Marketing lists are one of the real concerns of people who are involved with a GDPR, depending upon the legal basis the data subjects details were originally on the contact list.
Some possible legal basis are “Consent” which can be complex as per these articles and recitals:-
- There are very clear Conditions for consent in Article 7 as well as very clear Burden of proof and requirements for consent in Recital 42
- The consent must be Freely given consent as outlined in recital 43
- The conditions for consent are clear and outlined in recital 43
Another legal basis maybe “legitimate interest” as per https://gdpr-info.eu/recitals/no-47/ “7The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”
which may be an easier to legal basis to work with as outlined in Article 6, section 1 f)
1, F) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
BUT regardless of what legal basis you are using the data subjects data you need to offer the data subject suitable ways to subscribe and un-subscribe from the contact lists, one such service is available from https://myconsent.ie/ they can customise their service to suit you for both subscription and un-subscription.