Does GDPR or any other UK law specify the timeframe for removing someone from a mailing list? In our case the mailing list must be created up to 10 days before an automated email send over the Christmas period.

up vote 2 down vote accepted

Paragraph 47(1) of Chapter 3 of the Data Protection Act 2018 (based on GDPR) uses the phrase "without undue delay". I'm not aware of other legislation that defines a timescale, and believe this was intentionally undefined since what a Reasonable Person would consider reasonable action in a reasonable time could vary depending on whether we were considering a small company who could edit a distribution list in a few minutes or a large company with a policy to review Personal Data retention and processing on a monthly basis. [Though the beauty of SE is if I'm wrong, someone will be along to point it out.]

Assuming your mailing list has already demonstrated a Lawful Basis for Processing the names and addresses on the list, now is probably a good time to define a procedure on how to respond to requests for removal - this will be how you'll be able to convince the Information Commissioner's Office (if it came to it) that you acted "without undue delay".

If you've not already demonstrated Lawful Basis, your mailing list may have GDPR/DPA issues even before it's compiled. It's worth mentioning that not having objected before is not considered to be the same as having given expressed consent.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.