EDM approval checklist for Australian and New Zealand teams

Why an EDM needs a proper sign-off

Most EDM mistakes aren't made by people who don't know the rules. They're made at 4.45pm on a Thursday, when the offer changed twice, legal replied in a thread nobody saw, and the person who usually checks the footer is on leave. In seven years of sending email, I've found the fix is boring: the same checklist, the same approvers, the same order, every time.

This checklist is written for teams sending into Australia and New Zealand. It covers what to check, who should check it, and how long to allow. For the legal background, read our guides to the Australian Spam Act and New Zealand's Unsolicited Electronic Messages Act.

The EDM approval checklist

Work through it in this order. There's no point proofreading copy that legal is about to change.

1. Content and copy

• Subject line and preheader are final, spelled correctly and match what's inside the email.
• Copy is proofread against the approved brief, not against the last draft someone emailed round.
• Names, dates and times are right for each market. AEST, AEDT, NZST and NZDT catch people out, especially around daylight saving changes.
• Spelling follows the market. Australian and New Zealand English, not American.
• Personalisation has a sensible fallback ("Hi there", not "Hi ,").
• Merge tags and dynamic content render in a test send for each segment.

2. Offer, pricing and T&Cs

• The offer in the email matches the offer on the site: price, discount, end date, eligible products.
• Prices are in the right currency (AUD or NZD) and say whether GST is included where that matters.
• Key conditions are near the offer, not only in the small print. If there's a minimum spend, exclusions or a limited quantity, say so.
• The T&Cs link works and goes to the version for this promotion.
• End dates and times say which time zone.
• Anyone who signs off on promotions (often legal or a commercial lead) has seen the final version.

3. Spam Act and UEMA requirements

Both countries share the same three rules: consent, identify yourself, and unsubscribe. Check each one on every send.

Consent

• The audience is people who gave consent (express, or inferred from an existing relationship where that genuinely applies). In New Zealand, the UEMA also allows deemed consent in limited cases, and DIA says the sender has to prove consent exists.
• Suppression lists (unsubscribes, complaints, bounces) are applied to this send, across every system that sends marketing.
• No bought, rented or scraped lists.

Identification

• The footer names the business that authorised the email, with contact details that stay accurate for at least 30 days. For agencies, this is usually the client.

Functional unsubscribe

• Every commercial EDM has an unsubscribe link that works, costs nothing, needs no login and stays working for at least 30 days.
• Requests are actioned within five working days, in both Australia and New Zealand.
• "Service" emails with any promotional content need these too. The ACMA penalised Lululemon $702,900 in 2026 for order and delivery emails that carried marketing but had no unsubscribe. See our round-up of recent ACMA spam fines for more.

4. Links

• Every link is clicked in a test send, including the logo, images, social icons and footer.
• UTM or tracking parameters are correct and consistent with your naming convention.
• No links to staging, drafts, expired landing pages or internal tools.
• Deep links (app links, account pages) work for logged-out users too.
• Mailto and tel links are formatted correctly.

5. Images and alt text

• Images load in a test send, and the email still makes sense with images off.
• Alt text describes what each meaningful image says or does ("20% off all swimwear until Sunday"), and decorative images have empty alt text.
• No important text only in images: offer terms, prices and dates should be live text.
• File sizes are sensible, so the email doesn't crawl on mobile data.

6. Mobile and rendering

• Checked on a phone-sized screen in at least one iOS and one Android mail app, plus Outlook if your audience is B2B.
• Buttons are big enough to tap and not crammed together.
• Dark mode doesn't make logos vanish or text unreadable.
• Nothing is cut off (Gmail clips messages over roughly 102KB).

7. Accessibility

• Colour contrast is strong enough for body text and buttons.
• Font size is readable on a phone without zooming.
• Link text makes sense out of context ("See the winter range", not "Click here").
• Reading order is logical, with real headings where possible.
• The lang attribute is set, so screen readers pronounce the copy properly.

