If you run an email list from the UK, two near-identical data protection regimes apply to the same database. UK GDPR governs your processing in the UK. EU GDPR governs anything you do with people in the EU. They were the same text until January 2021, they have drifted since, and the drift matters most in three places: who supervises you, who you need to appoint, and what a transfer of data outside the UK requires.

This is a working guide for a small newsletter, not a compliance manual. It covers what changes between the two regimes and what you actually have to do differently on a list of a few thousand subscribers.

The short version

  • UK GDPR plus the Data Protection Act 2018 applies to your processing in the UK. The regulator is the ICO.
  • EU GDPR applies if you offer goods or services to people in the EU, or monitor their behaviour — for example by tracking opens and clicks on a newsletter sent to EU subscribers.
  • Both require a lawful basis, a privacy notice, a processor agreement with your email platform, and a way for people to unsubscribe and to ask what you hold.
  • The practical differences are the EU representative, the transfer mechanism, the fine ceilings and the age of consent for children.

Side by side

UK GDPREU GDPR
RegulatorICOThe supervisory authority of the member state where you are established, or where your representative sits
One-stop shopNot applicable — one authorityYes, via a lead authority if you are established in the EU
RepresentativeNot requiredAn EU representative is required under Article 27 for most non-EU controllers targeting EU data subjects
Maximum fine£17.5m or 4% of global turnover, whichever is higher€20m or 4% of global turnover, whichever is higher
Transfers outUK adequacy regulations, the International Data Transfer Agreement, or the AddendumAdequacy decision, or Standard Contractual Clauses with a transfer impact assessment
Child consent1313–16, set by each member state
Marketing emailsGoverned by PECR as well as UK GDPRGoverned by the ePrivacy Directive as implemented nationally
Registration feeAnnual data protection fee to the ICO, most small businesses at the lowest tierNo equivalent registration fee in most states

The fine ceilings get the headlines and are not the risk for a newsletter of 4,000 subscribers. The realistic risks are a complaint to the ICO, a platform suspension after a spike in spam reports, and the reputational cost of an email that people did not remember signing up for.

Lawful basis for a newsletter

You need one lawful basis for processing, and for marketing email to individuals you generally need consent as well, because the electronic marketing rules sit on top of the data protection rules. Consent has to be freely given, specific, informed and unambiguous — a demonstrated action, not an inference.

Two bases cover most small lists:

  • Consent. The subscriber ticked a box, or submitted a form, knowing what they would receive. Keep evidence: the source, the wording they saw, the date and time, and the IP address if your form captures it.
  • Soft opt-in. Available for your own existing customers, for similar products, at the point of sale, with an unsubscribe in every message. It does not extend to a list you bought, and it does not cover a newsletter that is unrelated to what they bought.

Double opt-in is not a legal requirement. It is the cheapest way to prove consent, and it protects your sender reputation. For a list built from a lead magnet, use it.

What belongs in the privacy notice

One page, plain English, linked from every sign-up form. It needs to say:

  1. who the controller is, and how to contact them;
  2. what you collect — email address, name, and any tracking data such as opens and clicks;
  3. why, and the lawful basis for each purpose;
  4. who processes it — your email platform, analytics, any CRM;
  5. whether data leaves the UK or the EEA, and on what mechanism;
  6. how long you keep it, and what happens when someone unsubscribes;
  7. the person's rights, and how to exercise them;
  8. how to complain to the ICO, and to an EU authority if relevant.

Point five is the one small senders usually skip, and it is the one that differs between the regimes. If your platform stores data in the US, you need a transfer mechanism for UK data (the UK Addendum or IDTA) and a separate one for EU data (SCCs). Most established platforms publish both in their data processing addendum — read it, sign it, and keep the version you signed.

Opening tracking, and why it changes your obligations

Open pixels and link tracking are monitoring. Sending them to EU subscribers is one of the clearest ways a UK business finds itself inside EU GDPR's territorial scope, which in turn raises the Article 27 representative question.

You have three honest options:

  • Turn tracking off for EU subscribers. Simplest, and it keeps the analysis honest — open rates are unreliable anyway since Apple's Mail Privacy Protection.
  • Keep tracking, disclose it, and appoint an EU representative. A representative is a person or company established in the EU who can be contacted by regulators and data subjects. There are services that provide this for a few hundred pounds a year.
  • Segment by jurisdiction and send a plain-text version to the EU. More work, but it keeps the main list measurable.

If the EU share of your list is under a few percent and you do not target EU customers, the proportionate answer is usually the first option.

Unsubscribes, suppression and the one email you must still send

Unsubscribes must be honoured promptly — treat 24 hours as the working standard, even where the platform only syncs hourly. If someone asks you to stop, you may keep the minimum needed to make sure you never email them again, and that suppression record needs a lawful basis too: legal obligation or legitimate interests, documented.

Transactional email is separate. A receipt, a password reset or a delivery notice is not marketing and does not need consent. Mixing the two — a receipt with a newsletter pitch attached — is where most complaints start.

When a subscriber asks what you hold

A subject access request must be answered within one month, extendable by two for complex cases. For a newsletter, the answer is usually a short export: email, name, sign-up date and source, engagement history. Keep the process written down even if you have never used it, because the first request is always unexpected.

A breach that risks people's rights must be reported to the ICO within 72 hours of becoming aware of it. A mailing list exposed through a misconfigured export is exactly that kind of breach.

The mistakes that actually get made

  • Buying or scraping a list. There is no lawful basis that makes this work, and it will damage your sending domain.
  • Pre-ticked consent boxes, or consent bundled into terms and conditions.
  • A privacy notice that names no processors and no retention period.
  • Keeping unsubscribed addresses in the live list because deleting them felt untidy.
  • Switching email platforms without a new processor agreement.
  • Assuming the ICO fee does not apply. Most small businesses owe the lowest tier, and non-payment is a separate offence from any data breach.

Checklist for a compliant small newsletter

  • Consent captured with the wording, date and source recorded.
  • Double opt-in for lead magnets and downloads.
  • Privacy notice linked from every form, naming processors, transfers and retention.
  • Processor agreement signed with the email platform and the CRM.
  • Transfer mechanism identified for UK and for EU data, and a copy kept.
  • Tracking disclosed, or disabled for EU subscribers.
  • One-click unsubscribe in every campaign, honoured within a day.
  • Suppression list kept separately from the marketing list.
  • Deletion schedule agreed — for example, drop non-openers after 24 months.
  • ICO data protection fee paid.
  • Written process for access requests and for a breach.

The structural rule is simpler than the checklist: one list, one consent record per person, one page explaining what happens to the data. Most small senders fail not because they chose the wrong lawful basis but because nobody wrote down which one they chose. If that sounds familiar, data privacy basics for small business covers the wider policy, and email newsletter structure covers the part subscribers actually read.