Control outbound permissions across regions

Start with commercial email and the sending entities your team already operates. Keep phone calls, text messages, and social messages outside this rollout until counsel supplies channel-specific rules. Create one policy row per combination of sending entity, applicable jurisdiction, recipient class, channel, and message purpose. Have counsel determine applicability using the actual operation, not the seller's territory label. Record sender establishment and recipient location separately. A US parent account with a contact working in Germany is an unresolved case until the relevant policy is identified.

Require an evidence source for each classification. Store the observed location, observation date, and any conflict with another source. Treat company headquarters, language, and domain suffix as investigation clues rather than conclusive recipient location. Hold unknown countries and recipient types. Exclude Canada and other unapproved regions from this implementation rather than borrowing a US or UK policy. Regional managers may resolve missing business facts, but they cannot invent a legal exception to remove a hold.

Create separate processing_basis and channel_rule fields. GDPR Article 6 identifies bases for lawful processing, including consent and legitimate interests subject to its conditions. A legitimate-interests label is not a consent receipt and does not resolve national electronic marketing requirements. Store counsel's assessment reference, intended purpose, approved data categories, and applicable restrictions. Do not let an enrichment vendor's confidence score populate either permission field. Public availability is an acquisition fact, not your internal approval decision.[3][4][5]

Give objections their own overriding state. GDPR Article 21 provides a right to object to direct marketing, including associated profiling, and requires processing for that purpose to stop after objection. It also requires the right to be brought clearly and separately to the person's attention by the first communication. The processing-basis assessment cannot override that objection. Design the operational gate so an existing approval never defeats a later suppression event.[3]

For the US commercial email row, include accurate transmission information, nondeceptive subject headings, a functioning opt-out mechanism, and the required identification and postal address. CAN-SPAM section 7704 requires the mechanism to receive requests for at least 30 days after transmission and prohibits covered sending more than 10 business days after an opt-out. Its advertisement-identification requirement has a prior-affirmative-consent exception. Ask counsel to approve message classification and applicable rules. Set a faster internal suppression deadline rather than treating the statutory outer limit as a queue target.[1]

For UK electronic mail, distinguish corporate subscribers from sole traders and relevant partnerships. ICO guidance says corporate subscribers do not need consent under that PECR sending rule, but sender identity and a valid opt-out address remain required. Personal-data processing still engages UK GDPR. Individual subscribers need specific consent or a qualifying soft opt-in. Preserve evidence for each soft-opt-in condition rather than storing a single customer=true flag. The ICO page is under review after legislative changes, so counsel must confirm the current policy before release.[2]

Do not create one EU B2B row. The ePrivacy Directive's Article 13 addresses unsolicited communications and leaves protection of legal-person subscribers to national legislation. Germany's UWG section 7 requires prior express consent for electronic advertising unless its existing-customer conditions all apply. Those conditions concern the acquisition during a sale, the sender's own similar offerings, no objection, and notice at collection and each use. Encode a Germany-specific row. Add other member states only after reviewing their national implementation with counsel.[4][5]

Use recipient_id, crm_contact_id, address_key, sending_entity_id, recipient_country, country_evidence_ref, recipient_class, class_evidence_ref, acquisition_source, acquired_at, processing_basis, basis_assessment_ref, channel_rule, consent_evidence_ref, notice_version, notice_due_at, notice_delivered_at, notice_delivery_ref, notice_exception_ref, suppression_version, policy_version, decision, reason_code, reviewer_id, reviewed_at, and expires_at. Keep raw evidence restricted and expose references to sellers. Use blocked, needs_review, and approved_for_reviewed_draft as decision values. Unknown classification is not an empty string that downstream code treats as eligible.

A hypothetical record uses recipient_id=person_184, recipient_country=GB, recipient_class=unknown, channel_rule=uk-email-individual, decision=blocked, and reason_code=recipient-class-unproven. Never fill consent_evidence_ref with a vendor's terms-of-service URL. Require the actual evidence covered by your policy. Tie an approved decision to draft_id, audience_version, and sending account. A changed address, purpose, recipient class, or policy version invalidates the prior decision and returns the contact to review.

Map who determines purposes and means and who processes on another party's behalf. GDPR Article 4 defines controller and processor by those roles, not by a procurement label. Article 28 requires a binding arrangement with specified processor obligations when that relationship applies. Have privacy counsel classify the CRM, acquisition provider, workflow service, and sender for each relevant processing activity. Do not assume every vendor is a processor or that an agreement transfers your decision responsibility.[3]

Create a vendor-role register with activity, data categories, role decision, contract reference, deletion owner, objection path, subprocessor review reference, and transfer review reference. GDPR Chapter V applies to relevant third-country transfers, including onward transfers. Route uncertain transfer arrangements to privacy review before loading recipient data. Acceptance requires a named owner and documented review for every destination. A vendor badge or API connection alone cannot pass this gate.[3]

Run a classification-only pass before drafting messages. RevOps resolves CRM identifiers and gathers source references. Route conflicting geography to the regional operations owner, uncertain subscriber type to a trained classifier, and ambiguous legal applicability to counsel. Define who can change each evidence field. Keep a record of the old value and the new evidence. Acceptance requires every proposed recipient to reach either a matching policy row or an explicit hold with an owner.

