GDPR and email marketing in Ireland: a guide for small businesses

Updated 3 November 2026 · 4 min read

Email is one of the cheapest and most effective ways for a small business to keep in touch with customers. It is also one of the most regulated, and the Irish Data Protection Commission has prosecuted businesses for sending marketing emails without proper permission.

Two sets of rules apply to marketing emails in Ireland. The General Data Protection Regulation (GDPR) governs how you collect and handle personal data in general. The ePrivacy Regulations, formally S.I. No. 336 of 2011, set specific rules for electronic direct marketing by email, text, phone and fax. The ePrivacy rules are the ones that decide whether you can send a marketing email at all.

What counts as marketing email?

Direct marketing covers any message promoting your business, products or services: newsletters, offers, event invitations, "we have missed you" emails and announcements of new products. Purely transactional emails, such as an order confirmation, receipt or appointment reminder, are not marketing. Adding promotional content to a transactional email can turn it into one.

The general rule: consent

Under Regulation 13 of the ePrivacy Regulations, you generally need the recipient's consent before sending them marketing email. That consent must meet the GDPR standard:

• Freely given: not a condition of buying something unless it is genuinely necessary.
• Specific and informed: people should know who will contact them, how and about what.
• Unambiguous: given by a clear positive action, such as ticking an unticked box or entering an email address in a sign-up form clearly labelled as a newsletter sign-up.
• Recorded: you should be able to show when and how each person consented.

Pre-ticked boxes, silence and "by continuing you agree" wording do not count as consent.

The exception for existing customers: the soft opt-in

The ePrivacy Regulations allow you to email your own customers without separate consent in limited circumstances, often called the "soft opt-in". In the DPC's guidance, the conditions are broadly that:

1. You got the person's email address in the context of a sale of a product or service to them.
2. You are marketing your own similar products or services, not someone else's.
3. At the point you collected the address, you gave them a clear, free and simple way to opt out of marketing, and they did not.
4. You give them the chance to opt out in every message you send.
5. The DPC's guidance also indicates that the first marketing message should be sent within 12 months of the sale.

If you did not offer an opt-out when you collected the address, you cannot rely on the soft opt-in for that person. An enquiry that did not lead to a sale is also not enough.

What every marketing email must include

• Who you are. Your business name should be clear, and the email should not disguise the sender.
• A working unsubscribe. A simple, free way to opt out, such as a one-click link. Act on opt-outs promptly and keep a suppression list so people are not added back by mistake.
• A valid contact address.

Business-to-business email

Emailing business contacts is not a free-for-all. The ePrivacy rules apply to marketing emails sent to businesses as well as individuals, and the DPC has taken action over unsolicited marketing sent to a business email address. Email addresses that identify a named person at a business are personal data under the GDPR. The safest approach for a small business is to treat B2B marketing email with the same care as consumer email: get permission, explain why you are contacting someone, and always offer an opt-out.

Buying or borrowing lists

Do not buy email lists, and be very wary of "opt-in" lists offered for sale. Consent given to one organisation does not transfer to you. The same goes for using contacts from a previous employer or business, or from business cards collected at an event without making clear they will receive marketing.

Building a compliant sign-up

1. Use a clear heading: "Get our monthly newsletter" rather than a vague "Stay in touch".
2. Say what people will receive and roughly how often.
3. Link to your privacy notice, explaining who you are, what you will do with the data and how to opt out.
4. For a checkout or booking form, use an unticked box for marketing, separate from accepting your terms.
5. Record the date, time, source and wording of the sign-up. Most email platforms do this automatically.

Keeping records

If someone complains, you will need to show where their address came from and that you had a lawful basis to email them. Keep your sign-up forms, the wording at the time, your consent records and your unsubscribe list. Delete contacts you no longer have a reason to keep.

Other channels

Text message marketing follows similar rules to email. Phone marketing has its own rules, including the National Directory Database preference register for some numbers. Social media advertising raises different questions about tracking and cookies. Our social media guide covers the practical side.

When you are ready to start sending, see email marketing for small businesses in Ireland for the practical side: tools, content and deliverability.