- The law
- GDPR articles 12, 15 to 17 and 21
- Who enforces it
- The data protection authority of the German federal state where you're established, or for senders outside Germany, the authority responsible for you (the Datenschutzkonferenz brings them together)
- Penalties
- Up to €20 million or 4% of annual worldwide turnover, whichever is higher
What’s changed (2026/27 edition). Germany is new to Mailfois's email rules in the 2026/27 edition.
What it means for your email
- A subscriber can ask for access to their data, to correct it, to erase it, or to object to direct marketing.
- Under GDPR article 12, you must act without undue delay and at the latest within one month of receiving the request.
- The month can be extended by two further months where needed because of the complexity and number of requests. You must tell the person within the first month, with the reasons.
- If you won't act on a request, you must say why within the month, and that they can complain to a supervisory authority or go to court.
- An objection to direct marketing must be acted on: stop emailing them.
Do
- Log each request with a reference and its deadline as soon as it arrives.
- Erase or export the person's data in your email platform and anywhere else email data is kept.
- Keep the minimum on a suppression list so they aren't added back by a later import.
- Keep your double opt-in records: an access request often asks how and when someone signed up.
Don't
- Don't wait for the full month if you can act sooner.
- Don't send further marketing while dealing with an objection.
- Don't share the person's details with tools that don't need them.
Good to know
- The authorities say an objection to marketing can reach you in any way, including a reply to an email. Treat other requests the same way.
- The same GDPR deadlines apply across the EU, so Germany and Ireland work the same way here.
Sources
- GDPR (Regulation (EU) 2016/679), articles 12, 15 to 17 and 21 (EUR-Lex)
- Guidance of the supervisory authorities on direct marketing under the GDPR, February 2022 (Datenschutzkonferenz)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.