Salons & Clinics: Avoid DPC Fines with 4 GDPR Email Soft Opt In Tests in Ireland

Yes, you can send marketing emails in Ireland, but only with valid consent or under the narrow ePrivacy “soft opt-in” for existing customers. Both GDPR and the ePrivacy Regulations (SI 336/2011) govern this, and the Data Protection Commission (DPC) enforces them together with the Data Protection Act 2018. Get the legal basis wrong and every recipient can object under Article 21 GDPR, and the DPC can treat each unsolicited message as a separate offense.

TL;DR:

Sending marketing emails in Ireland requires valid consent unless the soft opt-in conditions are precisely met within 12 months of data collection.

The soft opt-in only applies if the contact was collected during a sale, related to your own products, included a clear opt-out, and was within a year, with all conditions strictly fulfilled.

Proof of consent must include the exact wording, timestamp, URL, and IP address or user agent, and all records must be retained for verification.

Transactional emails remain exempt if they do not contain promotional content, but adding marketing material converts their legal status to requiring separate consent.

Failure to maintain up-to-date consent records, respond promptly to opt-outs, or properly segment campaigns can lead to enforcement actions, fines, or criminal liability.

What Are Ireland’s GDPR Email Marketing Rules?
When Do You Need Explicit Consent Versus the Soft Opt-In?
How Do You Collect and Prove Valid Consent?
Transactional or Marketing? How the Content Decides
Do B2B Email Rules Differ From B2C in Ireland?
How Should You Handle Opt-Outs and Complaints?
What Should Your Pre-Send and Post-Send Checklist Cover?
Why Growth Reach Marketing Treats Email Compliance as a Growth Lever, Not Paperwork
Get Your Email List Audited by People Who Do This Daily
Sources

Before you hit send on any campaign, run through this list. It covers the ground rules that decide whether your email marketing is lawful in Ireland or exposed to a complaint.

You need consent under Regulation 13 for any unsolicited marketing email to an individual, unless the soft opt-in applies.
The soft opt-in only works when four specific conditions are all met, not just some of them.
Every marketing message needs a working unsubscribe link or a valid contact address for objections.
Recipients have the right to object to marketing under Article 21 GDPR, and you must act on that immediately.
You need dated, retrievable consent records, not just a checkbox you remember ticking on somewhere.

Pro Tip: Run a quick audit of your recent campaigns against this list before you send the next one. It takes only a short time and it’s a valuable precaution.

The DPC has pursued prosecutions where senders couldn’t produce consent evidence on request, which is the single most common failure point in enforcement cases.

Regulation 13(11) creates a narrow exception, and it’s far stricter than most Irish marketers assume. The soft opt-in only applies when all four of these hold at once:

Contact was collected in a sale context. The person bought (or tried to buy) a product or service from you, not just browsed your site or entered a competition.
You’re marketing your own similar products or services. A salon that got someone’s email during a booking can promote its own treatments, not a partner’s supplement line.
They had a clear chance to opt out, both at collection and in every message since. No opt-out box at signup means no soft opt-in later.
The marketing started within 12 months of collection, or you’ve kept compliant contact going since.

Here’s where it breaks in practice. A clinic that reactivates a dormant client list from three years ago has almost certainly lost the exemption. An affiliate offer sent to your own booking list fails condition two outright, since Beauchamps’ guidance treats third-party promotions as a common trigger for invalidating the soft opt-in. Miss any single condition, and you’re back to needing full consent. There’s no partial credit here.

GDPR sets four features for valid consent: freely given, specific, informed, and unambiguous. Pre-ticked boxes, consent buried inside terms and conditions, and “by continuing you agree” language all fail this test under GDPR’s own definition.

What you actually need to log:

The exact wording shown to the person at the moment they consented
A timestamp for when they clicked
The page URL where consent was captured
IP address or user agent where feasible, as backup evidence

The DPC has flagged incomplete or deleted consent records as a recurring weakness in cases it has pursued, since the sender carries the burden of proof, not the recipient.

Design your forms with a separate, unticked checkbox for marketing consent, distinct from any checkbox for terms of service. Use a short, plain-language privacy notice link near the checkbox rather than a wall of legal text, especially on mobile where screen space is tight.

Pro Tip: Keep a simple spreadsheet or CRM tag that links each contact to their original consent event. When someone withdraws consent, suppress them immediately and log the withdrawal date. That log is your defense if a complaint ever lands.

