# GDPR for messaging — what enterprise senders need to know

> The General Data Protection Regulation (EU 2016/679) governs every collection and use of personal data of individuals in the EU/EEA, including MSISDNs used for messaging. For business messaging, GDPR matters most in five places: lawful basis, opt-out / right to erasure, cross-border transfers, processor agreements, and data-breach notification. Penalties reach the higher of €20 million or 4% of global annual turnover.

- Canonical URL: https://www.broadnet.me/answers/gdpr-for-messaging
- Language: en
- Last reviewed: 2026-05-27
- Publisher: BroadNet (https://www.broadnet.me)

## Lawful basis for SMS marketing

Article 6 demands one of six lawful bases. For commercial messaging the practical ones are explicit consent (the safest) or legitimate interest (workable but balance-test-required and excludes most outright marketing). PECR (the UK/EU ePrivacy regime) adds a marketing-specific opt-in requirement on top of GDPR Article 6 — for marketing SMS, you need both. Transactional SMS (OTPs, order confirmations) does not require an opt-in but still requires a lawful basis (usually contract performance, Article 6(1)(b)).

## Cross-border transfers

Sending an SMS to an EU recipient via a non-EU SMSC counts as a cross-border data transfer. After Schrems II (2020) the validity of Standard Contractual Clauses depends on a transfer-impact assessment. For US-based aggregators, the EU-US Data Privacy Framework (in force since 2023) gives a legal basis for the transfer if the aggregator is certified. For MENA-based aggregators like BroadNet, EU-recipient traffic should ideally route through an EU-region SMSC; we operate one in Frankfurt for exactly this.

## Right to erasure and STOP handling

Article 17 gives the data subject the right to erasure on request. For messaging that means: STOP keyword honoured immediately, recipient's MSISDN scrubbed from active lists, opt-out preference retained (so you don't re-add them next campaign), and the message-body history either deleted or anonymised depending on the lawful basis you stored under. BroadNet exposes a per-recipient erasure API for GDPR DSAR fulfilment.

## Processor vs controller

Your CPaaS is a processor (Article 28). You are the controller. You must have a signed DPA. Subprocessor changes (e.g. the operator network you route through) must be disclosed and you must have the right to object. BroadNet maintains a public subprocessor list at /trust/subprocessors and notifies controllers 30 days before any change.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [PDPL (KSA) — what the Saudi Personal Data Protection Law means for messaging](https://www.broadnet.me/answers/pdpl-ksa-explained)
- [HIPAA for messaging — what healthcare senders need to know](https://www.broadnet.me/answers/hipaa-for-messaging)
- [Compliance](https://www.broadnet.me/compliance)
- [Trust & security](https://www.broadnet.me/trust)