Hyper-personalisation: what it is, what it delivers and how to implement it in compliance with the GDPR

What is hyper-personalisation?

Hyper-personalisation means that every recipient receives a message tailored to their situation. The occasion, argument, channel and sender change – not just the name.

The term comes from marketing practice and is not a legal term. It can be understood as a third stage: segmentation divides customers into groups, personalisation inserts attributes such as the name into a uniform message, hyper-personalisation chooses content, channel and timing for each recipient. Among SMEs, people often put it more simply: addressing every customer individually – automatically rather than by hand.

Why now? Until now, every text variant had to be written and checked. Generative AI noticeably reduces this effort. The real work thus shifts to rules, data quality and approval – and that is exactly where it is decided whether hyper-personalisation is relevant and legally compliant.

How does hyper-personalisation differ from classic personalisation?

Classic personalisation adapts the surface of a message, hyper-personalisation the message itself – visible in what changes between two recipients.

Two examples make the difference tangible:

• Bank, classic: ‘Dear Ms Hoffmann, discover our attractive investment offers now.’ All customers receive the same text, only the name changes.
• Bank, hyper-personalised: ‘Ms Hoffmann, your fixed-term deposit of €68,400 matures on 31 March. You have three options – your adviser Christina Reuter has put them together for you.’ Occasion, amount, deadline and sender come from existing contract data.
• Municipal utility, classic: an autumn newsletter with all tariffs sent to all customers.
• Municipal utility, hyper-personalised: before his tariff ends, Jonas Weber receives a message with his tariff and a suitable renewal option – by email, because he has given consent.

The hyper-personalised bank example needs only four pieces of information: product, amount, maturity date and adviser. The effect comes from the occasion, not from detailed knowledge. One question remains open: what happens if Ms Hoffmann has not given email consent? The answer follows in the section on letters and advisers.

What can be personalised in a message?

Every element between sender and recipient can be personalised. In practice, there are nine levers:

1. Text: subject line, introduction and call to action as approved variants per field.
2. Image: a visual that matches the life situation, such as family, retirement or business.
3. Offer and argument: tax advantage, security or flexibility – depending on what fits the profile.
4. Tone: factual and concise for business customers, more explanatory for private customers.
5. Channel: email, letter, SMS or landing page – depending on consent and reachability.
6. Timing: triggered by a deadline or an event rather than by the campaign calendar.
7. Sender: the responsible adviser, the branch or the local dealer instead of ‘Your marketing team’.
8. Landing page: a personal page with the options that apply to precisely this customer.
9. Letter: content, argument and sender in the printed letter too, generated for each recipient.

Not every lever needs to be pulled. Three are often enough: occasion, argument and sender. Every additional variant increases the approval effort.

What data does hyper-personalisation really need – and what not?

Most scenarios manage with a few attributes that the company already holds anyway: contract and product data, deadlines, channel consents and an adviser’s responsibility. Sensitive data, purchased profiles or information from social networks, on the other hand, are rarely necessary and legally risky.

The rule of thumb: only use data where the customer can understand why you have it. That makes legal sense and is psychologically wise.

How does hyper-personalisation work technically?

Hyper-personalisation works in three layers. A rule layer decides who receives which variant. A generative layer drafts variants. An approval step ensures that only reviewed content is sent.

1. Rule layer (deterministic). Placeholders and conditions control the content. Example: if the portfolio value is over €50,000 and tax is a relevant topic, the customer receives the ‘tax advantage’ argument, otherwise a standard variant. For every recipient, it is possible to explain why they received precisely this text.

2. Generative layer (AI). A language model suggests text or image variants within the brand language. Crucially, variants are created in advance and reviewed, not live at the time of sending. No language model makes decisions during sending itself.

3. Approval (human). An automatic compliance and tone check looks for problems in advance, such as promises of returns or missing mandatory notices. A person then approves, in regulated industries typically according to the four-eyes principle.

The separation has a practical reason: rules can be audited, AI texts are variable. Anyone who mixes the two cannot later explain why a customer received a particular statement.

