gdpr-compliance

Use separate unchecked checkboxes for each purpose such as newsletters, product updates, and promotions, with a linked privacy notice and double opt-in. Store consent records capturing who consented, when, to what purpose, the mechanism, and the notice version shown.

Legitimate interest can apply when emailing existing customers about similar products, provided you document a three-part Legitimate Interest Assessment covering purpose, necessity, and balancing tests. Every email must include an easy opt-out, and frequency should remain reasonable.

A privacy notice must state the controller identity, processing purposes, lawful basis, recipients, retention periods, data subject rights, withdrawal mechanism, and complaint right. Third-party data additionally requires disclosing the data source.

Most GDPR rights requests including access, rectification, erasure, restriction, and portability must be answered within one month. Objections to direct marketing under Article 21 must be honored immediately.

This Skill explains requirements and drafts documentation but does not provide legal advice or guarantee regulatory acceptance. Complex cross-border transfers, breach response, and regulatory investigations should be escalated to a DPO or legal counsel.