How do lawful bases impact suppression handling?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Your lawful basis determines what happens when someone asks you to stop processing their data. Different bases have different withdrawal mechanisms, and they don't all work the same way.
Consent: If someone withdraws consent, you must stop processing for that purpose. Add them to your suppression list and don't contact them for marketing. Suppression should be immediate. Note that withdrawing consent doesn't automatically erase all their data. If you process some data under a different basis (like contract for transactional emails), that's separate.
Legitimate interest: People have the right to object to processing under legitimate interest. When they exercise that right, you must stop unless you can demonstrate compelling legitimate grounds that override their interests. In most email marketing situations, you won't be able to demonstrate that, so treat an objection under legitimate interest the same as a consent withdrawal: suppress and stop.
Contract: The contractual basis ends when the contract ends. Once the relationship is over, you can't keep processing under that basis. Move the subscriber to suppression and evaluate whether any other basis applies for further contact.
The practical implication: your suppression list needs to be reliable regardless of which basis you used. Someone who exercised a right to stop processing shouldn't receive emails even if they sign up again through a form. Your ESP's global suppression list is the mechanism that enforces this.
For more on how suppression works in erasure scenarios, see deletion vs suppression. For the full picture on the bases themselves, see the six GDPR lawful bases.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
