Ensure your marketing activities comply with GDPR requirements for consent, data processing, and privacy rights.
When to Use This Skill
Designing consent collection flows
Writing privacy notices
Auditing marketing data practices
Handling data subject requests
Documenting lawful basis
Methodology Foundation
Based on GDPR Articles 6, 7, 12-23 and EDPB Guidelines, covering:
Lawful basis determination
Consent requirements
Transparency obligations
Data subject rights
Documentation requirements
What Claude Does vs What You Decide
Claude Does
You Decide
Explains GDPR requirements
Business risk tolerance
Drafts compliant language
Implementation priority
Identifies gaps
Legal interpretation
Creates documentation
DPO consultation needs
Suggests controls
Resource allocation
Instructions
Step 1: Lawful Basis Assessment
Six Lawful Bases (Article 6):
Basis
Marketing Use
Documentation Needed
Consent
Email marketing, cookies, tracking
Consent records
Contract
Customer communications
Contract terms
Legitimate Interest
Soft opt-in, B2B marketing
LIA document
Legal Obligation
Regulatory comms
Legal reference
Vital Interest
Rarely applicable
-
Public Task
Rarely applicable
-
Marketing Activity Mapping:
Activity
Typical Basis
Requirements
Email newsletter
Consent
Double opt-in, easy unsubscribe
Existing customer upsell
Legitimate Interest
LIA, opt-out available
Cold B2B outreach
Legitimate Interest
LIA, clear identity
Website cookies
Consent
Banner, granular choices
Retargeting ads
Consent
Cookie consent
Lead magnets
Consent
Clear purpose, separate consent
Step 2: Consent Requirements
Valid Consent Criteria (Article 7):
Requirement
What It Means
Example
Freely given
No bundling, no penalty
Separate from T&Cs
Specific
Clear purpose stated
"Marketing emails about [X]"
Informed
Who, what, why explained
Privacy notice linked
Unambiguous
Clear affirmative action
Unchecked checkbox
Withdrawable
Easy to revoke
One-click unsubscribe
Consent Record Requirements:
Record for each consent:
- Who consented (identifier)
- When (timestamp)
- What they consented to (purpose)
- How (mechanism)
- What they were told (notice version)
[ ] I agree to receive the monthly newsletter with industry insights
[ ] I agree to receive product updates and feature announcements
[ ] I agree to receive promotional offers and discounts
[ ] I agree to receive relevant offers from our trusted partners
[Sign Up]
By signing up, you confirm you've read our [Privacy Notice].
You can withdraw consent anytime via unsubscribe link or contacting us.
---
You're receiving this because you subscribed to our [newsletter/updates].
Manage preferences: [link]
Unsubscribe from this list: [link]
Unsubscribe from all: [link]
[Company Name]
[Address]
[Contact Email]
Preference Center
Subscription
Status
Action
Monthly Newsletter
[ON/OFF]
Industry insights and tips
Product Updates
[ON/OFF]
New features and improvements
Promotional Offers
[ON/OFF]
Discounts and special deals
Partner Offers
[ON/OFF]
Relevant third-party offers
[Update Preferences] [Unsubscribe from All]
Compliance Checklist
All consents granular (separate checkboxes)
Checkboxes unchecked by default
Clear description of each purpose
Privacy notice accessible
Withdrawal mechanism clear
Consent records stored
Double opt-in implemented
Unsubscribe in every email
Preference center available
### Example 2: Legitimate Interest Assessment
**Input:**
We want to email our existing customers about related products.
Do we need consent or can we use legitimate interest?
You can likely rely on legitimate interest (not consent) for
emailing existing customers about similar products, but must
complete this assessment and offer easy opt-out.
Three-Part LIA Test
1. Purpose Test: Is There a Legitimate Interest?
Interest: Promote related products to existing customers
Legitimacy: Yes - recognized business interest in customer development
Benefit: Revenue growth, customer relationship deepening
✅ PASS
2. Necessity Test: Is Processing Necessary?
Question
Answer
Is email necessary to achieve the interest?
Yes - direct communication channel
Is there a less intrusive way?
In-app notifications possible but less effective
Is the processing proportionate?
Yes - limited frequency, relevant content
✅ PASS (with conditions)
Conditions:
Limit to genuinely related products
Reasonable frequency (not daily)
Honor opt-outs immediately
3. Balancing Test: Individual Rights vs. Your Interest
Include in privacy notice:
"We may contact existing customers about similar products
based on legitimate interest. You can opt out at any time."
Easy opt-out: Every email must have unsubscribe
Honor preferences: Immediate suppression on opt-out
Similar products only: Don't expand to unrelated offerings
Reasonable frequency: No more than weekly
Template Email Footer
You're receiving this as a valued [Company] customer.
Not interested in product updates?
[Opt out of marketing] | [Manage preferences]
This email was sent based on our legitimate interest in keeping
customers informed about relevant products. See our Privacy Notice
for details and your rights.
When This Doesn't Apply
Use consent instead if:
Products are significantly different
Customer bought once 2+ years ago
You acquired data from third party
Customer previously opted out
Emails are primarily promotional (not informational)
## Skill Boundaries
### What This Skill Does Well
- Explaining GDPR requirements
- Drafting compliant language
- Creating documentation templates
- Identifying compliance gaps
### What This Skill Cannot Do
- Provide legal advice
- Know your specific jurisdiction nuances
- Guarantee regulatory acceptance
- Replace DPO consultation
### When to Escalate to Human
- Complex cross-border transfers
- Regulatory investigation
- Data breach response
- Novel processing activities
## Iteration Guide
**Follow-up Prompts:**
- "Draft the privacy notice section for [activity]"
- "How do we handle a right to erasure request?"
- "What documentation do we need for [processing]?"
- "Is this cookie banner compliant?"
## References
- GDPR Text (Regulation 2016/679)
- EDPB Guidelines on Consent
- ICO Direct Marketing Guidance
- CNIL Cookie Guidelines
## Related Skills
- `terms-analyzer` - Terms of service review
- `contract-review` - DPA analysis
- `nda-generator` - Confidentiality
## Skill Metadata
- **Domain**: Legal / Marketing
- **Complexity**: Intermediate
- **Mode**: centaur
- **Time to Value**: 1-2 hours per assessment
- **Prerequisites**: Basic GDPR familiarity
