GDPR List Clean-Up: What to Keep, Re-Ask or Delete

Most small businesses build an email list over years and then never look at it again. There are old trade-show contacts, a spreadsheet inherited from a previous colleague, and people who stopped opening your emails long ago. Under GDPR (the EU's data protection law), that forgotten list is more than clutter. It is personal data you are responsible for. The good news is that one calm afternoon of clean-up fixes most of it.

This guide is general information, not legal advice. If your situation is complex, ask a data protection professional.

Why an old list is a risk, not an asset

Two GDPR ideas matter here. Data minimisation means you only keep the personal data you actually need. Storage limitation means you don't keep it longer than you have a good reason to. A contact who never opens, never buys and joined for a reason nobody remembers is hard to justify.

There is a practical side too. Inactive addresses drag down your engagement, and some turn into spam traps (addresses that mailbox providers use to spot careless senders). A smaller, willing list almost always works better than a large, sleepy one.

Step 1: Export your list and check three details

Export the full list and make sure each contact has, at minimum:

• Source: where did they join? A website form, checkout, event or import?
• Date and wording: when did they join, and what exactly were they told?
• Last activity: their most recent open, click or purchase.

If you cannot fill in the first two for a contact, that tells you something important. Keep reading.

Step 2: Sort everyone into three piles

• Keep: people with a clear record of consent and recent activity. Nothing to do here.
• Re-ask: people with a clear record of consent who have gone quiet. They deserve one friendly chance to confirm.
• Delete: people whose source you cannot explain, who never agreed to marketing, or who have been silent for a very long time.

The delete pile is the one people avoid, but it is the safest. If you cannot show where an address came from or what the person agreed to, you should not be mailing them. Please also note that a re-ask email is itself a marketing message. Sending it to people who never opted in only adds to the problem, so those contacts belong in the delete pile.

If you email existing customers about similar products, some EU countries allow that under specific conditions. The rules differ from country to country, so check your local guidance before you rely on it.

Step 3: Write a re-ask email people will answer

Keep it short, honest and easy. A good re-ask email follows this order:

1. Use a plain subject line, such as: Do you still want to hear from us?
2. Remind them how they joined, for example: You signed up on our website last spring for our monthly newsletter.
3. Offer one clear button: Yes, keep me subscribed.
4. Say what happens if they do nothing: you will stop emailing them and remove their details.
5. Send it once, send one gentle reminder, then act on the result.

Step 4: Set retention rules you can actually follow

GDPR does not give a magic number of months after which a contact must go. It asks you to decide on a reasonable period for your business and stick to it. Think about your sales cycle. A shop with weekly purchases will have a different rhythm from a firm that sells a service once every few years.

Write your rule down in one sentence, for instance: We re-ask contacts after a year without activity, and remove them if they don't confirm. Use your own timing, but make sure it is a rule you follow every time rather than a good intention.

Keep unsubscribes safe

One detail surprises many people. When someone unsubscribes, you should not simply erase every trace, or they could be added again by accident through a future import. Keep a minimal suppression list: just the address, plus the fact that the person opted out, so you can honour their wish for good. Keep it separate from your marketing list, and never import it back in.

Also make sure unsubscribing is easy. One click, no login, no questions. A person who cannot leave easily is more likely to complain, which hurts you far more than a lost subscriber.

Keep a simple log

If anyone ever asks how you handle their data, a short record is your best friend. Note the date of each clean-up, how many contacts were kept, re-asked and removed, and which rule you applied. A single page in a shared document is enough. It shows you take the matter seriously, and it saves you from reinventing the process next time.

Make it a habit, not a project

A big clean-up feels heavy once. A small one every quarter feels like routine. Put a recurring reminder in your calendar, review the three piles, and send your re-ask email only when the numbers justify it.

A platform built for EU senders makes this lighter. With CARIO Mail you can keep consent details alongside each contact, segment people by last activity and make unsubscribing effortless, so your housekeeping fits into a normal working week.

The result is a list of people who chose to be there, who recognise your name and who are glad to see you in their inbox. That is better for compliance, and better for your results too.