride on contract necessity and stay strictly transactional.
- Every marketing message carries a plain opt-out.
- Suppression applies instantly and everywhere.
A note on proportion
If you have eleven customers in Ireland, you still have obligations, but the practical answer is usually to hold consent properly and keep the records tidy rather than to build a large compliance apparatus. The failure mode that actually gets businesses into difficulty is marketing without consent to people who then complain — not imperfect documentation.