Privacy & compliance

Marketing consent and record-keeping: plain-English primer for SMEs

Updated 2026-04-11 · Practical guide for NZ small businesses

Short answer: Marketing consent should be informed, specific, and provable—with records showing what someone agreed to, when, and how.

Loose “add everyone from business cards to Mailchimp” habits create complaints and platform bans, not growth.

Practical consent capture

  • Separate tick boxes for essential service email vs promotional newsletters when appropriate.
  • Store source (event, web form, checkout) with the subscriber record.
  • Easy unsubscribe on every promo email—one click preferred.

Record-keeping without bureaucracy

Export occasional audience snapshots from your ESP, note policy versions when they change, and keep a changelog of integrations that touch personal data.

Align copy with reality

If your privacy notice says “we never share emails” but ad platforms hash-upload lists, fix the mismatch—accuracy builds defensibility.

Frequently asked questions

Is implied consent enough for cold outreach?

Often no for bulk email—platform rules and law are strict. Get professional advice for prospecting programmes.

What about SMS?

Usually higher expectation of consent and quieter hours—treat SMS as more sensitive than email.