What happens when you lose your lawful basis?

A subscriber hits unsubscribe. Or they send a formal objection to your marketing emails. Either way, the legal permission that let you contact them is gone. So what happens next?

Under GDPR, every piece of data processing needs a lawful basis to be valid. When that basis disappears, you can't just keep going. You need to stop the processing activity that depended on it.

For most email marketers, this comes up in two situations. First, consent withdrawal: someone unsubscribes, and if consent was your only basis for sending marketing emails to them, you're done. You can't market to that address anymore. Second, a legitimate interests objection: a subscriber formally objects to your processing, and you can't show a compelling reason that overrides their objection. Same result. Stop.

Stopping the emails is just the first step. Here's what you actually need to do when a lawful basis falls away:

• Stop the processing activity right away. No more marketing emails to that address.
• Check if another basis applies. For example, you can keep an address on a suppression list (the basis there is legitimate interest in not re-contacting someone who opted out). That's different from marketing, and it's valid.
• Delete data that no longer has a purpose. If you held profile data only for marketing and that permission is gone, you may need to delete it.
• Tell any third parties. If you've shared that contact's data with another processor, you need to inform them of the change so they adjust their own processing.
• Update your records. Your consent and processing logs should reflect the change, including the date and what triggered it.

The most common mistake is treating an unsubscribe as a deliverability action only and ignoring the data side entirely. The unsubscribe stops the emails, sure. But depending on your setup, there may be other data (profile records, behavioral tracking, third-party syncs) that also needs to be addressed.

It's also worth knowing the difference between losing a basis and switching one. If your original basis genuinely no longer applies, you can't just quietly swap in a different basis to keep going. That's not how it works. The rules around switching bases are strict, and this kind of retroactive substitution is exactly what regulators look for.

One practical note: the rules above are based on GDPR, which applies to contacts in the EU and EEA. Other jurisdictions (Canada's CASL, US state laws, etc.) have their own requirements. If you're unsure which law applies to your list, that's worth sorting out before you hit a compliance moment. If you'd like a hand thinking through your specific setup, our SOS hotline is free and no-pitch.