When someone asks to stop receiving communications, or to have their data deleted, the company has to act everywhere that data exists, including advertising lists. Without a clear process, the request stays half-done and the risk grows.
The essentials in a definition
The right to object and to erasure lets people ask to stop receiving marketing or to have their data deleted. The GDPR sets deadlines and conditions, and the CNPD explains procedures. For advertisers, the challenge is reflecting those requests in lists, audiences and systems, including those uploaded to ad platforms.
Rights that affect advertising
Data subjects may object to processing for marketing, request erasure and withdraw consent. These requests apply to databases, email tools, the CRM and lists uploaded to ad platforms.
The company must respond within the legal deadlines and confirm what has been done.
Where the data is
Map the places where a customer’s data exists: the site database, CRM, email marketing, audience lists on platforms, shared spreadsheets, backups. Each needs to be handled when a request arrives.
If data is scattered and nobody knows where, compliance becomes difficult and risky.
Handling an erasure request
- Log the request and confirm identity
- Locate the data in every system
- Delete or anonymise and update exclusions
- Confirm to the person and keep the record
A practical process
Define a channel for receiving requests and an owner. Log each request with date and action. Delete or anonymise in the main systems and update suppression lists. On ad platforms, remove the contact from lists and stop sending it in future uploads.
Keep a suppression list (people who must not be contacted), but store only the minimum necessary to enforce it.
An erasure request is only fulfilled when it reaches every place the data lives.
Automate what you can
If lists are regularly refreshed from the CRM, make sure suppressions propagate. Avoid uploading again contacts who asked to leave. Review the process when you change tools.
Validate with whoever handles data protection. Legal details vary depending on the situation.
Decision table
| Step | Action | Deadline and record |
|---|---|---|
| 1. Receive the request | Clear channel (email or form) and identification of the data subject | Record the date |
| 2. Verify | Confirm identity and scope | Reply within the legal deadline |
| 3. Execute | Remove from lists, audiences, CRM and tools | Include platforms and suppliers |
| 4. Confirm | Inform the data subject and record compliance | Keep proof without unnecessary data |
Common mistakes to avoid
- Removing only from email. The person may remain in lists uploaded to platforms.
- Delaying. Legal deadlines are short; automate where possible.
- Not propagating. Requests must reach all relevant systems and suppliers.
How to measure the result
Measure average response time, the percentage of requests executed in all systems and the number of incidents (re-sending to those who objected).
Limits and exceptions
Handling data-subject requests can be complex when data are in many systems and suppliers, and not all platforms allow precise deletion. Some data may need to be kept by legal obligation. Document the process, assess each request and consult legal support in difficult cases. The priority is meeting deadlines and maintaining trust.
Illustrative example
Illustrative example: a shop receives an erasure request and removes the person from the customer base, the email tool and lists uploaded to ad platforms. To do so, it keeps a list of systems and a written procedure. In the monthly list update, it applies the month’s objections and records compliance.
Frequently asked questions
How long do I have to respond?
There are legal deadlines. Check with whoever handles data protection.
Do I need to remove the person from ad lists?
Yes, when the request requires it. Update the lists and avoid uploading them again.
What about backups?
It helps to have a process and defined rotation periods. Validate the handling with legal support.
How long do I have to respond?
GDPR sets short deadlines, generally one month, with possible extensions; consult the law and the supervisory authority.
How do I reflect this in ad platforms?
By updating or replacing uploaded lists and removing people who objected, at each update cycle.
Objection and erasure requests must reach all lists, audiences and suppliers, including ad platforms, with deadlines met and compliance recorded.
Sources and recommended reading
- General Data Protection Regulation (GDPR)
- Portuguese Data Protection Authority (CNPD)
- European Commission: data protection
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.