Legal guidelines for the use of customer data by marketing agencies

Sharing customer data with a marketing agency is permitted, but only under strict GDPR conditions: you need a valid legal basis (usually consent for marketing), a clear privacy statement, and a data processing agreement with the agency. In this context, you, as the client, are the controller and the marketing agency is the processor. Below, you can read how to arrange this correctly and thus avoid both fines and loss of customer trust.

Customer data is usually personal data

Most customer and prospect data is personal data protected by the General Data Protection Regulation (GDPR) . Broadly speaking, there are three types:

• Direct personal data: data that refer directly to an individual, such as name and address.
• Indirect personal data: data that leads to someone indirectly, such as an IP address.
• Special personal data: sensitive data, such as health or religious beliefs, for which stricter rules apply.

As soon as you exchange this type of data with a marketing agency, that is processing to which the GDPR applies.

You need a valid legal basis

You may not simply share personal data; a valid legal basis is required for this. The GDPR recognizes six, including consent, a legal obligation, a legitimate interest, and the performance of a contract. For exchanging data for marketing purposes, this is usually the consent of the customer or prospect. That consent must:

• are given freely and informed;
• be specific and unambiguous;
• can be withdrawn at any time.

Even stricter requirements apply to special categories of personal data. If you base marketing on a legitimate interest, you must carefully weigh this against the privacy of the data subject.

A privacy statement is indispensable

You must inform data subjects via a privacy statement . This includes, among other things :

• who the controller is;
• which data is processed and for what purpose;
• who receives the data (such as the marketing agency);
• how long and where the data is stored;
• which rights data subjects have (access, correction, deletion).

The Dutch Data Protection Authority (AP) requires that this be done in clear language and be easily accessible.

Controller and processor: document it

It is important to distinguish between the controller (who determines the purpose and means) and the processor (who processes the data on behalf of the controller). In this situation, your company is the controller and the marketing agency is the processor.

You must record the agreements between you and the agency in a data processing agreement. In this agreement, you regulate, among other things, what the agency may and may not do with the data, security, confidentiality, the use of sub-processors, and what happens to the data after the collaboration has ended.

Frequently asked questions about customer data and marketing agencies

Is a data processing agreement mandatory?

Yes. If you engage a party to process personal data on your behalf, the GDPR mandates a data processing agreement. If this is missing, you are breaking the law — even if nothing else goes wrong with the data.

Am I allowed to contact existing customers without permission?

For email marketing to existing customers, an exception applies under certain conditions: you may approach them about similar own products, provided they can easily unsubscribe. However, consent is generally required for sharing with an external agency and for new prospects. Also, take the cookie and tracking rules.

Who is liable in the event of a data breach at the marketing agency?

As the data controller, you remain ultimately responsible towards the data subjects and the Dutch Data Protection Authority (AP). The data processing agreement sets out the agency's obligations and how it reports a breach, so that you can recover damages from the agency if necessary. Good agreements are therefore also in your own interest.

Help with sharing customer data

The legal experts at MKB Juristen draft the required documents — from privacy statements to data processing agreements — and advise on the correct legal basis and consent. This allows you to share customer data with your marketing agency without unnecessary risk. View our expertise in privacy and data protection or schedule a no-obligation intake.