GDPR checklist for email marketing tools.
Email marketing tools hold subscriber lists, preferences and engagement data, so consent records matter. Compare 22 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Mailchimp | Usually a processor | Usually the United States | Published by the vendor |
 Customer.io | Usually a processor | Set per account or project | Published by the vendor |
 Klaviyo | Usually a processor | Set per account or project | Published by the vendor |
 ActiveCampaign | Usually a processor | Set per account or project | Published by the vendor |
 MailerLite | Usually a processor | Usually the European Union | Published by the vendor |
 Moosend | Usually a processor | Set per account or project | Published by the vendor |
 GetResponse | Usually a processor | Set per account or project | Published by the vendor |
 AWeber | Usually a processor | Set per account or project | Published by the vendor |
 Omnisend | Usually a processor | Set per account or project | Published by the vendor |
 Kit | Usually a processor | Set per account or project | Published by the vendor |
 Beehiiv | Usually a processor | Set per account or project | Published by the vendor |
 Buttondown | Usually a processor | Set per account or project | Published by the vendor |
 EmailOctopus | Usually a processor | Set per account or project | Published by the vendor |
 Ontraport | Usually a processor | Set per account or project | Published by the vendor |
 Keap | Usually a processor | Set per account or project | Published by the vendor |
 Flodesk | Usually a processor | Set per account or project | Published by the vendor |
 Sender | Usually a processor | Often the European Union, check your account | Obtained through the vendor |
 Benchmark Email | Usually a processor | Set per account or project | Published by the vendor |
 Pardot | Usually a processor | Set per account or project | Obtained through the vendor |
 Eloqua | Usually a processor | Set per account or project | Published by the vendor |
 Encharge | Usually a processor | Set per account or project | Obtained through the vendor |
 Mailshake | Usually a processor | Set per account or project | Obtained through the vendor |
What to check for email marketing tools
- Keep proof of consent and a working unsubscribe for every list.
- Check what engagement tracking is on, such as opens and clicks, and mention it in your policy.
- Record the region and any transfer outside the EEA.
- Make sure you can find and erase one subscriber across lists.
All email marketing tools
- MailchimpEmail marketing
- Customer.ioEmail marketing
- KlaviyoEmail marketing
- ActiveCampaignEmail marketing
- MailerLiteEmail marketing
- MoosendEmail marketing
- GetResponseEmail marketing
- AWeberEmail marketing
- OmnisendEmail marketing
- KitEmail marketing
- BeehiivEmail marketing
- ButtondownEmail marketing
- EmailOctopusEmail marketing
- OntraportEmail marketing
- KeapEmail marketing
- FlodeskEmail marketing
- SenderEmail marketing
- Benchmark EmailEmail marketing
- PardotEmail marketing
- EloquaEmail marketing
- EnchargeEmail marketing
- MailshakeEmail marketing
Questions, answered.
What should I check before using an email marketing tool under the GDPR?
Keep proof of consent and a working unsubscribe for every list. Check what engagement tracking is on, such as opens and clicks, and mention it in your policy. Record the region and any transfer outside the EEA. Make sure you can find and erase one subscriber across lists.
Do I need a data processing agreement with an email marketing provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which email marketing tools does Privacyboard cover?
Mailchimp, Customer.io, Klaviyo, ActiveCampaign, MailerLite, Moosend, GetResponse, AWeber, Omnisend, Kit, Beehiiv, Buttondown, EmailOctopus, Ontraport, Keap, Flodesk, Sender, Benchmark Email, Pardot, Eloqua, Encharge, Mailshake. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.