What happens when you lose your lawful basis?

When you lose your lawful basis for processing, you must stop processing immediately unless another lawful basis applies. For email marketing, the most common scenario is consent withdrawal. When ua subscriber unsubscribes, you lose the consent basis for sending marketing emails to them. If consent was your only basis, you cannot continue marketing to that address. Similarly, if you relied on legitimate interests and the subscriber objects, you must stop processing unless you can demonstrate compelling legitimate grounds that override their interests.

Loss of lawful basis triggers immediate compliance obligations. Stop the processing activity (don't send more marketing emails). Determine whether any data retention is justified under a different basis (suppression data to prevent future contact). Delete data that's no longer needed. Update your records to reflect the change in processing status. If you've shared data with third parties, inform them of the change so they can adjust their processing accordingly.

Common scenarios where lawful basis is lost include: consent withdrawal (subscriber unsubscribes or explicitly revokes consent), successful objection (subscriber objects to legitimate interests processing and you can't demonstrate overriding grounds), relationship ending (contract concludes and contractual necessity no longer applies), or purpose completion (original purpose achieved, making continued processing unnecessary). Have systems in place to recognize these triggers and respond appropriately. Losing your lawful basis isn't optional to address. It umeans your processing has become unlawful, and continuing violates GDPR.