What data needs to be deleted when a user requests it?

When a subscriber invokes their right to erasure under GDPR, or a deletion right under CCPA or similar laws, the obligation is real. but it's not unlimited. You have to delete their personal data unless you have a legitimate reason to keep it.

What you must delete for an email marketing contact:

• Their email address and any associated profile data (name, demographics, preferences, purchase history you hold)
• Engagement history tied to that individual (open records, click records, campaign interactions) if those records can identify them
• Any behavioral or segmentation data you've collected about them
• Records in third-party systems you've shared data with (your CRM, advertising platforms, enrichment services). you need to cascade the deletion or instruct those processors to delete

What you can often keep:

• A suppression record. a minimal marker (hashed email or just a flag) that indicates an address exists on your suppression list. You can't delete this, because deleting it means you could accidentally re-import and re-email the person.
• Aggregated, anonymized analytics (e.g., "Campaign X had a 32% open rate"). these don't identify individuals and are generally exempt from erasure.
• Records you're required to retain for legal, tax, or contractual reasons (like transaction records).

The suppression-record exception is important and often misunderstood: GDPR regulators have accepted the principle that keeping a minimal non-identifiable record after erasure is necessary to honor the erasure itself. Deleting the address entirely can result in re-importing it later. The address goes into a suppressed/hashed state, not into a void.

For how long to keep these records, see suppression data retention rules. For the full erasure process, see handling deletion requests securely.