How does consent work for employees or internal emails?

Employee consent in email marketing is trickier than it looks. When an employer asks an employee to sign up for company communications, can that employee really say no? Under GDPR, regulators have consistently said that employee consent is suspect precisely because of the employment relationship. You can't freely consent when saying no might have career consequences.

This means companies marketing to their own employees typically can't rely on consent as the legal basis. Instead, GDPR analysis usually points to legitimate interest: the company has a genuine business reason to communicate with employees, and that interest can be balanced against employee privacy rights. The documentation requirements are real, though. You need to record what the legitimate interest is and why it outweighs the employee's right to object.

Operational emails (payroll, HR notices, safety updates) are straightforward. They're necessary to the employment relationship and don't raise much concern. It's the marketing-flavored internal communications where it gets complicated: company newsletter subscriptions, voluntary opt-ins to non-essential updates, internal promotional campaigns. These require more careful handling.

Practically speaking, always give employees a genuine way to opt out of non-essential internal communications without fear of consequence. Document that the opt-out works and that it's respected. If you're not sure what legitimate interest means in practice, it's worth understanding the definition before drafting your documentation. Under GDPR's data subject rights, employees have the right to object to processing, including marketing-style emails even from their employer.

If you're building an internal email program and you're not sure which legal basis applies, the answer depends heavily on your jurisdiction and what you're actually sending. Get in touch if you'd like a straight opinion on your specific setup.