HOW their data will be used

[MasudIbne756]

If you already have explicit consent for your database, it's unlikely to be sufficient. Even if you've already contacted a person, you'll need to obtain their consent again. And have a record of it. This is the key issue: having a record of a user saying they agree to receive your marketing messages, when they gave their consent, and how.

And you have to state. Even if someone gave them their business card and said "contact me," it's not enough. Even verbal agreement won't hold up under the GDPR. Consent must be provable and recorded.

Without explicit consent from these users, the only alternative is to student data have a completely redundant user database. This is a situation no business wants, and it would be catastrophic.



There's no way around it: the legislation will come into force, regardless of Brexit. As soon as the GDPR comes into force, the UK will still be part of the EU. We already know that the UK won't leave the EU for at least two years. The British government has already confirmed that the changes will continue.