How do lawful bases impact suppression handling?

Your lawful basis affects how you handle suppressions because different bases have different withdrawal mechanisms. For consent-based processing, withdrawal of consent means adding to suppression and stopping marketing immediately-no argument or justification required. For legitimate interests, the subscriber has a right to object; if they object, you must stop unless you demonstrate compelling grounds, which is rarely possible for standard marketing. The practical result is similar (suppression), but the legal mechanics differ.

Suppression itself can be justified under legitimate interests or legal obligation regardless of the original marketing basis. You have a legitimate interest in complying with anti-spam regulations, and maintaining a suppression list is necessary to achieve that interest. Alternatively, honoring unsubscribes is a legal requirement under CAN-SPAM, CASL, and similar regulations. Either basis supports retaining minimal suppression data after the marketing consent or basis has ended. The uaddress, suppression date, and reason.

The interplay becomes important when handling erasure requests. If someone requests deletion under GDPR, you're generally required to delete their data. But you can still retain suppression data because: (1) you have a legitimate interest in compliance, (2) you have a legal obligation to honor their opt-out, and (3) retaining the address actually protects their interests by ensuring you don't accidentally re-contact them. Explain this retention to the requester-most people understand the logic. Your lawful basis for marketing may end, but your basis for suppression continues. The uaddress stays on the list to protect the individual's choice not to hear from you.