> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.laposta.org/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.laposta.org/_mcp/server.

# What does the GDPR mean for your newsletter?

> Which rules apply to collecting email addresses and how Laposta protects your data.

The General Data Protection Regulation (GDPR) has been the European privacy legislation since 25 May 2018. The law applies to all organisations in the EU that process data. Public authorities, companies and associations must set up their systems and processes accordingly.

## What does the GDPR mean for your list?

You are not allowed to simply add people to a list. To be allowed to send marketing emails, you need a legitimate reason. For example, because recipients are already customers (existing customer relationship) or have subscribed to your newsletter (unambiguous consent). These are called [legal bases for processing](/grondslagen-voor-verwerking). You must be able to demonstrate the legal basis upon request, for example if a recipient files a complaint.

## Supervision by the Dutch Data Protection Authority

The Autoriteit Persoonsgegevens (AP, the Dutch Data Protection Authority) supervises compliance with the GDPR. Personal data must be appropriately protected. If data that affects the personal freedom of citizens is exposed, this constitutes a [data breach](/datalekken) and you must report it to the AP. In the event of a GDPR violation, the AP can impose [fines](/boetes).

## How does Laposta protect your data?

As a processor of personal data, Laposta has taken appropriate technical and organisational measures to protect your data. Laposta has been ISO 27001 certified since 2019. This means that information security is continuously monitored and improved. In addition, independent external auditors and technical specialists supervise compliance with and the effectiveness of the measures.

You can read more about the division of roles in data processing under the [roles of controller and processor](/rollen-verwerkingsverantwoordelijke-en-verwerker).

## Related articles

#### [How can you comply with the GDPR with Laposta?](/hoe-zorg-ik-ervoor-dat-ik-voldoe-aan-de-avg)

Read which seven points you must meet for the GDPR when sending newsletters with Laposta.

#### [What agreements are included in a data processing agreement?](/wat-is-een-verwerkersovereenkomst)

What agreements you make about processing personal data and how Laposta handles your data.

#### [Where can you find Laposta's privacy statement?](/privacystatement)

How Laposta processes and secures personal data, and where you can report a security…

#### [What rules must a sender address meet?](/wat-is-een-afzendadres)

Which email address you choose as a sender, why you need to confirm it and how it…