CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
A European e-commerce company wants to send marketing emails to customers about new products. Under GDPR, which of the following lawful bases must the company obtain from customers before sending non-essential marketing communications?
- ALegitimate interest
- BContractual necessity
- CLegal obligation
- DExplicit consent
Show answer & explanationAnswer & explanation
Correct answer: D. Explicit consent
Under GDPR, marketing communications generally require explicit, freely given, opt-in consent from the individual, as this processing is not necessary to fulfill a contract or comply with a legal obligation, and legitimate interest is not typically sufficient for direct marketing outreach without consent.
Why the other options are wrong
- A. Legitimate interest can apply in limited marketing contexts but generally requires an opt-out and is not the primary basis GDPR mandates for direct marketing consent.
- B. Contractual necessity applies to data needed to fulfill a service agreement, not optional marketing outreach.
- C. Legal obligation applies when a law requires processing, such as tax reporting, not marketing emails.
GDPR Lawful Basis - Consent
Under GDPR, consent is one of six lawful bases for processing personal data, requiring a freely given, specific, informed, and unambiguous opt-in, commonly required for marketing communications.
- Must be an affirmative opt-in, not a pre-checked box
- Individual can withdraw consent at any time
- Required for most direct marketing communications
Memory trick: CCLVPL: Consent, Contract, Legal obligation, Vital interests, Public task, Legitimate interests