Strategy
Part of Planning a customer data platform decision around the data journey, not the product class
Customer data platform objections: a direct-marketing suppression runbook
Handle direct-marketing objections in an England CDP with daily hand-offs, profile and destination checks, suppression tests and objection deadlines.
Receipt day: recognise the objection and stop marketing
On receipt of a direct-marketing objection, stop processing for that purpose. If the person also disputes a contact detail, open a separate correction task. Do not make marketing suppression depend on finishing the accuracy investigation. Record the request's scope and route both tasks to named owners.
The ICO's right-to-object guidance states that Article 21 of the UK GDPR gives individuals the right to object to processing of their personal data at any time. For direct marketing, this includes related profiling. The right is absolute, with no exemptions or grounds for refusal.
An objection can arrive verbally or in writing. It need not use 'objection to processing' or cite Article 21 where an applicable condition is met. Recognise and handle it accordingly. Capture whether it concerns all personal data, particular information or a particular processing purpose, rather than assuming its scope.
If more information is needed to confirm identity, tell the person as soon as possible. The objection response period begins when that additional information arrives. Record the original receipt date and the later receipt of identity information separately, so the case owner can track the relevant deadline.
Next working day: check sources, profiles and destinations
Use the next working day as an example hand-off checkpoint, not permission to postpone stopping direct marketing. Trace the request through sources, matched profiles, marketing audiences and destinations. Ask each owner to confirm the resulting state rather than treating a central suppression marker as proof of completion.
| Example owner | Assigned operational task | Completion check |
|---|---|---|
| Data protection lead | Track scope, identity questions and objection response timing | Case status and response date recorded |
| Source owner | Investigate the disputed value and correct it if necessary | Source record checked |
| CDP operator | Update matched profiles and re-evaluate audiences | Profile and audience states checked |
| Marketing operations owner | Stop marketing selection and related profiling | Suppression applied to relevant routes |
| Destination owner | Apply correction and exclusion instructions | Destination state confirmed |
Use team roles to assign hand-offs and commercial contracts to locate the instruction route for external operators. For each source, profile, audience and destination, record an owner and confirmation. Keep unresolved destinations open as operational tasks; a completed central update should not be treated as confirmation of their state.
Following days: check corrections without lifting suppression
For a rectification request, take reasonable steps to satisfy yourself that the data is accurate and rectify it if necessary. Operationally, investigate the originating value separately from the marketing objection. Check profile matching before changing a value, using identity resolution checks to investigate uncertain matches.
As an operational sequence, correct the source where needed, update matched profiles, re-evaluate affected audiences and ask destination owners to confirm the new state. Use customer data quality checks on later imports. Keep the objection marker separate, so replacing an inaccurate value does not silently restore marketing eligibility.
An objection does not automatically require erasure. In most cases, suppression is preferable: retain just enough information to respect the person's preference in future. Clearly mark the data so it is not processed for the objected-to purpose. Erasure may be inappropriate if the data is needed for other purposes.
Example suppression record: identity key; objected-to purpose; receipt date; active status; affected destinations; last check result. Keep only what is needed to recognise and respect the preference. After correcting a contact value, check that the relevant profiles and destinations still exclude the person from the objected-to marketing.
Before the objection deadline: respond or explain an extension
Comply with an objection without undue delay and at the latest within one month of receipt, subject to the identity-information timing above. Calculate the period from the receipt day, whether working or not, to the corresponding calendar date in the next month. Record that date against the objection task.
If the following month has no corresponding calendar date, use its last day. Where a system needs a consistent operational interval, a 28-day period may help keep compliance within a calendar month. Treat this as an operational aid, rather than replacing the calendar-based deadline.
You can extend the response time by a further two months if the request is complex or the individual has made a number of requests. Tell the person within one month of receiving the request and explain why the extension is necessary. Do not use an extension to continue the objected-to direct marketing.
Before every marketing release: run the suppression check
Before releasing another marketing audience, repeat the suppression check across the relevant route. Use the operating workflow to assign the checks and record results. Treat source imports, profile changes and destination updates as prompts to test the preference again, rather than assuming an earlier check remains enough.
- Confirm the source import preserves the objection marker.
- Confirm matched profiles retain the suppression state.
- Confirm marketing audiences exclude the person and related direct-marketing profiling has stopped.
- Check destination lists and queued marketing activity.
- Confirm a corrected contact value remains suppressed.
Check both the current state and a later import as an operational test. Compare the source, matched profile, audience membership and destination selection. If an owner cannot confirm suppression, hold the affected marketing release while investigating. Do not treat a successful correction as permission to resume direct marketing.
Keep electronic marketing controls aligned with suppression
The ICO's electronic mail marketing guidance says the rules on electronic mail marketing are in regulation 22. Marketing emails or texts must not be sent to individuals without specific consent, subject to the limited soft opt-in exception for an organisation's own previous customers.
That exception concerns an existing customer who bought or negotiated to buy a similar product or service, with a simple opt-out when details were collected and in every message. The soft opt-in does not apply to prospective customers or new contacts, including contacts from bought-in lists.
Electronic mail marketing rules also apply to marketing through social-media direct messages. Senders must not disguise or conceal their identity and must give a valid contact address for opting out. For businesses that object or opt out, keeping a do-not-email-or-text list and screening new marketing lists against it is good practice.
Screen electronic marketing against the do-not-contact list and exclude anyone who has asked not to receive it. Include that check in the advertising rules review before a campaign release. Check that audience exclusions and destination suppression cover the same objected-to purpose, with unresolved discrepancies assigned to an owner.
The Data (Use and Access) Act 2025 added the definition of direct marketing in the DPA into PECR. Electronic mail marketing guidance is under review following changes made by the Act and may change. Recheck the guidance when reviewing procedures, while keeping recorded marketing objections effective across the affected routes.
