25 May 2018 was a wake-up call for the marketing world.

Since that day, when GDPR (General Data Protection Regulation) was introduced, every organization has had to rethink how it collects, uses, and protects data from people in the EU. It doesn’t matter where you’re based – if you have customers in the EU, GDPR applies to you. And if you break the rules, the penalties can be eye-watering.

Marketing teams have felt the impact of GDPR more than most. Whether building a prospect database for email campaigns or creating personalized customer portals, they are often the ones responsible for capturing and managing personal data. And yet most marketers are not compliance experts. How can they be sure they’re getting GDPR right?

This guide is here to help, providing insight into why GDPR matters, what it means for your marketing activity, and how you can make compliance second nature.

If you would like GDPR explained, read on.

Why GDPR matters in marketing

Personal data is the currency of modern marketing and digital content creation. It fuels:

• Personalised, relevant customer experiences
• Smarter, data-driven campaigns
• Sharper targeting and higher ROI

But with great value comes great responsibility. Fail to follow GDPR, and you’re not just risking your company’s reputation and eroding brand trust. You also risk fines of up to €20 million or 4% of global turnover (whichever is greater).

And these fines are no idle threat. British Airways was forced to pay over €26 million for a 2018 data breach affecting more than 400,000 customers while H&M was fined €35.3 million for illegal surveillance of employees.

The international reach of GDPR

Just because GDPR is an EU regulation does not mean it only companies within the EU. If you collect data from EU citizens, then GDPR applies to you, no matter where your organization is based.

This was underlined by a 2021 EU Court of Justice ruling, which found that big tech companies with European headquarters in Dublin can be taken to court by any national data protection authority if there are cross-border data processing activities.

Marketers targeting UK citizens aren’t off the hook either. Despite quitting the EU, the country has retained GDPR regulations in domestic law – so the same rules still apply.

In short: if your campaigns interact with customers from the EU or UK then your company is impacted by GDPR.

What is personal data and when can you use it?

GDPR defines personal data as anything that can identify someone directly or indirectly. This includes everything from names, phone numbers, emails, and home addresses to IP addresses, ID numbers, and online pseudonyms.

Under GDPR, there are six lawful bases for collecting and processing personal data. These are:

• Consent (you have the individual’s consent to process the data for a specific purpose)
• Contract
• Legal obligation
• Vital interests (to protect someone’s life)
• Public task (because it’s in the public interest)
• Legitimate interests

Consent is the most common basis for marketing teams – and, crucially, consent must always be given freely and never assumed. In other words, it has to be the consumer’s choice to share their personal data with you – or not.

This means:

• No pre-ticked boxes or default opt-ins
• No confusing privacy policies
• No bundling multiple permissions into one tick box

You must also make it just as easy to withdraw consent as it is to give it, for example by including an unsubscribe button in email newsletters.

5 tips for marketers to secure GDPR compliance

1. Be transparent about data collection

You need to make it crystal clear what data you collect from people and why. Consider:

• Is your website’s privacy policy up accurate and up to date?
• Do contact or download forms contain links to your privacy policy?
• Do you make it clear you use cookies to collect personal data and give people control over what they share?

2. Establish clear opt-out systems

The right to be forgotten is a key principle of GDPR. Make sure customers can easily manage what they receive from you. Every email you send should have a visible unsubscribe link.

3. Audit databases regularly

Check marketing or website databases once a year or even once a quarter to verify you are maintaining best practice. This is an opportunity to remove outdated or unconsented data, and to identify any holes in your approach before they escalate into costly breaches.

4. Report data breaches immediately

With GDPR, honesty is the best policy. Report any data losses, theft or accidental transfers as soon as possible. Any attempt to cover up breaches will likely lead to maximum financial penalties and heavy damage to your brand reputation. 

5. Focus on employees as well as customers

Just like customers, employees have rights over the personal information. If using employee-generated images or videos in your marketing or employer branding, you must ensure you have each employee’s consent.

The easy way to ensure GDPR Compliance for global marketing teams

Papirfly’s Digital Asset Management (DAM) solution helps global marketing teams safeguard every aspect of privacy and consent by automating compliance when managing digital assets. Our DAM software includes a GDPR consent manager tool to ensure:

• Facial recognition with consent management is used to identify subjects and verify assets for use
• Images with identifiable people are only used with permission
• Content is automatically withdrawn the moment permissions expire
• People have the ability to review and revoke their content anytime

Bottom line: GDPR isn’t going anywhere. And neither is the need to earn and keep customer trust. The sooner GDPR compliance becomes second nature in your processes, the stronger your brand reputation will be.

FAQs

A Digital Asset Management (DAM) RFP does far more than shortlist vendors. It defines how effectively your teams will onboard, how consistently they will use the system, and how well your DAM becomes the content command center for your brand. Yet most organizations underestimate this step. They focus on storing files, not on the workflows, governance, and brand experience that make DAM successful.

