GOVERNANCE
A well-managed audience gives every campaign a better starting point. Clear permissions, useful records and respect for individual choices help you build lasting connections and work responsibly with the services that deliver your messages.
Every database used for sending must comply with the laws that apply to its collection and use, the rules governing the message and the selected provider’s conditions. These layers work together. This guide explains the practical questions to consider before your next campaign.
A useful database carries context, not just addresses. Record the collection source, date, privacy information provided and intended use. For consent-based audiences, retain evidence of the action taken, the wording shown, the organisation named and the channel covered. Review third-party sources before importing them. Public availability and email validation are not permission to send.
Check both the lawful basis for processing personal data and the rules for the marketing message itself. Obtain consent wherever required. Where a local rule allows an existing-customer exception or another route, document why its conditions are met. A legitimate-interests assessment cannot replace consent where electronic marketing law requires it. Business addresses are not a universal exemption.
Make the invitation clear and the choice voluntary. Explain whose messages the person will receive and what they can expect. Where consent is required, avoid pre-ticked boxes, silence or acceptance hidden inside general terms. Review whether permission still covers the sender, topic and channel. Confirmed opt-in can strengthen evidence and reduce mistaken signups, but does not make an otherwise unlawful list compliant.
Include a visible, straightforward unsubscribe in every marketing email and act on requests promptly, within the applicable legal and provider deadlines. Keep only the suppression information needed to prevent unwanted future sends, with appropriate safeguards. Apply those choices across relevant lists and providers. Do not reactivate a contact simply because the address appears in a fresh import.
Use an accurate sender identity, honest subject lines and the contact and postal details required for the campaign. Explain how personal data is used through accessible privacy information. Keep promotional messages distinct from essential service messages. Review tracking pixels, link tracking and profiling separately, including any additional notice or consent requirements.
Collect only what the campaign needs, limit access and set a justified retention period. Document the responsibilities of your business, Best Send and any delivery or other service providers in the relevant agreements. Assess where data is stored or accessed and the safeguards required for international transfers. Children’s data and sensitive information need a separate assessment before use.
Legal permission and provider acceptance are separate requirements. Review the selected provider’s acceptable-use policy before importing, validating or sending a list. A provider may require express permission and reject purchased, rented or scraped lists even where a local marketing rule permits a different approach. Maintain domain authentication, manage bounces and complaints, and investigate problems before increasing volume. A different sending route is not a way around a restriction.
Maintain a practical record of audience sources, permission, notices, objections, campaign decisions and provider requirements. Review changes in purpose, geography or service providers before the next send. You remain responsible for your audience and campaign decisions; Best Send and other providers retain their own applicable legal and contractual responsibilities. Using a platform does not transfer every responsibility to one party.
The relevant rules depend on where your business operates, where recipients are located, the type of recipient and how data is collected and used. The examples below are starting points, not a complete country-by-country clearance. Review every market you plan to reach.
Read the GDPR together with national rules implementing the ePrivacy Directive. A lawful basis for personal-data processing is only part of the assessment: consent, existing-customer exceptions and B2B rules depend on the applicable marketing rules. Respect objections to direct marketing and assess transfers outside the EEA.
CNIL: email marketing guidanceConsider the UK GDPR and PECR together. Individual subscribers, including sole traders and some partnerships, generally require consent or a qualifying exception for unsolicited marketing. Corporate subscribers are treated differently under PECR, but transparency, opt-out and applicable data-protection duties remain.
ICO: electronic mail marketingCAN-SPAM sets requirements for commercial email, including B2B messages: truthful identification and subject lines, required advertising disclosure, a valid postal address and a working opt-out. It does not impose a general prior-consent requirement. State privacy laws, including California’s CCPA as amended by CPRA where applicable, add separate data-use and consumer-rights duties. Provider rules may be stricter.
FTC: CAN-SPAM guideAssess the Personal Information Protection Law (PIPL), applicable email rules and international-transfer requirements. China’s Internet Email Service Measures require explicit permission for commercial advertising emails within their scope, advertising identification in the subject and respect for a recipient’s refusal. Audience sourcing and any cross-border processing need particular care.
MIIT: Internet Email Service MeasuresCASL generally requires consent, sender identification and an unsubscribe mechanism for commercial electronic messages, subject to defined exceptions. Express and implied consent have different conditions; implied consent may be time-limited. Keep evidence of the route used rather than assuming a business contact can always be emailed.
CRTC: CASL guidanceThe Spam Act framework requires consent, sender identification and an accessible unsubscribe for covered commercial messages. Consent may be express or inferred in qualifying circumstances. Address-harvesting restrictions also matter, and an email asking for marketing consent can itself be a marketing message.
ACMA: avoiding spamAssess the LGPD basis for processing, transparency, necessity and individual rights. If relying on legitimate interests, document the purpose, necessity, balancing exercise and safeguards. Do not treat legitimate interests as automatic permission for every audience or campaign; check the channel rules and provider conditions too.
ANPD: legitimate-interest guidanceReview the PDPA where it applies to the personal data involved and the Spam Control Act for covered unsolicited bulk commercial electronic messages. Sender information, prescribed message labelling and unsubscribe requirements need attention. Do not confuse telephone Do Not Call requirements with the rules for email.
IMDA: unsolicited communicationsIdentify the relevant data-protection regime and sector rules before processing or sending. The federal framework and the separate DIFC and ADGM regimes should not be treated as interchangeable. Check consent or another available legal ground, privacy information, individual rights and cross-border handling, together with applicable marketing and provider requirements.
UAE Government: data protectionConfirm the audience source and right to contact. Check the sender, message and destination market. Test the unsubscribe and apply existing suppressions. Review privacy information, tracking and international transfers. Confirm that the chosen provider accepts both the audience and the campaign. Keep the evidence behind those decisions.
Certification and sector-specific requirements are a separate assessment. ISO standards, SOC reports, HIPAA/BAA arrangements and PCI DSS requirements do not establish permission to send marketing, and should only be claimed where their scope and evidence are verified.
Tell us about your audience, the markets you want to reach and your intended sending setup. Clear information at the start helps identify the questions to resolve before a campaign goes live.
This page does not certify a database or guarantee legal compliance, provider approval or inbox delivery. Country-specific exceptions and requirements need assessment for the actual campaign. The applicable agreements and privacy notices set out the service-specific arrangements.