How does GDPR affect email marketing practices in Marketing Cloud?

GDPR (General Data Protection Regulation) applies to email marketing to EU/EEA residents. Key impacts:
Lawful basis: You need a valid lawful basis to send marketing email. For most marketing, this is consent (freely given, specific, informed, unambiguous). Other bases (legitimate interest, contractual necessity) are less reliable for direct marketing.
Consent records: You must be able to demonstrate when, how, and what the subscriber consented to. Store consent timestamps and source in a DE. Marketing Cloud's preference centre can capture and store this.
Right to erasure (Right to be Forgotten): When a subscriber requests deletion, you must remove their personal data from Marketing Cloud — subscriber record, all DEs containing their data, and ensure they are suppressed from future sends. Marketing Cloud's contact deletion API (POST /contacts/v1/contacts/actions/delete) handles this.
Data minimisation: Only collect and store data necessary for the declared purpose.