GDPR

What it means

The GDPR governs processing of personal data, which includes a named or individual email address, work addresses included. Every mailing needs a lawful basis: usually consent (freely given, specific, informed and unambiguous, and as easy to withdraw as to give) or legitimate interest. Recital 47 says processing for direct marketing may be regarded as carried out for a legitimate interest.

Two articles bear directly on email. Article 21 gives an absolute right to object to direct marketing; once someone objects, their data may no longer be used for it, and the right must be brought to their attention at the latest at the first communication. Article 14 requires informing people whose data you did not get from them, at the latest at the first communication.

Whether consent is needed for the email itself is set by the ePrivacy rules.