First, the good news for those in email marketing who are based only in the United Kingdom, are processing personal data and are unlikely to affect individuals in any other EU or EEA state: the answer is the ICO. However, UK-based controllers or processers who carry out cross-border processing of personal data, across member state borders, but still within the EEA, it gets a bit more involved.

It’s impossible to give specific answers to all possible scenarios in just 350 words, and if you are in any doubt whatsoever, you should read the guidance from the EDPB, found here: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en

The PDF document runs to 28 pages and while the intent of the publishers seems to be to avoid legalese as far as possible, it’s not that far and many might feel that it is best to seek legal advice if it is available within budget. For those who would rather stick pins in their toes then read legal documents, the guidance is clarified in simpler language on the ICO website here: https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-and-the-eu-in-detail/the-uk-gdpr/eu-regulatory-oversight/ Take my word for it, it’s easier to understand.

Following its normal format, the ICO’s version gives four examples or scenarios, which, in their way, explain the four basic divisions of the regulatory process. It explains matters for most of us. They refer to a fashion retailer, but are relevant to email marketing. The thing that might concern you is that above the main heading we read the caveat that the ICO is in the process of updating the guidance.

Although it’s is almost certainly best to familiarise yourself with all scenarios, the classifications are laid out clearly at the beginning of each one. There is one specific condition that will stand out for those with data in email marketing lists. You should be clear, and be able to support your view, whether or not your processing is likely to substantially affect individuals in one or more other EU or EEA state

The ICO has in the past always been available to those with specific questions. The hope is they still are, despite the current uncertainty with the full import of the Adequacy decision.