If a marketing mailshot is withdrawn, what is the retention period?

• A. 3 months
• B. 6 months
• C. 60 months
• D. 12 months

Answer: (D)

When someone withdraws consent to receive marketing, you must stop sending marketing communications to them and respect that withdrawal. You can keep their details to maintain a suppression list so you don’t accidentally market to them again, but that data should be kept only for a reasonable period to achieve that goal. A common, practical retention period for this purpose is twelve months. This gives you time to process the withdrawal, update your systems, and ensure no further marketing is sent, without holding onto the data longer than necessary. After twelve months, you would review and delete or further anonymize the record unless there’s another lawful basis to retain it. Shorter periods risk re-contacting the individual, while much longer retention isn’t typically justified for an opt-out scenario. Do note that if there are other purposes for processing the data, retention may differ, but for the marketing opt-out itself, twelve months is the standard approach.