GDPR compliance for music mailing lists Checklist

Double opt-in—where subscribers confirm consent via email after initial signup—provides stronger legal protection and reduces complaints. It's particularly important for VIP fan lists, presale groups, and venue-specific databases where you're building long-term engagement relationships.

Consent collected at a live gig (via signup sheet or QR code) is different from consent from a website signup form or social media promotion. Record the source for each subscriber, as context matters if disputes arise about how consent was obtained.

If fans signed up to a festival, venue, or playlist curated brand rather than the artist directly, you don't automatically have consent to email them as the artist. Clarify data ownership before claiming a list as yours.

GDPR requires data to be kept only as long as necessary. If someone hasn't engaged with email for 12-18 months, they should be either re-engaged or deleted. Set an automated purge schedule to prevent storing abandoned data indefinitely.

Record what data fields you've collected for each subscriber (name, email, location, purchase history, etc.). GDPR requires you to know and justify what personal data you're processing. This inventory becomes crucial if a subject access request arrives.

If you believe subscriber data has been compromised, you have 72 hours to report it to the ICO (Information Commissioner's Office). Prepare a documented process now so you're not scrambling if it happens. Include internal notification and subscriber communication steps.

If your email platform allows subscribers to manage preferences (e.g., 'receive tour dates only'), respect those settings. Don't send the 'tour dates only' subscriber merchandise promotions. Preference centres reduce unsubscribes and improve overall engagement.

If an email permanently bounces (hard bounce), remove it within a few days. If someone marks your email as spam, remove them from future sends. Continuing to email dead addresses or spam-flagged subscribers harms your sender reputation and IP.

Keep a separate, permanent suppression list of anyone who's ever unsubscribed, hard-bounced, or complained. Check against it before every send to ensure you're not accidentally re-adding removed addresses.

If you start collecting postal addresses for physical merchandise, add a new consent form and update your policy. If you change email platforms or add a third-party analytics tool, update the policy. Don't let privacy documentation drift from reality.

Under GDPR, consent is the most common lawful basis for marketing emails. Document why you believe you have consent for each subscriber segment. If someone has a previous relationship with the artist (e.g., bought a ticket), you might use 'legitimate interest'—but be explicit about it.

If you use email platform features that profile subscriber behaviour (open rates, click patterns, engagement scoring), tell subscribers how this data is used. If you plan to use generative AI for personalised email content, this needs explicit disclosure.

This isn't strictly GDPR, but it's required under PECR. Unsolicited marketing emails to personal numbers have quiet hours. Most email platforms let you schedule sends to respect timezone and time-of-day rules, so use them.

Subject lines like 'Re: Your ticket purchase' or 'Urgent: Action required' can mislead subscribers if the email is actually promotional. Subject lines should accurately reflect content. This reduces complaints and unsubscribes.

If subscribers mark emails as spam, your email platform reports this. Track your complaint rate (aim for under 0.1%). High complaint rates damage your domain reputation and can get you blacklisted. If complaints spike, review content and frequency.

Music PR campaigns are campaign-focused, but sending multiple promotional emails per week trains subscribers to unsubscribe. Mix promotional emails with content-focused ones (behind-the-scenes, story posts, etc.). Most artist lists thrive at 1-2 promotional sends per week maximum.

While GDPR is the baseline for Europe, Canada (CASL), Australia (SPAM Act), and the US (CAN-SPAM) all have different email marketing rules. If the artist has significant international fan bases, review those rules separately—they can be stricter than GDPR.

Some markets require opt-in (like Canada); others require opt-out (like the US). Your email platform should let you manage different regions with different rules. Never assume one unsubscribe setting works everywhere.

If a subscriber is in both the UK and EU, or moved between territories, document consent separately for each jurisdiction they're associated with. This prevents compliance gaps if regulations diverge in future.