Compliance
Staying on the right side of the law while sending cold email at scale.
49 guides and growing
The guides
Adequacy Decision vs. Safeguard: Cross-Border Routing Choice
Adequacy Decision vs. Safeguard: Cross-Border Routing Choice — Architects need to choose a data route based on adequacy, safeguards, and recipient changes.
B2B Corporate Subscriber vs. Individual Address: PECR Routing
B2B Corporate Subscriber vs. Individual Address: PECR Routing — B2B senders need a routing rule when a corporate mailbox is mixed with personal or sole-trader.
CAN-SPAM Opt-Out SLA Monitoring and Escalation
CAN-SPAM Opt-Out SLA Monitoring and Escalation — Operators need to monitor the statutory response window and vendor failures.
CAN-SPAM Sender and Initiator Responsibility Map
CAN-SPAM Sender and Initiator Responsibility Map — Agencies and clients need to assign responsibility when multiple marketers or vendors appear in one message.
CAN-SPAM vs. GDPR for Cold Email: What Changes?
Compare CAN-SPAM and GDPR for cold email by scope, lawful basis, transparency, opt-outs, and records—without treating either as a universal rule.
CASL Express Consent Evidence Packet
CASL Express Consent Evidence Packet — Canadian senders need to prove who consented, when, how, and for what message class.
CASL Identification for Agencies and Multiple Affiliates
CASL Identification for Agencies and Multiple Affiliates — Agency sends must identify the sender and represented persons without hiding behind one brand.
CASL Implied Consent Expiry Calendar
CASL Implied Consent Expiry Calendar — Teams need to stop treating an implied relationship as permanent.
Cold Email Compliance for Agencies Sending for Clients
A responsibility matrix and intake workflow for agencies that send cold email on a client’s behalf, with evidence and suppression ownership made explicit.
Cold Email Compliance Review Before a New Country Launch
Use this jurisdiction-research gate to review direct-marketing rules, privacy duties, transparency, vendors, and evidence before expanding cold email.
Cold Email Compliance Recordkeeping: What to Log
A practical recordkeeping model for cold email: list provenance, lawful basis, notices, opt-outs, suppression, approvals, and send evidence.
Cold Email Privacy Notice Placement: A Practical Guide
A decision workflow for placing privacy information in cold outreach, with context, source, accessibility, and jurisdiction review prompts.
Cold Email Unsubscribe Requirements: A Practical Checklist
A jurisdiction-aware checklist for cold-email opt-outs: clear instructions, working links, suppression, timing, and provider requirements.
Cold Outreach Data Provenance Checklist
A source-register checklist for tracking how prospect data was collected, refreshed, approved, noticed, and suppressed before import.
Cold Outreach Data Retention and Deletion Schedule
A purpose-based worksheet for deciding what prospecting data to retain, review, restrict, or delete without inventing a universal retention period.
Consent Capture UX QA: No Prechecked Boxes, Clear Purpose
Consent Capture UX QA: No Prechecked Boxes, Clear Purpose — Growth and CRM teams need to test whether forms capture affirmative, specific permission.
Consent Withdrawal vs. Marketing Suppression: Keep Both Signals
Consent Withdrawal vs. Marketing Suppression: Keep Both Signals — CRM and compliance teams can erase a consent event accidentally or fail to preserve proof of.
Correcting Inaccurate Prospect Data Before Sending
A privacy QA workflow for correcting prospect data without confusing email verification with identity or marketing permission.
Using Data Brokers for Cold Outreach: Due-Diligence Workflow
A broker-data review workflow for source documentation, notice, accuracy, objections, contractual assurances, suppression, and provenance evidence.
DPIA Review After a New Vendor, Model, or Data Source
DPIA Review After a New Vendor, Model, or Data Source — Teams often treat a DPIA as one-time paperwork after processing changes.
DPIA Sign-Off and Residual High-Risk Escalation
DPIA Sign-Off and Residual High-Risk Escalation — Project owners need to know who signs, what remains, and when supervisory consultation is needed.
DPIA Triage for Prospect Enrichment and Profiling
DPIA Triage for Prospect Enrichment and Profiling — Teams need a fast screen for whether enrichment, profiling, or monitoring is high risk.
DSAR Search Scope for CRM, Sender, and Suppression Systems
DSAR Search Scope for CRM, Sender, and Suppression Systems — Privacy operations need a repeatable search scope across fragmented outreach systems.
Email Compliance Incident Response After an Accidental Send
A time-ordered, evidence-led runbook for stopping an accidental outreach send, assessing impact, correcting suppression, and escalating legal questions.
