Does GDPR apply to announcement/technical emails?
<p>I work on a SaaS website offering both free, and paid subscriptions to B2C customers.
On it, I collect statistics, and emails(subscribed and double-opt-in users only)</p>

<p>As far as newsletters and marketing emails go, I understand those require re-approval to be allowed.</p>

<p>My question, is for the types of emails below. Under what circumstances can I send them without specific approval? (Besides on the terms and conditions):</p>

<ol>
<li>Service outage and maintenance announcements(Can I send to my entire emails list?)</li>
<li>Terms and Privacy Policy updates</li>
<li>New Feature Announcements(something new the site can do) that are relevant to the current user(or for most users, does the specificity matter?)</li>
<li>Notifications about account status changes(like an existing paid feature being made free for the user)</li>
<li>Security notices</li>
<li>Personal contact with users(for example for surveying them)</li>
</ol>

<p>Thank you in advance</p>

<p>It depends. I know that's a cop-out, but it really does.</p>

<p>First, let me challenge you on marketing emails requiring re-approval: that's not the case. Data processed for the purposes of direct marketing needs a way for the user to be able to object to it, in which case you must stop, but that's not the same as required to opt-in again.</p>

<p>On to your question. IANAL(and you should consult one within your company) but a lot of your question to me seems to fall on what are the lawful basis you are using to process the data, what your privacy notice is, etc.</p>

<p>For example, if you are relying on "contract", and it is implied your customers are paying you to provide and notify them of security notices, then asking consent for this would be silly (but there are other rights you would have to be aware of)</p>

<p>In practice, as long as you are honestly and clearly telling users what you are doing with their data when you collect it (or soon after), giving them access when appropriate and holding it securely, you probably won't go far wrong.</p>

<p>Remember what the UK ico says:</p>

<blockquote>
  <p>The GDPR sets a high standard for consent. But you often won’t need
  consent. If consent is difficult, look for a different lawful basis.
  Consent means offering individuals real choice and control. Genuine
  consent should put individuals in charge, build trust and engagement,
  and enhance your reputation.</p>
</blockquote>

<p><a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/" rel="nofollow noreferrer">https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/</a></p>

<p><strong>Edit: Additional Information on Consent</strong></p>

<p>As mentioned, you may not need to get consent. This is all about the 'Lawful basis' you use for processing the data. Consent is only one of several available options, and should often be avoided where possible. </p>

<p>The UK ICO even has a couple of blog post about this:
<a href="https://iconewsblog.org.uk/2017/08/16/consent-is-not-the-silver-bullet-for-gdpr-compliance/" rel="nofollow noreferrer">https://iconewsblog.org.uk/2017/08/16/consent-is-not-the-silver-bullet-for-gdpr-compliance/</a></p>

<p><a href="https://iconewsblog.org.uk/2018/05/09/raising-the-bar-consent-under-the-gdpr/" rel="nofollow noreferrer">https://iconewsblog.org.uk/2018/05/09/raising-the-bar-consent-under-the-gdpr/</a></p>

<p>Quoting from the second link:</p>

<blockquote>
  <p>Myth #9 We have to get fresh consent from all our customers to comply
  with the GDPR.</p>
  
  <p>You do not need to automatically refresh all existing consents in
  preparation for the new law. But the GDPR sets the bar high for
  consent, so it’s important to check your processes and records to be
  sure existing consents meet the GDPR standard. If they do there is no
  need to obtain fresh consent.</p>
  
  <p>Where you have an existing relationship with customers who have
  purchased goods or services from you it may not be necessary to obtain
  fresh consent.</p>
</blockquote>

<p>And remember, if you use consent, that means you need to give the people option to withdraw it: Can you still operate an effective service for your customers if you cannot send service outage and maintenance announcement emails?</p>

<p>I cannot advise you on the your buisness without knowing a lot more about your processing, but it sounds to me like you might be relying on the 'Contract' basis more:</p>

<p><a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/" rel="nofollow noreferrer">https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/</a></p>

<p>But be aware that you may need different basis for different things, for example, you may need to rely on consent for things like profiling done under your surveys.</p>

privacy gdpr email