united-kingdom gdpr
GDPR - How quick to honour unsubscribe?
<p>Does GDPR or any other UK law specify the timeframe for removing someone from a mailing list? In our case the mailing list must be created up to 10 days before an automated email send over the Christmas period.</p>

<p><a href="http://www.legislation.gov.uk/ukpga/2018/12/section/47/enacted" rel="nofollow noreferrer">Paragraph 47(1) of Chapter 3 of the Data Protection Act 2018</a> (based on GDPR) uses the phrase "without undue delay". I'm not aware of other legislation that defines a timescale, and believe this was intentionally undefined since what a Reasonable Person would consider reasonable action in a reasonable time could vary depending on whether we were considering a small company who could edit a distribution list in a few minutes or a large company with a policy to review Personal Data retention and processing on a monthly basis. [Though the beauty of SE is if I'm wrong, someone will be along to point it out.]</p>

<p>Assuming your mailing list has already demonstrated a <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Lawful_basis_for_processing" rel="nofollow noreferrer">Lawful Basis</a> for Processing the names and addresses on the list, now is probably a good time to define a procedure on how to respond to requests for removal - this will be how you'll be able to convince the Information Commissioner's Office (if it came to it) that you acted "without undue delay".</p>

<p>If you've not already demonstrated Lawful Basis, your mailing list may have GDPR/DPA issues even before it's compiled. It's worth mentioning that not having objected before is not considered to be the same as having given expressed consent.</p>
