Suppression lists and the right to erasure

A customer texts back "STOP. And delete my number." The ICO's answer to what happens next is in its direct marketing guidance: if someone no longer wants your marketing, "you should put their details onto a suppression or 'do not contact' list, instead of deleting them." You stop the marketing straight away, you delete everything else you don't need, and you keep a small record of the number so it never gets texted again. The guidance puts it plainly: "In most cases it is preferable to suppress their details."

That can sound like ignoring the second half of the customer's message. It isn't, and the reason sits in how two separate rights in the UK GDPR fit together: the right to object to direct marketing in article 21, and the right to erasure in article 17. Get the fit right and you can honour both halves of that text. Get it wrong, usually by deleting too thoroughly, and the number can find its way back onto a list.

Two rights that do different jobs

Article 21(2) says that where personal data is processed for direct marketing, the person "shall have the right to object at any time". Article 21(3) gives the consequence: "the personal data shall no longer be processed for such purposes." There's no balancing test, unlike the general right to object in article 21(1). The ICO's guidance is blunt about it: "There are no reasons that you can use to refuse their objection."

Article 17 is the right to have data erased "without undue delay", and it applies only on one of the grounds it lists. Ground (c) is the one that matters here: the person "objects to the processing pursuant to Article 21(2)". So an objection to marketing opens the door to erasure. Then article 17(3) lists the situations where erasure doesn't apply, including processing that is necessary "for compliance with a legal obligation" and "for the establishment, exercise or defence of legal claims".

The ICO's right to erasure page lists the grounds in plain English, one of them being that "you are processing the personal data for direct marketing purposes and the individual objects to that processing". Its direct marketing guidance adds a practical point that saves a lot of worry: "You don't need to automatically treat withdrawals of consent or objections to direct marketing as an erasure request." In practice, though, once the marketing stops you have no use for most of what you held for it, so "you are likely to need to delete that information (unless you need to keep a small amount for another reason, such as on a suppression list)".

Why deleting everything backfires

The ICO illustrates the risk with a phone call, and the story maps straight onto texting. A person asks a company not to call them again, and the company "simply deletes their phone number". A few months later it buys in a list that has the same number on it, calls again, and has "breached PECR by calling their number as the person had previously told it not to call." Had the number been on a suppression list, checking the new list against it "would have identified that there was an objection".

Swap the bought list for anything that brings numbers back in: a spreadsheet export from the till system, a booking form, an old CSV someone finds on a laptop and uploads before a Christmas campaign. If the opt-out was handled by deleting the row, nothing stands between that number and the next send. The ICO's guidance is clear that the law doesn't force a suppression list on you ("Data protection law and PECR don't say you have to use a suppression list"), but it says you "should use one to help you to comply instead of just deleting their details", and its accuracy guidance adds that "You should make sure that any direct marketing suppression lists you use are kept up to date."

How the ICO squares suppression with erasure

The obvious objection is that keeping the number at all is still processing it. The ICO meets that head on. "Sometimes organisations are concerned that the law stops them from putting someone on a suppression list when they object. This is not correct." Keeping the list "isn't for direct marketing purposes. You are keeping this list so that you can comply with your statutory obligations (ie to comply with their objection)".

From that it follows, in the ICO's words, that "there is no automatic right for people to have their information on such a list deleted." The guidance even gives the exact scenario as a worked example: a customer objects to direct marketing and asks for their information to be deleted, and the company "deletes all of it, apart from a small amount that it keeps on its suppression list." The ICO's verdict on that company: "The company is complying with the customer's right."

The guidance doesn't say which paragraph of article 17(3) it's relying on. My reading is that the legal obligation exception in 17(3)(b) is the closest fit, since the only reason the record exists is to keep obeying the objection. Whatever the label, the condition the ICO attaches is the part to hold onto: "Suppression involves keeping just enough information about someone to ensure you respect their preferences in the future, so you must not keep more than you need."

What goes on a suppression record?

