Klaviyo and data protection: GDPR-compliant email marketing

01Klaviyo and the EU-US Data Privacy Framework

Topic

DPF certified

Key point

SCCs as a safeguard

Klaviyo is certified under the EU-US Data Privacy Framework (DPF).[2] The DPF is the successor to the Privacy Shield, which was struck down in 2020, and was recognised by the EU Commission in July 2023 as providing an adequate level of data protection (adequacy decision under Art. 45 GDPR).[3]

This means: data transfers from the EU to the US are legally permitted on this basis, as long as the receiving US company is DPF certified.[3] Klaviyo is.

Note: The DPF is already being challenged (as Safe Harbor and Privacy Shield were before it): the EU General Court dismissed an action in September 2025,[17] and the appeal before the CJEU is still pending.[18] It is therefore advisable to also keep the standard contractual clauses (SCCs) as a safeguard. Klaviyo offers them.[5]

02Conclude a data processing agreement (DPA)

Topic

Art. 28 GDPR

Key point

Processing only on instruction

Art. 28 GDPR requires you to conclude a data processing agreement (DPA) with every service provider that processes personal data on your behalf.[4] Klaviyo provides such an agreement, which it calls the “Data Processing Agreement” (DPA).[5]

You can find the DPA publicly on the Klaviyo website under klaviyo.com/legal → Data Processing Agreement.[5] It is part of the terms of service and applies automatically as soon as you accept them.[6] Among other things, the DPA covers:

• Which data Klaviyo processes (email addresses, names, purchasing behaviour etc.)
• That Klaviyo only processes the data on your instructions[5]
• Technical and organisational security measures
• Rights of data subjects (access, erasure etc.)
• Sub-processors that Klaviyo uses

03Set up double opt-in

Topic

Confirmation email

Key point

Document consent

In Germany and Austria, double opt-in is the recommended standard for newsletter sign-ups.[7] This means: after entering their email address in a form, the user receives a confirmation email and has to click the sign-up link.

In Klaviyo, you activate double opt-in in the List Settings.[8] Important: document the consent. Klaviyo automatically stores the timestamp, the IP address and the source of the sign-up.

04Update your privacy policy

Topic

Klaviyo section

Key point

Purpose and legal basis

Your privacy policy must name Klaviyo as a processor. It should include the following points:

• Name and address: Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, USA[5]
• Purpose: Email marketing, marketing automation, profiling
• Legal basis: Art. 6(1)(a) GDPR (consent) for newsletters; Art. 6(1)(f) GDPR (legitimate interest) for transactional emails[4]
• Data transfer: USA, based on the EU-US Data Privacy Framework + standard contractual clauses[6]
• DPA: Concluded in accordance with Art. 28 GDPR

05Tracking and cookies

Topic

ePrivacy Directive

Key point

only after consent

Klaviyo uses cookies and tracking pixels to record user behaviour on your website (e.g. Viewed Product, Added to Cart).[9] This tracking falls under the ePrivacy Directive and requires the user’s prior consent.[10]

This means: the Klaviyo tracking code on your website may only be loaded after the user has agreed in the cookie banner.[11] Most consent management platforms (CMPs) such as Cookiebot or Usercentrics support loading Klaviyo conditionally.

06Rights of data subjects

Topic

From access to data portability

Key point

Always an unsubscribe link

Under GDPR, your customers have the right to:

• Access (Art. 15): What data do you store about me?[4]
• Erasure (Art. 17): Please delete all my data.
• Objection (Art. 21): I don’t want to receive any more emails.[4]
• Data portability (Art. 20): Give me my data in a machine-readable format.

In Klaviyo, you can view, export and delete profile data.[12] The option to unsubscribe (unsubscribe link) must be included in every marketing email.[13] Klaviyo adds it automatically.[14]

07Checklist: using Klaviyo in line with GDPR

Topic

7 points

Key point

Manageable effort

1. Read the DPA on klaviyo.com/legal and file it for your records
2. Activate double opt-in for all lists
3. Add a Klaviyo section to your privacy policy
4. Configure your cookie banner so that Klaviyo tracking only loads after consent
5. Make sure every marketing email has an unsubscribe link
6. Define a process for access and erasure requests
7. Document Klaviyo’s list of sub-processors[15]

Conclusion: Klaviyo can be used in line with GDPR. The foundation is the DPA, the EU-US Data Privacy Framework and clean consent management. The setup effort is manageable, and there is no reason not to do it.