{"id":2419,"date":"2019-04-24T07:59:54","date_gmt":"2019-04-24T12:59:54","guid":{"rendered":"http:\/\/blog.kmbrian.com\/?p=2419"},"modified":"2020-12-04T00:39:48","modified_gmt":"2020-12-04T06:39:48","slug":"gdpr-compliant-cold-email","status":"publish","type":"post","link":"http:\/\/kmbrian.com\/blog\/gdpr-compliant-cold-email\/","title":{"rendered":"The Practical Guide to Staying GDPR Compliant With Your Cold Emails"},"content":{"rendered":"
Contrary to what you might have read, GDPR<\/a> didn\u2019t kill cold emails. You can still send them. You just have to be more careful about the way you collect, manage and store the data you use to send them.<\/p>\n The good news is, if you\u2019re already following cold email best practices<\/a> \u2013 that is, you aren\u2019t \u201cspraying and praying\u201d or spamming people with irrelevant messages \u2013 you\u2019re half way there already.<\/p>\n You don\u2019t need a data process administrator to do this (quite frankly, most companies don\u2019t have the money to do this anyways). Instead, check out this practical, step-by-step guide to staying GDPR compliant as an individual or a small sales team<\/a>.<\/p>\n As a note, this guide only focuses on sending cold emails. There are plenty of other requirements you\u2019ll need to get comfortable with when it comes to sending marketing emails to those who opt-in to hearing from you or using cookies on your website. For a more thorough breakdown of what GDPR is and how it affects your business, check out this article<\/a>.<\/p>\n And of course, we\u2019re not lawyers. If you have any specific concerns about your GDPR status or its requirements, consult with a lawyer who\u2019s familiar with the regulation.<\/p>\n In case you somehow missed it, the EU adopted the General Data Protection Regulation (GDPR) in 2016, replacing the 1995 Data Protection Directive (which was put in place during the internet\u2019s earliest days).<\/p>\n EU member states were given two years \u2013 until May 2018 \u2013 to become compliant with the new regulation, which, according to Digital Guardian\u2019s Juliana De Groot<\/a>, \u201cmandates a baseline set of standards for companies that handle EU citizens\u2019 data to better safeguard the processing and movement of citizens\u2019 personal data.\u201d<\/p>\n Basically, to comply with the GDPR, companies need to be more conscious of the way they handle and use personal data, which includes, among other things:<\/p>\n Even encrypted data can fall under this category. Close.com\u2019s Jory MacKay writes<\/a>, \u201cBasically, if the information you have can be used to identify a person in any way, it\u2019s covered under GDPR.\u201d Failing to protect information appropriately according to the regulation can lead to fines<\/a>.<\/p>\n So, if you\u2019re following along as someone who sends cold email, that probably sounds pretty intimidating. Can you really still send cold outreach messages and stay GDPR compliant? Yes, but it may look different than what you\u2019ve done in the past.<\/p>\n According to Dan Vanrenen<\/a>, Managing Director of Taskeater, \u201cUnder the GDPR, the personal data you collect should be adequate and relevant to the purpose of its processing (Principle c: Data Minimisation<\/a>). That means you have to consider two key things: the adequacy of your data collection (how much data do you really need for what you are going to achieve) and the relevancy of your data collection (is the data you are collecting the right data for your purposes).\u201d<\/p>\n Breaking that down, any offer you send via cold email should be clearly connected to the specifics of your prospects\u2019 business.<\/p>\n To get to this level of specificity, you\u2019re going to need to segment your lists and closely personalize your cold emails based on your prospects\u2019 business needs. Email personalization tools like Mailshake<\/a> can help.<\/p>\n As a side note \u2013 Mac Hasley writes at Convert<\/a> that, \u201cThe generic info@company, sales@company, marketing@company email addresses, aren\u2019t personal data.\u201d Since GDPR applies to individuals, generic email addresses such as these may not be affected.<\/p>\n They aren\u2019t ideal from a marketing standpoint, but may be an option if you aren\u2019t able to meet the specificity of purpose guidelines described above.<\/p>\n Since the GDPR\u2019s big push is to ensure that businesses handle personal data appropriately, it\u2019s important that you only collect the data you actually need for your campaign \u2013 and that you explain why you\u2019re emailing and how recipients can remove their data from your list.<\/p>\n For example, use a message like this:<\/p>\n \u201cI\u2019m reaching out because I found your name and email address on LinkedIn, and it looks like your company might benefit from our [product\/service]. If you\u2019d rather not hear from me, just let me know and I\u2019ll delete your information.\u201d<\/em><\/p>\n As you can see, you don\u2019t have to use a cold unsubscribe link. In fact, you need more than that to cover all your GDPR bases. Two things to keep in mind:<\/p>\n Don\u2019t just mark them as unsubscribed in your email management system. Actually delete them from any place where you\u2019ve stored their information.<\/p>\n Sending a valid, justified cold email is one thing. What you do after that is just as affected by GDPR.<\/p>\n Most marketers like to throw cold email contacts into a nurture sequence after the initial engagement. Maybe they aren\u2019t a fit now, but through regular interactions, you\u2019ll be top-of-mind when they do need your product or service.<\/p>\n The challenge is that, under GDPR, you may need to ask permission to follow up in this way. SuperOffice\u2019s Steven MacDonald writes<\/a>, \u201cWhen you collect personal data such as an email address, not only do you need to inform the individual that you have stored it, but you also need to make sure that your prospects actively \u2018opt-in\u2019 or choose to join a specific email list before you start sending them marketing messages.\u201d<\/p>\n To make matters more challenging, Hasley shares that, \u201cAsking for consent to receive marketing materials, is in and of itself, sending a marketing material.\u201d<\/p>\n So, what options remain? Follow-up emails may be ok as long as they follow the same criteria as initial cold outreach messages, in that you must:<\/p>\nA Quick GDPR Refresher
<\/h2>\n
\n
GDPR Best Practices for Cold Emails<\/h2>\n
Only reach out to people who you have a strong reason to believe can benefit from your product<\/h3>\n
\n
Be able to explain exactly how you got someone\u2019s email address
<\/h3>\n
\n
Understand the limits of data consent<\/h3>\n
\n