Show the AE a card with region, recipient class, acquisition source, permission status, and the reason for any hold. For the hypothetical UK record, show 'Blocked. Subscriber type unproven. Regional operations review required.' The AE can submit evidence but cannot clear the hold. Do not replace a blocked email with an unreviewed phone call or social message. Those are separate channel decisions, not workarounds for an email restriction.

For indirectly obtained personal data, GDPR Article 14 specifies the controller, purpose, legal basis, source, and retention information. Subject to its exceptions, provide the information within a reasonable period and at latest one month after acquisition, earlier by the first communication when using the data to communicate, or by first disclosure to another recipient. The privacy owner maintains notice_due_at and delivery evidence in a queue independent of marketing approval. Counsel approves applicability, any exception, and a lawful notice delivery route. Holding a contact unsent for more than a month must produce timely notice evidence or an approved exception, not merely a blocked campaign. Notice delivery never substitutes for required marketing permission.[3][2][5]

Give the reviewer the exact message, sending entity, audience version, permission reasons, notice version, and opt-out path. Approval covers that package only. Acceptance requires the sender's final preview to match the reviewed draft and the recorded account. Reject misleading reply-style subjects, concealed sender identity, missing required details, and inaccessible opt-out mechanisms. These checks implement the relevant US and UK rules, while counsel decides which requirements apply to each row.[1][2]

Create one suppression event with event_id, recipient_id, address_key, scope, received_at, source, reason, and version. Record which CRM views, sender queues, manual-mailbox workflows, and import jobs consume the event. Each consumer returns an acknowledgement with its applied version and timestamp. Block release when a required consumer has not caught up. Recheck suppression immediately before execution, even when the draft received approval earlier. A scheduled message is still pending work, not a protected exception.

Keep the minimum suppression evidence your privacy policy approves rather than erasing the only record that prevents reimport. Have counsel approve retention and lawful handling. Acceptance requires a staged opt-out to cancel queued messages and survive a later list import. Expose the resulting blocked state to the AE. The US rule covers covered sending on behalf of the sender after opt-out, and GDPR Article 21 stops direct-marketing processing after objection. A sender-local unsubscribe alone does not prove your whole operation applied the event.[1][3]

Package each release with decision_id, policy version, evidence references, exact draft, approval receipt, sending account, suppression check version, execution timestamp, and destination receipt. Limit the package to authorized operations and privacy reviewers. Let an AE open a plain-language decision explanation without downloading the underlying contact dataset. Set retention rules for evidence and exceptions with counsel. Do not retain complete enrichment payloads just because a connector returns them.

Acceptance requires a reviewer to reconstruct why one message was permitted and why another was blocked using the stored records. Include an expired approval and an opt-out received between approval and scheduled release. The first stays held until review. The second stays suppressed even if an AE retries the original action. Keep a correction record rather than rewriting the old decision as though the earlier evidence had never existed.

Use named cases in the rollout evidence pack. The 'UK sole trader with a company-looking address' case must not inherit the corporate-subscriber row. The 'Germany work email without consent evidence' case remains blocked unless counsel confirms a supported exception. The 'US opted-out contact reimported under a new CRM ID' case must retain suppression through address matching. The 'London territory, unknown recipient location' case stays unresolved. These are deliberate test inputs, not claims about any real contact.[2][5][1]

Include 'seller changes draft after approval' and 'suppression destination unavailable'. The former invalidates approval. The latter pauses release until the destination acknowledges the required version or administrators isolate that sender. Never turn an unavailable check into an eligible recipient. Keep the rejected action and reason visible so a seller does not interpret a quiet queue as successful sending.

Calculate evidence coverage as proposed recipients with all required evidence divided by all proposed recipients, expressed as a percentage. Calculate suppression acknowledgement coverage as required destination acknowledgements received divided by required acknowledgements due. Measure propagation delay as final required acknowledgement time minus event receipt time, in minutes. Report unresolved events alongside delay so a fast subset cannot hide missing destinations. Calculate post-suppression release rate as releases after an applicable suppression event divided by all releases. Investigate every occurrence rather than using an average as clearance.

Roll out one approved sending entity and policy row first. Counsel signs the policy, RevOps signs classification coverage, and sender administrators sign propagation proof. The regional sales leader confirms that sellers can see and resolve holds. Pause the affected sender immediately if suppression fails, approvals are bypassed, or evidence no longer supports the row. Preserve suppression during rollback. Revert the workflow to manual review, not unrestricted sending. Name the administrator who can pause release and the counsel owner who can authorize a corrected policy. Public sources were reviewed on 2026-10-14. No live sending system was tested for this playbook.