[ MarTech Insights ]

GDPR-Compliant Marketing Automation: The Checklist for Mid-Market Companies

April 10, 2026|7 min read|Stephan Götze

Marketing automation processes personal data: email addresses, click behavior, lead scores, purchase history. That makes the tool choice a data protection decision, not just a technical one. The good news: the requirements are clear. The bad news: they are shockingly often checked only after purchase.

Requirement 1: Data Processing Agreement (DPA)

As soon as an external service provider processes personal data on your behalf, a DPA under GDPR Art. 28 is mandatory. For marketing software this means: before the first email address is transferred to the system, a valid DPA must be in place.

Pre-purchase check: does the vendor offer a standardized DPA? Can it be customized? Vendors who don't offer a DPA or only provide it after negotiation are a warning sign.

Requirement 2: Data storage in EU or equivalent third country

Personal data may only be transferred to third countries if an adequate level of protection is guaranteed. For US vendors this has been more complex since the Schrems II ruling (2020): US authorities can access data under US law even if the server is technically located in the EU.

What really helps: servers in the EU operated by an EU company without a US parent. Or at least a vendor that has correctly implemented Standard Contractual Clauses (SCCs) and can provide a Transfer Impact Assessment (TIA).

Schrems II in practice: A large portion of leading US marketing automation tools (HubSpot, Marketo, Pardot) are subject to the CLOUD Act. This means that US authorities can under certain circumstances demand access to the data regardless of server location. That is not an automatic disqualifier, but a risk that must be documented and assessed.

Requirement 3: Sub-processors transparent and compliant

Marketing automation tools themselves use third-party providers: for email delivery, analytics, cloud infrastructure. All sub-processors must be GDPR-compliant and listed in the DPA or a separate list. You have the right to know who processes your customer data, even indirectly.

Requirement 4: Data subject rights technically implementable

GDPR guarantees data subjects the right to access, rectification, erasure and data portability. The tool must technically support these rights: search and export individual contacts, delete data without integrity problems in the rest of the system. That sounds obvious, but isn't. Especially for systems not developed for the European market.

The checklist: 10 points before tool purchase

  1. DPA available and signable before go-live
  2. Server location documented (EU preferred)
  3. Sub-processor list accessible
  4. SCCs or Adequacy Decision for third-country transfer
  5. Deletion of individual contacts technically possible
  6. Data export in standard format (CSV, JSON) possible
  7. Double opt-in for email natively supported
  8. Consent management integrable or documented
  9. Vendor's data breach process documented (GDPR Art. 33)
  10. Records of processing activities entry creatable (Art. 30)

Further reading: Tool Scout with standard compliance screening and Mistakes in the RFI/RFP process.

[ Next Step ]

Ready for an independent review?

30-minute initial call. No sales pitch. I listen and tell you whether and how I can help.

Schedule a call