What data needs to be deleted when a user requests it?

When a subscriber exercises their right to erasure (under GDPR) or deletion (under CCPA and similar laws), you must delete their personal data unless you have a legitimate basis for retention. For email marketing purposes, this typically includes their email address, name, profile information, preference data, and detailed engagement history. However, the right to erasure isn't absolute. You ucan retain data necessary for legal compliance, defense of legal claims, or other legitimate purposes specified in the applicable regulations.

The key exception for email marketers involves suppression records. If someone requests deletion and has also unsubscribed (or you delete their marketing consent as part of the erasure), you need to retain minimal data necessary to honor their opt-out-otherwise, you might re-add them if their address appears in a future import. Most privacy frameworks recognize this paradox: you're permitted to retain the email address on a suppression list specifically to prevent future unwanted contact. What you cannot retain is extensive personal information, engagement history, or profile data beyond what's minimally necessary for suppression.

Ensure your deletion process is comprehensive across all systems. Subscriber data often exists in multiple places: your ESP, CRM, analytics platforms, backup systems, exported lists, and integrated applications. A deletion request must propagate to all these locations. Document which systems hold subscriber data and establish procedures for ensuring complete deletion (or anonymization where deletion isn't technically feasible). Respond to the requester confirming what data was deleted and what minimal data was retained for suppression purposes. Deletion means deletion everywhere the data exists-not just marking it inactive in your primary system while copies persist elsewhere.