A practical GDPR checklist for EU social media agencies
You manage other companies' audiences and data — which makes GDPR your problem too. A plain-English checklist for agencies handling social media in the EU.
If your agency runs social media for European clients, you're handling personal data on their behalf — audience insights, engagement data, sometimes contact details from comments and DMs. Under the GDPR that carries real obligations. This isn't legal advice, but it's the practical shortlist we'd want every agency to have.
Know your role: controller vs processor
For your client's data, your client is usually the data controller and your agency is a processor acting on their instructions. That relationship should be written down in a data processing agreement (DPA). If you use tools like Castessa, those tools are your sub-processors — and your client is entitled to know who they are.
The checklist
- Sign a DPA with each client, and keep a list of the sub-processors (tools) you use.
- Prefer tools that process data inside the EU, and confirm where each vendor stores data.
- Collect only what you need — resist hoarding audience exports 'just in case'.
- Use privacy-friendly, cookieless analytics on your own site so you don't need a consent wall.
- Have a clear process for data deletion requests, and make sure your tools support it.
- Lock down access: give team members and clients only the permissions they actually need.
Consent and cookies on your own site
Your marketing site is the easiest place to get caught out. If you load ad trackers or non-essential cookies, you generally need a compliant consent banner. Switching to cookieless analytics removes that requirement entirely — fewer banners, less risk, and a faster site.
Why it's a selling point
European businesses increasingly ask their agencies how data is handled. Being able to answer clearly — EU processing, a signed DPA, named sub-processors, honest analytics — turns compliance from a chore into a reason to choose you.