Post-Purchase Communication in Age of GDPR -- What Is and Isn't Allowed Since 25th May

The GDPR supplanted the Data Protection Act 1998 in the UK, generating significant uncertainty among British businesses. A Federation of Small Businesses survey revealed fewer than one in ten UK small enterprises were fully prepared for the new EU-wide personal data regulations.

Post-purchase communication confusion extends across the retail sector. Retailers questioned whether they could inform customers about order shipment status or delivery dates without special consent agreements. This analysis addresses common data protection concerns regarding transactional communications.

What is Personal Data?

The EU's General Data Protection Regulation governs personal data processing by both private companies and public authorities, establishing unprecedented protections. Its objective involves harmonizing data protection standards across member states while restoring individual control over personal information.

Personal data examples include:

• Name and surname
• Address
• Email address
• Location data
• Phone or mobile number
• Date of birth

From May 25, retailers collecting such information require user consent. Additionally, organizations may collect only data necessary for order processing and fulfillment -- such as name, address, and email -- nothing beyond these essentials.

Are Online Retailers Allowed Post-Purchase Communication?

Article 6(1)(B) of GDPR addresses lawful data processing:

This provision permits transaction-related messages for contract fulfillment. Communications connected to order processing -- even if not directly serving the primary service -- remain permissible. Transaction-based customer communications require no explicit consent. This constitutes customer service rather than advertising.

However, once notification content diverges from order processing, retailers must obtain explicit customer consent for additional communications. Compliant emails include notifications regarding:

• Order confirmation
• Pre-shipping status updates
• Shipping status
• Parcel tracking information
• Delivery station directions
• Return status information

Advertising in Post-Purchase Communication

Emails combining necessary order information with supplementary product details remain classified as customer service. Examples include instructional videos demonstrating product usage, recipes for food purchases, or cycling route links following bicycle purchases. This value-added content enhances product experience without constituting promotion.

Advertisements may appear in confirmations, status updates, and dispatch messages -- including offers, promotions, and coupons -- provided items represent similar products within the same category as the original purchase. A bicycle helmet advertisement following a bicycle purchase proves acceptable; however, iPhone advertisements in bicycle dispatch messages violate guidelines.

GDPR hasn't eliminated post-purchase communication possibilities. Rather, retailers must prioritize valuable, customer-relevant content. This approach strengthens customer loyalty, satisfaction, and repeat business prospects over time.