In the PBM Campaign Platform, the three layers are therefore separate: rules select an approved variant for each recipient, the AI only provides suggestions, and every approval is recorded in the audit log. The AI drafts. You decide. Find out more on the ‘Hyper-personalisation’ feature page.

Is hyper-personalisation compatible with the GDPR?

Yes – if every data category used has a legal basis, the purpose is defined in advance, data subjects are informed in an understandable way and an objection to advertising takes effect immediately. Hyper-personalisation is not prohibited. However, it is generally profiling and is therefore subject to special transparency and objection rules.

Which legal basis supports personalisation?

For advertising, two legal bases are primarily relevant: consent under Art. 6(1)(a) GDPR and legitimate interest under Art. 6(1)(f) GDPR. Recital 47 makes it clear that direct marketing may be regarded as a legitimate interest. What matters is the balancing against the interests of the data subjects and their reasonable expectations.

The German data protection supervisory authorities (DSK) draw a clear line in their guidance on direct marketing (as of February 2022): automated selection procedures for creating detailed profiles, behavioural predictions or analyses indicate that the interests of the data subjects prevail. Profiles from external sources, such as social networks, generally lead to this result. Moreover, the expectations of data subjects cannot simply be extended through mandatory information.

In practice, this means that addressing customers based on contract end date and product holdings can often be based on legitimate interest. Deep behavioural profiles generally require consent – freely given, informed and revocable at any time.

What do purpose limitation and data minimisation mean?

Art. 5(1)(b) GDPR requires specified, explicit and legitimate purposes. Under point (c), data must be adequate, relevant and limited to what is necessary for the purpose. For hyper-personalisation, this means that data collected for the performance of a contract is not automatically available for advertising. Check for each attribute whether its use for advertising is compatible with the original purpose. And do without attributes that change nothing about the message.

Is hyper-personalisation profiling?

In most cases, yes. Art. 4(4) GDPR defines profiling as the automated processing of personal data to evaluate personal aspects – in particular to analyse or predict economic situation, personal preferences, interests or behaviour. Anyone who decides automatically which argument suits a customer is evaluating such aspects. Profiling is not prohibited. However, it triggers transparency obligations and a special right to object.

Glossary: profiling →

What applies to objections to direct marketing?

Under Art. 21(2) GDPR, data subjects may object at any time to the processing of their data for direct marketing. This expressly also applies to profiling to the extent that it is related to direct marketing. Under Art. 21(3), the data may then no longer be processed for these purposes – without any balancing. Art. 21(4) requires this right to be explicitly brought to the data subject’s attention at the latest at the time of the first communication, clearly and separately from other information. Technically, this means that an objection stops ongoing campaigns immediately and across all channels.

When does Art. 22 GDPR apply?

Art. 22(1) GDPR gives data subjects the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them. In typical cases, the selection of a text variant does not reach this threshold. This is also the view of the Article 29 Working Party’s guidelines on profiling, which the European Data Protection Board has adopted. However, they name factors that can change this: the intrusiveness of the profiling, the expectations of the data subjects and their particular vulnerability. You should check carefully as soon as personalisation decides on terms or access to services. Exceptions are governed by Art. 22(2) (contract, legal provision, explicit consent).

Which data is off limits?

Art. 9(1) GDPR prohibits in principle the processing of special categories of personal data. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data and biometric data for the purpose of uniquely identifying a person, health data and data concerning sex life or sexual orientation. The exceptions in Art. 9(2) are narrow. This data has no place in advertising personalisation. Also watch out for inferences: anyone who infers an illness from behavioural data may themselves create sensitive data. For statutory health insurers, social data protection also applies.

What do you need to tell customers?

Art. 13 GDPR (collection from the data subject) and Art. 14 GDPR (collection from other sources) require, among other things, information on the purposes, the legal basis and – in the case of Art. 6(1)(f) – the legitimate interests. For automated decisions within the meaning of Art. 22, meaningful information about the logic involved is added. Good practice goes further – a sentence in the message itself: ‘You are receiving this letter because your fixed-term deposit matures on 31 March.’