After reviewing more than 50 enterprise RFPs, we saw a clear pattern: strong RFPs anchored around real business outcomes, content workflows, and user behavior. Weak RFPs described features, not needs — leading to mismatched solutions, rework, and slower adoption

As Christer Lorichs, DAM expert at Papirfly, puts it:

“The main success factor lies in the organization’s insight into the effort required internally — a clear purpose, the right resources, leadership support, and an obvious business case.”

This guide distills the seven questions every team should answer before writing a DAM RFP — the same questions covered in our upcoming webinar exploring real RFP examples, common pitfalls, and the operational foundations of modern DAM.

1. What are you trying to achieve?

This question shapes every decision that follows. Organizations often rush into vendor evaluation before aligning on the business outcome: What problem should the DAM solve? What behaviors need to change? What will success look like for marketing, brand, IT, or compliance?

Teams get stuck here because different functions have different priorities. Marketing wants ease of use. IT wants security and scalability. Brand teams want consistency. Without a shared definition of the problem, RFPs become feature lists rather than a clear articulation of need.

A strong DAM RFP starts by clearly defining the business outcomes you want to achieve, the challenges you need to solve, and the workflows that must improve. This shared purpose sets the foundation for accurate proposals and a smoother implementation.

2. How should the DAM integrate with your workflows and wider tech stack?

A DAM becomes your single source of truth, but only if it connects cleanly to the systems that create, manage, and deliver content. Many RFPs mention integrations but fail to describe how assets should move, when they should sync, or which systems rely on DAM content.

Without clear use cases, vendors cannot define feasibility or cost — and integrations become risk areas later.

Effective requirements describe integration scenarios in detail — including use cases, data flow, frequency, and required versus optional connections — so vendors can commit to the right approach from the start.

3. What governance, access controls, workflows, and approvals do you need?

Governance structures are often assumed rather than defined, and those assumptions create compliance risks. Organizations differ widely in how they manage access, approvals, brand permissions, and content lifecycles — but RFPs frequently leave these areas vague.

This leads to bottlenecks, unexpected limitations, and governance gaps that slow teams down or expose the organization to risk.

Clear governance requirements outline segmentation by brand, team, or territory; define user roles and lifecycle rules; and explain approval flows with real examples so vendors can configure the DAM accurately.

4. How should your DAM showcase the brand and support brand experience?

A modern DAM must feel like an extension of the brand — not just a file repository. Employees, partners, and agencies rely on it to understand what is approved, what is current, and how assets should be used.

Your RFP should outline expectations for brand portals, guideline presentation, multilingual support, access points, and the insights you need to understand how users engage with the brand inside the DAM.

5. How will you create, localize, and reuse on-brand content from the DAM?

Once assets sit inside the DAM, the real value comes from activation. Teams need to adapt and reuse content quickly, locally, and without manual design workarounds. But many organizations describe storage needs without describing how content will be transformed into campaigns, retail materials, or market-specific adaptations.

This creates inconsistency and slows down global-to-local delivery.

Your RFP should specify the types of templates required, the level of editing flexibility, who can localize content, how dynamic data feeds should connect, and what approvals are needed before assets are exported or published.

6. How do you need to organize and find your content?

Findability is often the biggest complaint in DAM implementations. Users must be able to find the right asset quickly, or they will revert to re-creating content or downloading outdated versions.

A DAM that works for a single, centralized team may not scale when market-level variations, regional permissions, brand hierarchies, and localized content are introduced.

As Christer puts it:

“If end users can’t get the right asset easily, everything else fails.”

Most RFPs lack detail about metadata rules, taxonomy structures, and search expectations — making it difficult for vendors to design a system that aligns with real user behavior.

Before writing an RFP, map your content types and formats, define metadata and taxonomy rules, and detail the search outcomes users expect. This helps vendors design a structure that supports true asset discovery.

Example of a taxonomy (based on a sewing brand):

7. How will the DAM scale as your content, teams, and governance evolve?

A DAM must support the organization you are becoming, not just the one you are today. Many RFPs reflect current pain points but overlook future needs, such as new brands, market expansion, AI-driven automation, and growing content volumes.

This is why organizations often outgrow their DAM within two to three years.

Define your three- to five-year vision, including brand expansion, market growth, governance maturity, automation plans, and increasing content demands. This ensures long-term fit and reduces costly rework.

Conclusion

Well-shaped DAM RFP requirements reduce friction, set expectations early, and give vendors the clarity they need to demonstrate the right fit. These seven questions help you build a complete picture — from content structure to brand experience, templated creation, governance, integrations, and future scalability.

To make the process faster and more structured, you can build a tailored, vendor-ready brief in minutes using Papirfly’s DAM RFP Generator.

FAQs