The GDPR requires businesses to obtain explicit consent from individuals before sending them marketing emails. This consent must be freely given, specific, informed, and unambiguous. Additionally, businesses must provide clear options for recipients to opt-out of email communications and ensure that personal data is securely stored.