Who is responsible for compliance — sender or ESP?

You are. The sender. Full stop. though with some important nuance.

As the sender, you're the data controller under GDPR. You decide what data to collect, who to email, what to send, and how long to keep records. Those decisions carry legal accountability. If a regulator investigates a complaint about your email program, they come after you. not your ESP.

Your ESP is a data processor. They execute your instructions: send to the list you provide, using the templates you create, on the schedule you set. They're responsible for maintaining their infrastructure securely and for their own subprocessor relationships. Under GDPR, you need a Data Processing Agreement (DPA) with your ESP. most major providers include this in their terms of service or offer it on request. That DPA defines the boundary of their obligations vs. yours.

Where the division of responsibility matters most:

• Consent collection: Yours. Your ESP might provide the form, but you're responsible for what consent language it shows and what records it captures.
• Suppression list maintenance: Yours. Your ESP maintains the technical mechanism, but you're responsible for making sure unsubscribes are honored and for maintaining accurate suppression records.
• Honoring data subject rights: Yours. If someone sends you a SAR or erasure request, you need to fulfill it. and cascade any deletions to your ESP and other processors.
• Security of the platform: Shared. Your ESP is responsible for platform-level security. You're responsible for access controls, credential hygiene, and not giving third parties unnecessary access to your account.

The practical implication: "we use a reputable ESP" is not a compliance defense. Your ESP provides tools. You're responsible for how you use them.

For the specific records you need to maintain as the sender, see what consent records to keep. For understanding your DPA obligations, see what a Data Processing Agreement covers.