For a texting list, "just enough" is short. The ICO also says to "clearly mark the information so you don't use it for the direct marketing purposes they objected to", which means the record lives somewhere a campaign can check against but never send from.

What goes: the name (unless you need it to match against another channel), the purchase history, the birthday, the notes about which offers they liked, and anything else that only existed to market to them. The ICO also warns against confusing the suppression list with a screening list, the people you leave out of one campaign because it doesn't suit them. "Use of a screening list is processing for direct marketing purposes", so a screening list carries none of the suppression list's protection.

Requests that arrive in other words

Very few customers say "I object under article 21(2)". The ICO accepts that: "There is no form of words that people must use to object to your direct marketing. People can object verbally, as well as in writing, and this might be directed to any part of your organisation." Erasure works the same way. An erasure request "can be made verbally or in writing", and "any of your employees could receive a valid verbal request", so the ICO recommends keeping a log of requests made by phone or in person.

That covers the replies a keyword filter won't catch: "please take me off your list", "who gave you this number, delete it", a stylist being told at the till. Each one is an objection, and some are erasure requests too. If you're not sure the number belongs to the person asking, you can check, but only as far as you need to; the ICO's example is that "you may need to confirm their email address or phone number". For a reply that came from the number in question, that check has already happened.

The clocks differ. For an erasure request the ICO says you "have one month to respond", counted from the day it arrives to the same date the next month (its example: a request on 3 September is due by 3 October), with up to two further months for complex cases. For withdrawn consent to marketing it says to stop "immediately or as soon as possible". In practice the marketing stops on the day and the tidy-up finishes within the month.

Backups, processors and the other copies

Deleting a customer from the main system rarely deletes them everywhere. The ICO's erasure guidance deals with backups directly: the data may sit in a backup until it's overwritten, and "The key issue is to put the backup data 'beyond use', even if it cannot be immediately overwritten." Tell the customer that's what will happen.

Then there are the copies other organisations hold for you. Article 19 says the controller "shall communicate any rectification or erasure" to "each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort", and the ICO notes that recipients include processors. Your SMS provider, your booking system and your email platform are all processors in the usual set-up, and article 28(3)(e) requires each processor's contract to make it assist the controller in responding to requests from individuals. The suppression record is the one copy you deliberately keep everywhere you send from, so the number is blocked in every system and deleted from the rest.

Does a STOP mean no service texts either?

Not necessarily. The ICO's own example has a customer texting STOP to a company's marketing texts while still receiving its emails, because an opt-out from one channel leaves the others alone. The same logic applies to service texts. A customer who objects to marketing but has an appointment next week still needs the reminder, and the number is still necessary for that purpose, so erasure ground (a) (data "no longer necessary") doesn't arise for it yet. If they want no texts at all, that's a different request, and the honest thing is to ask how they'd like to hear about the appointment.

What you can't do is come back later to ask whether they've changed their mind. The ICO says "you can't contact them at a later date to ask if they've changed their mind", because that contact is itself direct marketing. Virgin Media learned this in December 2021, when the ICO fined it £50,000 after 451,217 emails about a price freeze went to customers who had opted out, carrying a paragraph inviting them to opt back in (the case is one of four in our post on service texts that turned out to be marketing).

How often does it end up with the ICO?

The ICO publishes every completed data protection complaint as a line in a spreadsheet, with the article it treated as the main issue.

In the file for April to June 2026, 1,497 of the 24,132 completed cases had the right to erasure as their primary reason, behind only the right of access at 11,731. Objections were rarer at 304, and 75 of those cited the objection to direct marketing in article 21(2) specifically.

CaptiFi Connect handles STOP and the other opt-out words automatically: the number goes on the account's opt-out list, and any later send to it is refused, whichever list it arrives in. That list is your suppression record, so leave it out of any clear-out, and when someone asks to be forgotten, delete the contact and keep the opt-out. Our guide to STOP replies covers the replies a keyword match won't catch.