The privacy notice for a newsletter list — what it has to tell subscribers
When you collect newsletter subscribers, Article 13 of the GDPR lists the information you must give them, already on the sign-up form. Your email tool is a recipient in the notice, and if it transfers the list outside the EU, the transfer must be stated separately. Here are the items article by article, straight from the English text of the Regulation.
A newsletter mailing list is processing of personal data in the same way as any customer register: every address identifies a person. That is why subscribers must be told who keeps the list, what it is used for and where it is held. This page goes through what the GDPR requires you to tell them, at what point, and how the email tool you choose changes the text. Consent, and when you need it, is covered in our guide to email marketing and GDPR.
The short answer
Subscribers must be told, at the sign-up form, at least who the controller is, the purpose and legal basis of the processing, the recipients (including the email tool), any transfer outside the EU, the storage period, the data subject’s rights, the right to withdraw consent and the right to complain to a supervisory authority. The requirement is in Article 13 of the GDPR. You also need a data processing agreement with the tool (Article 28), and the list goes into your own record of processing activities (Article 30).
When to give the information: when the address is collected
Under Article 13(1) of the GDPR, the information must be provided “at the time when personal data are obtained”. For a newsletter, that moment is the sign-up form. In practice, a short note and a link to the notice with all the items go next to the form. On withdrawing consent the Regulation is more specific still: under Article 7(3), “prior to giving consent, the data subject shall be informed thereof”, and “it shall be as easy to withdraw as to give consent”.
On form, Article 12 says the information is given “in a concise, transparent, intelligible and easily accessible form, using clear and plain language”. Finland’s Office of the Data Protection Ombudsman points the same way in its guidance: the controller must assess whether the information is understandable from the target group’s point of view. If you later use the list for a purpose other than the one you stated, Article 13(3) requires you to inform subscribers of the new purpose before that processing.
The items in a privacy notice, article by article
The left column is the requirement in the Regulation, the right one says what it means for a newsletter list. The article references are from the consolidated English text of the Regulation, read on 26 September 2026.
| Item | Article | For a newsletter list |
|---|---|---|
| Controller and contact details | 13(1)(a) | Your company’s name and an address for data protection questions |
| Data protection officer | 13(1)(b) | Only “where applicable”, i.e. if one has been appointed |
| Purpose and legal basis | 13(1)(c) | Sending the newsletter; the basis is usually consent (6(1)(a)) |
| Legitimate interest | 13(1)(d) | Only if the processing is based on legitimate interest (6(1)(f)) |
| Recipients | 13(1)(e) | The email tool and any other services the list ends up in |
| Transfers outside the EU | 13(1)(f) | The destination country, the adequacy decision or safeguards, and where to get them |
| Storage period | 13(2)(a) | The period, or the criteria that determine it |
| Data subject’s rights | 13(2)(b) | Access, rectification, erasure, restriction, objection, portability |
| Withdrawal of consent | 13(2)(c), 7(3) | Withdrawal at any time, for example via a link in every message |
| Right to complain | 13(2)(d) | A supervisory authority (Article 77: in particular where the subscriber lives or works) |
| Whether providing the data is mandatory | 13(2)(e) | Subscribing is voluntary; say what happens without the address |
| Automated decision-making | 13(2)(f) | Only if you use automated decision-making under Article 22, including profiling |
← scroll →
Source: Regulation (EU) 2016/679, Article 13, EUR-Lex, read on 26 September 2026. The table is not legal advice; the right-hand column is our summary of the article’s wording.
Three items need a closer look. A recipient under Article 4(9) is a body to which personal data are disclosed, “whether a third party or not” — so the email tool belongs here, even though it only acts on your behalf. The storage period is left to you: the Regulation requires you to state the period or, if that is not possible, “the criteria used to determine that period”. The right to complain is to a supervisory authority, under Article 77(1) in particular in the member state where the subscriber habitually resides, works or where the alleged infringement took place. In Finland, for example, it is the Data Protection Ombudsman, which under section 8 of the Data Protection Act acts as the national supervisory authority. If you send to businesses on the basis of legitimate interest, Article 21(4) adds one more obligation: the right to object must be brought to the person’s attention at the latest at the first communication, “clearly and separately from any other information”.
How your email tool changes the notice
The tool affects the notice in two places: recipients and transfers. If the list stays in the EU, the transfer item is short. If the tool transfers data to a third country, Article 13(1)(f) requires you to state the transfer and “the existence or absence of an adequacy decision by the Commission”, or the safeguards and “the means by which to obtain a copy of them”.
An example: Mailchimp’s data processing addendum (section 6.1) allows data to be transferred “to and in the United States and anywhere else in the world”, so a Mailchimp user’s notice has a transfer item. The sub-processors in MailerLite’s data processing agreement are Google Cloud in Germany and the Netherlands and the Polish company Vercom. At ActiveCampaign, the EU region can be chosen for EMEA accounts created after 14 March 2024. The data location of seven tools, read from their privacy policies, is on the page email tools and EU data location, and the background to transfer bases on the page Schrems II and moving a list outside the EU.
The data processing agreement: automatic or signed separately
Under Article 28(3) of the Regulation, processing by a processor “shall be governed by a contract or other legal act”. Finland’s Office of the Data Protection Ombudsman puts it plainly: having no agreement is contrary to the GDPR. With the tools, the agreement comes about in one of two ways, read from their own terms on 25 September 2026:
- Part of the terms of service: Mailchimp (“incorporated into … the Agreement”), Brevo (an annex to the terms of use) and MailerLite.
- Signed separately: ActiveCampaign (“You must execute a DPA”) and EmailOctopus.
- Not found: we found neither a public data processing agreement nor a sub-processor list on Systeme.io’s pages.
Two parts of the agreement are worth reading, both named in the Regulation: sub-processors, where under Article 28(2) a processor with general authorisation must inform you of “any intended changes”, and deletion or return of the data when the service ends (Article 28(3)(g)).
The record of processing activities is a different document
The privacy notice given to subscribers and the Article 30 record of processing activities are easily confused. Finland’s Office of the Data Protection Ombudsman describes the latter as an internal document of the organisation, provided to the supervisory authority on request, and says it is not meant to be used directly for informing data subjects. Under Article 30(1), the record includes among other things the purposes, the categories of data subjects and personal data, the recipients, transfers to third countries and the time limits for erasure. The Finnish office offers a voluntary template for it.
Under Article 30(5), a company with fewer than 250 employees is exempt, unless the processing “is not occasional”. The Finnish office’s own example concerns employee data: even a small company processes it regularly, so the processing is not occasional. In our reading, a newsletter list that is mailed regularly is in the same category, and so it belongs in the record.
What to do now
- Go through the 12 items in the table against your own notice and add what is missing.
- Add a link to the notice on the sign-up form, and a mention of the right to withdraw, before the subscribe button.
- Check your tool’s data processing agreement: is it part of the terms, or does it have to be signed in the account settings?
- Record transfers if the tool’s agreement allows processing outside the EU, and update the item when you change tools. If you have not chosen a tool yet, the comparison of email tools also shows data location.
- Add the list to your record of processing activities, for example using a template such as the Finnish office’s.