Transactional or Marketing? How the Content Decides

The template doesn’t matter. What matters is what’s inside the email. A booking confirmation stays transactional right up until you add a promotional line, and then the whole message becomes marketing under Regulation 13, according to Beauchamps’ interpretation of Irish law.

Safe as transactional: appointment confirmations, receipts, password resets, plain feedback requests.
Risky: a receipt with “book your next visit and save 10%” tacked on the bottom.
Best practice: keep transactional emails clean, and send marketing follow-ups as separate messages with their own consent basis and unsubscribe link.

Splitting these two email types isn’t extra admin. It’s what keeps your booking confirmations legally untouchable while your promotions stay auditable on their own terms.

Do B2B Email Rules Differ From B2C in Ireland?

Corporate addresses get more flexibility, but not a blank check. A generic address like info@salon.ie is generally treated more loosely than an individual’s inbox.

Named personal addresses at a company domain, like jane.murphy@clinic.ie, are often best treated like individual addresses, particularly for targeted or profiling campaigns, per DPC guidance on direct marketing.
Keep a separate suppression list for business contacts and honor removal requests just as fast as you would for consumer ones.
Don’t assume B2B status excuses you from Article 21 objection rights. It doesn’t.

How Should You Handle Opt-Outs and Complaints?

Every marketing email needs a working unsubscribe mechanism or a valid contact address, and you need to act on opt-out requests promptly, not at the end of the month.

Add a one-click unsubscribe link to every marketing send, tested before each campaign goes out.
Log the date and time of every opt-out request, along with when you actioned it.
Treat each unsolicited message sent after a valid opt-out as a fresh, separate breach. The DPC enforcement guidance treats repeat violations as compounding offenses, not one ongoing issue.
If a complaint lands, stop the campaign, audit the list segment involved, remediate the consent gap, and notify the DPC if the breach is significant.

DPC enforcement has included formal warnings and prosecutions where senders kept marketing after an opt-out or couldn’t produce consent evidence. Repeat non-compliance can escalate toward criminal liability under the ePrivacy framework, which is a heavier consequence than most small businesses expect for what feels like a routine newsletter.

What Should Your Pre-Send and Post-Send Checklist Cover?

Build this into your workflow rather than treating it as a one-off legal review. Two short lists, run every time.

Before you send:

Confirm your legal basis (consent or soft opt-in) for every segment on the list.
Check consent records exist and match the segment you’re emailing.
Test the unsubscribe link and confirm a valid contact address appears.
Verify soft opt-in conditions individually for any segment relying on that exemption.

After you send:

Update your suppression list with any new opt-outs within hours, not days.
Record every opt-out event with a timestamp.
Store the campaign, list segment, and consent basis together as an audit trail.
Retain records for as long as you rely on that legal basis, then review on a schedule.

Element	Suggested wording
Consent checkbox	“Yes, send me offers and updates from [business name]. Unsubscribe anytime.”
Unsubscribe line	“Don’t want these emails? Unsubscribe here.”
Privacy notice link	Placed directly below the checkbox, not buried in a footer

Why Growth Reach Marketing Treats Email Compliance as a Growth Lever, Not Paperwork

Working with salons, clinics, and local-service businesses across Ireland, we’ve seen compliant email programs consistently outperform messy ones, mostly because clean lists convert better and survive longer without complaints. A list built on real consent, with proper records, doesn’t get gutted every time someone reports an unwanted message.

Growth Reach Marketing supports clients through consent-capture setup, list audits, and ongoing campaign governance so marketing doesn’t outrun the legal basis behind it. That includes checking soft opt-in segments before a send goes out, not after a complaint arrives. Our salon email marketing guidance covers how this plays out in real booking systems.

If your list has grown faster than your recordkeeping, an audit usually surfaces the gap before the DPC does.

— Gerard

Get Your Email List Audited by People Who Do This Daily

Growth Reach Marketing is the alternative to hiring a compliance consultant separately from your marketing team. We build the consent capture, list segmentation, and campaign governance directly into the lead generation systems we run for salons, clinics, and beauty brands, so compliance isn’t a bolt-on step someone forgets before a launch.

Our work covers consent-checkbox design, layered privacy notices, suppression list management, and campaign audits that catch soft opt-in gaps before they become DPC complaints. We also handle the marketing side that has to sit on top of that clean foundation: local SEO, Google Ads, and lead generation systems built for appointment-based businesses. If you run a clinic and want to see how compliant email fits into a broader lead pipeline, our beauty clinic lead generation playbook walks through the full setup. Book a list and consent audit with Growth Reach Marketing and find out exactly where your campaigns stand before your next send.