GDPR – busting the Direct Mail myth

GDPR Direct Mail


When the new General Data Protection Regulations (GDPR) come into effect in May 2018, businesses will need to show a lawful reason for the processing of their customers’ data. There are six in total:

  1. They have the consent of the Data Subject
  2. It’s necessary for the completion of a contract
  3. It’s a legal obligation
  4. It protects the vital interests of the Data Subject
  5. The task is carried out in the public interest, and
  6. It’s in the legitimate interest of the data controller.

Remember, only one of these needs to be true in order for a business lawfully to process their customer’s data, and for marketing communications this will tend to be either option 1 (Consent) or option 6 (Legitimate Interest).


When securing the consent of their customers, businesses need to make sure they are offering genuine choice and control, and that it’s as easy and for people to withdraw that consent any time they wish. So this means no pre-ticked boxes, or other methods which assume consent by default. That customers have consented to be communicated with needs to be evidenced, kept, and refreshed as appropriate.

It’s all about trust and belief, and research shows that customers are more likely to give permissions if they feel in control and believe the organisation is going to 1) Keep their data safe, 2) Not share it with others and 3) Not bombard them with unwanted or unnecessary communications.

You need to assess whether your existing consent is up to scratch? If it was not given as an affirmative action, or you haven’t got proper records of how you secured it, or if it was gained a very long time ago, the answer to this question is probably “no.” In these instances, businesses should re-permission that consent, or find an alternative lawful basis if possible. This is where legitimate interest may come into play and particularly for Direct Mail which remains an opt-out media channel under GDPR.

Legitimate Interest

This has been the case since the regulations was published and the Information Commissioner’s Office has stated overtly that you won’t need consent for postal marketing, However, it by no means a “get out of jail free” card. Some businesses (particularly charities) have elected to make postal marketing opt in, but they do not need to. That is merely a choice being made on how you want to deal with customers rather than a legislative requirement.


As the diagram on the right for inserts and unaddressed mail/household drops, which can be targeted at customers using demographics, location-specific titles, these are essentially broadcast media and as such do not identify an individual and do not use personally identifiable information (PII) and so GDPR doesn’t apply. However, businesses who process a customer’s data in order to send them direct mail relying on legitimate interest must have a compelling purpose for doing so. The communications must be necessary, targeted, and proportional to that purpose, and companies must balance the interests of the business against those of the consumer. They must undertake a legitimate interest assessment or balancing test, for which we’ve created an 8-point approach based on the available guidance


Direct Mail ‘leading the charge’

Direct mail is less easy to ignore than a crowded email inbox. The new JicMail research shows that box people receive 1.3 pieces of mail a day with 65% open rates and 17% leads to a commercial action.  The physicality lends credibility to communications, builds trust, and shows that the customer is valued. As such, it is being used as a lead media for re-permissioning. Indeed, for some companies, where their email database isn’t fully compliant, it may be their only option and, as the availability of email data shrinks the general use of direct mail [and indeed unaddressed mail] for acquisition will grow accordingly. Additionally, people are generally less likely to opt out of mail than digital channels (even though DM will need to be more up front about offering it) so it will become a growing part of on-going CRM communications.

Lots of marketers consider print to be old fashioned, but we at Paragon know that it works, even against younger people who are do not receive as much direct mail, so for them it has stand out against the myriad of digital communications they receive. It’s tangible and disruptive, increasing stand out and retention of the message, it’s explanatory, a ‘sit back’ media allowing businesses to convey complex information in a simple way. It’s also targeted against specific groups of people geographically and demographically and allows for high degrees of personalisation and individualisation. It is an inclusive channel that works well against the digitally disadvantaged/disinterested, and action focussed, generating high quality leads and changes in behaviour.

Once the GDPR comes into effect, digital marketing will become harder. As such, companies who plan and implement a communications strategy which incorporates the real benefits of print channels will be in a stronger position than those who don’t.

To find out how we can help you and your organisation gain compliance and send effective communications to your customers, please fill in the contact form below and our experts will be in touch.

Marc Michaels, Direct of Strategy and Insight.

To read more on our legitimate interest blog click here


For more information  on Paragon's GDPR solution fill in the form below and we'll be in contact within 1 business day