GDPR check for marketing campaigns →

What does the UWG permit for email, SMS and letters?

The GDPR governs whether you may process data for advertising. The Act against Unfair Competition (UWG) governs through which channel you may advertise. Both checks apply side by side.

• Email and SMS: under Section 7(2) no. 2 UWG, advertising by electronic mail without prior express consent always constitutes an unreasonable nuisance. Older sources still cite the provision as no. 3. Under European law, SMS messages are considered electronic mail (Recital 40 of the ePrivacy Directive 2002/58/EC).
• Existing customer exemption: Section 7(3) UWG only permits email advertising without consent if all four conditions are met:
  1. You obtained the email address from the customer in connection with the sale of goods or a service.
  2. You are advertising your own similar goods or services.
  3. The customer has not objected to the use.
  4. When collecting the address and each time it is used, you clearly and unambiguously point out that the customer can object at any time without incurring any costs other than the transmission costs at the basic rates.
• Letter: addressed advertising by letter is permissible in principle. Under Section 7(1) sentence 2 UWG, it becomes impermissible if it is recognisable that the recipient does not want it – for example after an objection. The GDPR applies to letters in the same way.

What counts as ‘similar’ in an individual case should be checked by a legal adviser – especially for financial products.

For hyper-personalisation, this means that the channel is itself a personalised attribute. Anyone who has not given email consent receives the message by letter. In this way, a legal limit becomes a rule in the customer journey.

What does the EU AI Act require for AI-generated content?

Since 2 August 2026, the transparency obligations under Art. 50 of the AI Regulation (Regulation (EU) 2024/1689) have applied. For personalised advertising texts that a person reviews and approves before sending, this generally does not, as things currently stand, give rise to an obligation to label the text as AI-generated to the recipient. However, the classification depends on the individual case.

The relevant obligations at a glance:

• Providers of generative AI systems must label synthetic content in a machine-readable format as artificially generated (Art. 50(2)). This mainly affects the manufacturers of models and tools. For systems placed on the market before 2 August 2026, a transitional period until 2 December 2026 applies under the so-called Digital Omnibus.
• Deployers, i.e. companies that use AI, must disclose deepfakes (Art. 50(4)): AI-generated or manipulated image, audio or video content that resembles real persons, places or events and falsely appears to be authentic.
• AI-generated texts published to inform the public on matters of public interest must be disclosed – except where there is human review and editorial responsibility.
• Chatbots must make it clear that people are interacting with an AI, unless this is obvious (Art. 50(1)).

For your marketing, this means: do not depict real people, such as your advisers, with deceptively realistic AI images. Document which content was created with AI support and who approved it. And follow the EU Commission’s guidelines, which further specify the interpretation.

Trust Centre – AI and customer data →

When does personalisation feel creepy – and how does it stay relevant?

Personalisation works as long as the recipient understands where the company’s knowledge comes from and why the message is useful to them. It tips over when it reveals more knowledge than the customer expects.

Three research findings explain this boundary:

• Self-reference effect: information that people relate to themselves is remembered better – as confirmed by a meta-analysis by Symons and Johnson (1997). The findings come from memory research, not marketing. However, they make it plausible why a personal occasion holds attention.
• Reactance: White, Zahay, Thorbjørnsen and Shavitt (2008) found that highly personalised emails can trigger resistance if the company does not explain why the offer suits the person. This was particularly pronounced when recipients rated the benefit as low.
• Personalisation paradox: Aguirre and colleagues (2015) showed that covertly collected data triggers a feeling of vulnerability and reduces willingness to click. Open data collection and trust-building signals weakened this effect.

