The rule.
“the data subject has given consent to the processing of his or her personal data for one or more specific purposes”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- Processing is lawful only if at least one Article 6(1) basis applies; point (a) is consent for one or more specific purposes.
- The purpose named at collection is the purpose the consent covers. A new purpose — a partner list, a new channel, profiling — needs its own basis.
Who it applies to.
Controllers processing personal data for marketing on the basis of consent.
Common violations in marketing copy.
Webinar sign-ups added to the general newsletter
Consent for the webinar is not consent for a different marketing purpose.
Leads passed to 'selected partners' without a separate opt-in
Each specific purpose needs its own lawful basis.
Non-compliant vs compliant.
“Register for the webinar (you'll also join our mailing list and partner offers).”
“Register for the webinar. ☐ Also send me the monthly newsletter.”
Related rules.
-
GDPR Article 6(1)(f) · European Union
-
GDPR Article 4(11) · European Union
-
GDPR Article 7(1) · European Union
-
GDPR Article 8(1) · European Union
-
GDPR Article 13(1)–(2) · European Union
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Regulation (EU) 2016/679 (General Data Protection Regulation) |
|---|---|
| Provision | GDPR Article 6(1)(a) |
| Primary source | https://www.legislation.gov.uk/eur/2016/679/article/6/adopted |
| Official text | https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng |
| Read from | legislation.gov.uk's as-adopted copy of the Official Journal text (/eur/2016/679/article/N/adopted) |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.