8. Deliverability basics

• From name and address are the usual ones, on your authenticated sending domain (SPF, DKIM and DMARC in place).
• Reply-to goes to a monitored inbox.
• The audience size and segment are what you expected. A sudden jump usually means a filter is wrong.
• Sending time is set in the right time zone. A 9am Sydney send lands at 11am in Auckland for most of the year, and at noon in the week or so each spring when New Zealand has started daylight saving and Sydney hasn't.
• Plain-text version exists and reads properly.

You can run most of the mechanical checks (links, images, alt text, size, footer) in a couple of minutes with our free pre-send checker.

Who approves

Keep the approver list short and named. "Marketing" isn't an approver; a person is.

• Campaign owner: the brief is met, copy and offer are right. Usually the marketer who requested the EDM.
• Builder or email specialist: links, rendering, mobile, accessibility, deliverability and footer.
• Commercial or product lead: prices, stock and offer mechanics, if they change often.
• Legal or compliance: promotions, competitions, regulated products (finance, health, alcohol, gambling) and anything with claims. Not every EDM needs legal; decide which ones do in advance.
• Client (for agencies): final approval of the version that will send, recorded somewhere you can find later.

Each approver should know what they're approving. Legal shouldn't be reviewing button colours, and the builder shouldn't be deciding on T&Cs.

How long to allow

These are working days, before the scheduled send:

• Routine EDM (newsletter, known template, no legal): one to two working days from final draft to approval.
• Promotional EDM with an offer and T&Cs: two to three working days, so there's time for one round of changes.
• Regulated or high-stakes EDM (financial products, competitions, a launch): allow five working days, and book legal's time in advance.

Build in a final check on the day for anything date-sensitive, and remember public holidays differ between states, territories and New Zealand regions.

A simple workflow

1. Brief agreed: audience, offer, send date, approvers named.
2. Copy drafted and approved by the campaign owner (and legal, if needed) before the build starts.
3. Build in the ESP, then the builder runs the technical checks above.
4. Test send to the approvers, with a single link to the current version.
5. Feedback collected in one place, not across email, chat and comments on a screenshot.
6. Changes made, new version sent round. Each round should be smaller than the last.
7. Final approval recorded: who, when and which version.
8. Scheduled, with a last check of audience, time zone and suppression.
9. Archived: the approved version, the approvers and the date, so you can answer "who signed this off?" a year later.

Steps 4 to 7 are where approvals drift. A sign-off tool that gives outside approvers a private link and keeps a printable record of who approved what helps here; email approval software such as MailFois is built for exactly that.

New Zealand notes

UEMA

The UEMA works much like the Spam Act: consent (express, inferred or deemed), accurate sender details, and a free, clear unsubscribe that works for 30 days and is actioned within five working days. DIA also says the unsubscribe should use the same method as the original message, so an email needs an email-based way out.

Privacy Act: IPP3A from 1 May 2026

The Privacy Amendment Act 2025 added a new principle, IPP3A, in force from 1 May 2026. According to the Office of the Privacy Commissioner, when you collect someone's personal information from somewhere other than them, you must take reasonable steps to tell them, as soon as reasonably practicable, things like the fact and purpose of the collection, who will receive it, your name and address, and their rights to access and correct it. There are exceptions, including where they already know.

For EDM teams, the obvious cases are lists you didn't collect yourself: data shared by a partner, a co-branded competition, a referral form, or contacts passed from another part of the business. If your audience includes people like that, check who has told them, and when. (A shared list is a consent risk under the UEMA anyway.)

Frequently asked questions

Does every EDM need legal approval?

No. Decide in advance which types do: usually promotions with T&Cs, competitions, regulated products and claims. Routine newsletters on an approved template can be signed off by the campaign owner and builder.

Is the unsubscribe rule the same in Australia and New Zealand?

Close enough for a checklist: a free, working unsubscribe in every commercial message, kept working for 30 days and actioned within five working days.

Do transactional emails need to go through approval?

They should be reviewed when templates change. If a transactional email includes any marketing content, treat it as an EDM: it needs consent, identification and an unsubscribe.

What should we keep as a record of approval?

The approved version of the email, who approved it, when, and any conditions they set. Keep it with the campaign so it's easy to find if a complaint or regulator question arrives later.