Everything worth knowing, nothing that isn't.
Lawful basis for SMS marketing
Article 6 demands one of six lawful bases. For commercial messaging the practical ones are explicit consent (the safest) or legitimate interest (workable but balance-test-required and excludes most outright marketing). PECR (the UK/EU ePrivacy regime) adds a marketing-specific opt-in requirement on top of GDPR Article 6 — for marketing SMS, you need both. Transactional SMS (OTPs, order confirmations) does not require an opt-in but still requires a lawful basis (usually contract performance, Article 6(1)(b)).
Cross-border transfers
Sending an SMS to an EU recipient via a non-EU SMSC counts as a cross-border data transfer. After Schrems II (2020) the validity of Standard Contractual Clauses depends on a transfer-impact assessment. For US-based aggregators, the EU-US Data Privacy Framework (in force since 2023) gives a legal basis for the transfer if the aggregator is certified. For MENA-based aggregators like BroadNet, EU-recipient traffic should ideally route through an EU-region SMSC; we operate one in Frankfurt for exactly this.
Right to erasure and STOP handling
Article 17 gives the data subject the right to erasure on request. For messaging that means: STOP keyword honoured immediately, recipient's MSISDN scrubbed from active lists, opt-out preference retained (so you don't re-add them next campaign), and the message-body history either deleted or anonymised depending on the lawful basis you stored under. BroadNet exposes a per-recipient erasure API for GDPR DSAR fulfilment.
Processor vs controller
Your CPaaS is a processor (Article 28). You are the controller. You must have a signed DPA. Subprocessor changes (e.g. the operator network you route through) must be disclosed and you must have the right to object. BroadNet maintains a public subprocessor list at /trust/subprocessors and notifies controllers 30 days before any change.