Email Enrichment Vendor Privacy Review
A vendor due-diligence checklist for enrichment tools covering data sources, roles, subprocessors, deletion, access, geography, and objections.
ePrivacy vs. GDPR: Two-Layer Marketing Permission Map
ePrivacy vs. GDPR: Two-Layer Marketing Permission Map — Practitioners confuse electronic-marketing permission rules with GDPR personal-data lawful basis.
Event or Business-Card Leads: Permission and Follow-Up Review
A source-context checklist for deciding how to follow up with event or business-card leads without treating an exchange as automatic consent.
International Transfer Review for Email and Enrichment Tools
A current-review checklist for mapping prospect data transfers, providers, subprocessors, mechanisms, safeguards, and residual risk.
International Transfer Triage for Prospect Data
International Transfer Triage for Prospect Data — Teams need to identify whether a CRM, sender, support team, or subprocessor moves data abroad.
Lawful Basis Change Control for Outreach Data
Lawful Basis Change Control for Outreach Data — Privacy, legal, and lifecycle owners need to know when a new use requires a new basis.
Legitimate Interest and Cold Email: Questions to Ask
A practical, non-legal framework for assessing legitimate interest in cold email: purpose, necessity, expectations, safeguards, and objections.
Objection Scope: Stop This Sequence or All Outreach?
A conservative decision tree for interpreting ambiguous objections and applying the right suppression scope across campaigns, channels, and future imports.
Onward Transfer Inventory for Email Service Chains
Onward Transfer Inventory for Email Service Chains — A sender may not know where its email platform or enrichment chain sends data next.
Data Processing Agreement for an Outreach Tool
A practical question list for reviewing an outreach tool’s DPA, roles, processing instructions, subprocessors, deletion, security, transfers, and audit support.
Privacy Impact Assessment for Outbound Prospecting
A risk-assessment template for higher-risk or novel prospecting involving profiling, sensitive data, large-scale enrichment, or vulnerable people.
Privacy Notice Update Trigger for New Outreach Purposes
Privacy Notice Update Trigger for New Outreach Purposes — Owners need to know when changed purpose, source, or lawful basis requires notice updates.
Privacy-Safe Export of Prospect and Suppression Data
A generic export checklist for limiting, sharing, auditing, expiring, and deleting prospect and suppression data without inventing platform security features.
Processor vs. Controller Role Map for Outreach Vendors
Processor vs. Controller Role Map for Outreach Vendors — Teams struggle to assign roles when a platform selects means, uses data, or sends on instructions.
Handling a Prospect Data Access Request
A jurisdiction-neutral runbook for locating prospect data across CRM, campaigns, vendors, and logs while preserving suppression and escalating legal questions.
Prospect Data Deletion vs. Do-Not-Contact Suppression
A decision guide for choosing between deleting prospect data and retaining a minimal do-not-contact marker to prevent re-import and re-contact.
Purpose Compatibility Review Before Reusing Prospect Data
Purpose Compatibility Review Before Reusing Prospect Data — Teams want to reuse enrichment or event data for outreach without checking compatibility.
Regional Campaign Routing When Recipient Location Is Uncertain
Regional Campaign Routing When Recipient Location Is Uncertain — Teams need a conservative route when country, residence, or mailbox domain conflicts.
Role-Based Access to Prospect Contact Data
A platform-neutral access-control checklist for prospect data, exports, contractors, offboarding, least privilege, and review evidence.
SCC and Transfer Impact Assessment Evidence Pack
SCC and Transfer Impact Assessment Evidence Pack — Privacy teams need a practical evidence bundle for transfer safeguards and destination-risk review.
Soft Opt-In Decision Tree for Existing Customers
Soft Opt-In Decision Tree for Existing Customers — Marketers struggle to separate customer relationship, compatible products, notice, and easy opt-out conditio.
Exclude Special-Category Data from Prospecting
A pre-import screening workflow to minimize, quarantine, delete, or escalate sensitive personal data before it enters ordinary outbound prospecting.
Subprocessor Register Review for Email and Enrichment Vendors
Subprocessor Register Review for Email and Enrichment Vendors — Procurement and privacy owners need a recurring review of subprocessors and changes.
Is This Email Transactional or Marketing?
Use the FTC primary-purpose framework to classify mixed email while keeping the result limited to the relevant law and message facts.
Vendor Offboarding: Revoke Outreach Data and Sending Access
Vendor Offboarding: Revoke Outreach Data and Sending Access — Teams need a closeout sequence for exports, deletion confirmation, credentials, subprocessors, an.