do I need consent to send customers a newsletter

Newsletters to existing customers often do not require separate consent

For a newsletter to existing customers, consent is usually not the only way: processing personal data is also permitted if another legal basis under Article 6 of the GDPR exists, and "legitimate interest" is often used in practice for marketing to people who are already customers. For new contacts who have never purchased or used anything, it is different: explicit consent is generally required before a newsletter is sent, among other things because the rules on unsolicited communications require this.

The distinction between "existing customer" and "new contact" is therefore more important than the question of whether a newsletter checkbox has been ticked. In addition, it matters what the newsletter contains and how someone ended up in the database: data collected for another purpose cannot simply be used for marketing. Anyone who wants more control over this should examine which legal basis exactly applies to the processing that underlies the newsletter, and whether that use is also included in the privacy notice that customers can consult.

Where this follows from: Article 6 of the GDPR

Article 6 of the GDPR sets out the legal bases on which processing of personal data can be lawful, including consent and legitimate interest; which legal basis applies depends on the specific situation and is not determined by the GDPR itself for each case. The Dutch Data Protection Authority provides further guidance on its website on how these legal bases are applied in practice. These rules on the lawfulness of processing apply as part of the regulation directly in each EU member state; what differs is which supervisory authority monitors compliance — in the Netherlands this is the Dutch Data Protection Authority, in other member states the supervisory authority of that country.