When someone objects to direct marketing, you must stop using their data for it. Build a central suppression list that every campaign tool checks before sending, keep it even after you delete the rest of the person's record, and apply it on every import. GDPR Article 21 makes the right absolute for direct marketing.
What the law says
Article 21(2) says that where personal data is processed for direct marketing, the data subject has the right to object at any time, including to related profiling. Article 21(3) says that where they object, the personal data "shall no longer be processed for such purposes." Unlike other objections, there is no balancing test for marketing. Separate rules on electronic marketing may also apply in your country, so check those with counsel.
Why suppression lists fail
Marketing data moves. An unsubscribe in one tool does not reach the CRM, a list import re-adds the person, an old export is uploaded to a new platform, and a partner sends the same address back. A person who opted out receives email again, and complains.
Design a central list
Store suppressions in one place, owned by one team, with an API that every sending system calls. Entries hold:
- A normalised identifier, such as a lowercased email or a keyed hash of it.
- The channel, such as email, SMS or phone, since someone may object to one only.
- The date and the source of the request.
- The reason: objection, withdrawn consent or bounce.
Check the list at send time, not only at import. A short cache is fine.
Keep the minimum after erasure
If the person also asks you to delete their data, you still need to remember not to contact them. The ICO guidance on consent accepts keeping suppression records for direct marketing, provided you tell people and rely on a lawful basis. Keep only the identifier and date, and keep it apart from marketing profiles.
Apply on every entry point
- Imports and uploads. Filter against the suppression list before loading.
- Integrations and sync jobs. Make suppression a field that flows both ways.
- Tool migrations. Export the suppression list first and load it into the new tool before any campaign.
- Partner lists. Check against the suppression list before using purchased or shared data.
Make opting out easy
Put a working link in every message and honour it quickly, within the time you state. A multi step process that asks for a login or a reason invites complaints. Article 12(2) asks you to facilitate rights.
Test it
Create a test contact, suppress it, then try to send from every system, import the address in a list and trigger a sync. Nothing should go out. Run it before each tool change.
Quick check
Can I keep emailing for service messages?
Transactional messages that are necessary for the service are different from marketing. Keep them strictly functional and check local rules.
Is a hashed email enough for suppression?
Yes as a matching key. It is still personal data, so store it with the same care.
Sources
Last reviewed: 19 October 2026.