Five rules can be derived from this:

1. State the occasion. Say in the first line why you are writing.
2. Only show knowledge the customer would expect. Contract data yes, inferences about private matters no.
3. Benefit before precision. Every personal detail must help the customer, not prove how much you know.
4. Give control. Choose a channel, unsubscribe from topics, object – simply and without detours.
5. Limit contacts. Relevance instead of volume: fewer but more suitable contacts – across channels.

How does hyper-personalisation work in letters and with the adviser as sender?

Hyper-personalisation is not limited to digital channels. An automatically generated letter can be as individual as an email, and a personal sender anchors the message in an existing customer relationship.

Example: Marlene Hoffmann, 58, is a customer of Regionalbank Musterstadt eG. Her fixed-term deposit of €68,400 matures on 31 March. There is no email consent, and she has not objected to advertising by letter. This is what her journey might look like:

1. Occasion: 90 days before maturity, she meets the segment condition and enters the campaign.
2. Letter instead of email: because there is no email consent, the journey chooses the letter – the answer to the open question from the beginning.
3. Personal sender: the letter comes from her adviser Christina Reuter, with photo and direct dial number.
4. Suitable argument: the investment amount and tax situation lead to the ‘tax advantage’ argument. Other customers receive ‘security’ or ‘flexibility’.
5. Personal landing page: an access code in the letter opens a protected page with three options: reinvest, pay out, arrange a consultation.
6. Next step: if there is no response, a reminder letter follows after a defined period. If she visits the page, the adviser receives a task.

The adviser as sender requires clear organisation: up-to-date responsibilities, a cover rule, consent to the use of name and photo. And advisers should be able to see what is sent in their name.

In the PBM Campaign Platform, the letter is a fully fledged channel: the platform generates a brand-compliant PDF for each contact and hands the batches over to the print service provider via SFTP. If no responsible adviser can be resolved, nothing is sent. The complete process is shown in the ‘Reinvestment journey in detail’.

How can SMEs get started without a data science team?

Hyper-personalisation does not need a data science team, but clear business rules. Your sales team already knows the logic of ‘who gets which argument?’ – it just needs to be written down. Three steps are enough to begin with (example plan):

1. Choose one occasion. Start with a recurring, datable event. Example: Muster Maschinenbau GmbH writes to customers whose maintenance contract ends in three months. An Excel list with contract end date, contact person and channel consent is all it takes.
2. Few rules, few variants. Define two or three arguments and a standard variant. Let AI help you with the wording – and approve every variant yourself.
3. Start with a control group, then expand. A randomly selected portion of recipients receives the previous standard communication. Only once the comparison holds up are further occasions and channels added.

A typical mistake is starting too big: too many attributes, variants and channels at once. Find out more under ‘Campaigns for SMEs’.

How do you measure whether hyper-personalisation works?

You can only prove impact with a comparison. A randomly drawn control group receives the standard communication, the remaining recipients the personalised variant. Both groups come from the same segment and run in the same period.

What matters:

• Define the goal in advance. Set a primary macro goal such as ‘appointment arranged’ or ‘contract renewed’ before the campaign starts.
• Use micro goals as early indicators. A click, a landing page visit or an argument read show where prospects drop off. They do not replace the macro goal.
• Assign randomly. Otherwise the test measures the selection, not the personalisation.
• Test at sufficient scale. Have the required group size calculated in advance.
• Record side effects. Unsubscribes, objections and complaints belong in the same analysis.
• Analyse channels separately. Letters and emails have different response paths.

Industry benchmarks are of little help here, because response and conversion depend on product, customer base and channel. Only your own comparison is reliable.

Measuring impact without third-party cookies →

Conclusion: relevance is a question of rules, not data volume

Hyper-personalisation changes not only the salutation but the message: occasion, argument, channel, timing and sender. It succeeds with a small amount of purpose-bound data, clear rules, AI suggestions with human approval and a control group that proves the impact. It holds up legally if the GDPR and UWG are checked separately and objections are implemented immediately. It holds up psychologically if the customer understands why they are receiving this message.

The PBM Campaign Platform is built for this way of working. Its principle: individual for every recipient – but only with data approved for that purpose.