Privacy notice for a newsletter

A newsletter is marketing, and the rules on marketing by email are the ones the regulator enforces most often: consent or the soft opt-in before the first email, an unsubscribe that works in every message, a suppression list for the people who said no, and no sending to purchased lists without a basis. The privacy notice for a newsletter has to say what the sign-up does, which basis the business relies on for each kind of recipient, what the email platform and its tracking collect, and what happens when someone unsubscribes or objects. The pack (privacy notice, cookie notice and consent guidance) is drafted for the business for £595, fixed, in five working days.

Who this is for

Businesses in England and Wales sending newsletters, promotional emails or marketing sequences to customers, prospects or subscribers, from a one-person newsletter to a company's marketing programme.

What matters in a newsletter privacy notice

What the sign-up must do before the first email

The business, as controller, owes a duty under Article 13 of the UK GDPR to tell subscribers at the point of sign-up what it will do with their email address and any other data it collects (name, interests, location, the source of the sign-up), and the sign-up form should link to the notice, state what the subscriber will receive and how often, collect only what the newsletter needs, and obtain the consent or implement the soft opt-in in a way the business can prove later (the date, the source, the wording seen, which the email platform records); a double opt-in confirmation is not legally required but is the evidence of consent the regulator accepts most readily.

Consent, the soft opt-in and the basis for business recipients

Electronic marketing to individuals requires consent under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 unless the soft opt-in applies (details obtained in the course of a sale or negotiations for one, marketing of the business's own similar products, a clear chance to refuse at the time and in every message), and consent means a positive action (an unticked box, a separate sign-up) rather than a pre-ticked box or a condition of buying; marketing to named individuals at corporate subscribers (limited companies, public bodies) is outside regulation 22 and may rest on legitimate interests under Article 6(1)(f) of the UK GDPR with an opt-out, while sole traders and partnerships count as individuals; the notice should state which basis applies to which recipients and the forms should match.

The platform, the tracking and the data an email generates

The email platform is a processor under Article 28 of the UK GDPR (usually hosted outside the United Kingdom under the safeguards Article 46 requires), and it records opens, clicks, device and location data through tracking pixels and tracked links, which the Information Commissioner treats as similar technologies within regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requiring consent before they are used, so that the business should either obtain consent to tracking at sign-up or turn open tracking off; the notice should describe the platform, the tracking and what the business does with the engagement data (segmenting, re-sending to non-openers, scoring), and the website's own cookies need the consent mechanism the pack provides guidance on.

The unsubscribe, the suppression list and the people who said no

Every marketing email must contain a valid address and a clear means to refuse further messages, the unsubscribe must work and take effect promptly, the business must keep a suppression list of people who have unsubscribed or objected so that they are not re-added when a new list is imported (which is the commonest cause of complaints), and the notice should explain that unsubscribing removes the subscriber from marketing but that the suppression record itself is kept (as a legitimate interest, so that the business honours the request) and that service messages (order confirmations, account notices) continue; a business that deletes unsubscribers entirely and then re-imports them from the CRM has broken the rule the suppression list exists to keep.

Purchased lists, lead magnets and the other ways subscribers arrive

Sending to a purchased or rented list is lawful only where the seller obtained consent that specifically covered marketing by the buyer (or named it), which is rare, and Article 14 of the UK GDPR requires the business to tell the individuals where their data came from; lead magnets, webinars, competitions and events collect sign-ups that may fall within the soft opt-in (negotiations for a sale) or need consent, and the forms should say which; and contacts added from business cards, networking or the CRM need the basis the notice states before they are added; the notice should name the sources and the basis for each, because the regulator's fines for email marketing almost all involve lists the sender could not show a basis for.

Retention, the subscriber who objects and the regulator's enforcement

The notice should state that subscriber data is kept while the subscription continues and for a stated period after the last engagement (with inactive subscribers removed, which the platform can automate), that the suppression record is kept indefinitely, that a subscriber may object to marketing under Article 21 of the UK GDPR at any time with the objection honoured without conditions, and the rights the individual has (to access, correct, erase, restrict, port and object), the way to exercise them, the month the business has to respond, and the route to the Information Commissioner's Office, which fines senders under the Regulations without the sender needing to have caused harm; the notice can record the business's registration with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need double opt-in?

Not by law, but it is the evidence of consent the regulator accepts most readily, and the platform records it. Single opt-in with a recorded date, source and wording is lawful if the business can prove it.

Can we add our existing customers to the newsletter?

Under the soft opt-in, where their details came from a sale or negotiations for one, the newsletter promotes similar products and they could refuse at the time and in every email. Otherwise ask for consent. The notice states the basis.

Does email open tracking need consent?

The regulator treats tracking pixels as similar technologies needing consent, so either obtain it at sign-up or turn open tracking off. The notice describes the tracking the business uses and the pack's guidance covers the consent.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for an e-commerce website
• Privacy notice for an online course provider

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.