An online retail company is trying to determine how to handle users’ data if they unsubscribe from marketing emails generated from the website. Which of the following is the BEST approach for handling personal data that has been restricted?

The best approach is to flag the user's email address on a suppression list. This directly honors the user's request to stop receiving marketing communications. It also prevents the user from being inadvertently re-added to marketing lists in the future if their data is re-imported from another source. This method respects the right to object to processing for direct marketing purposes while allowing the organization to retain the data for other legitimate reasons, such as transaction history or legal compliance, if applicable. This is a standard industry practice for managing marketing consent.

A. Encrypting data protects its confidentiality but does not prevent it from being used for marketing, failing to honor the user's request.
B. The privacy policy should guide the process, but the action itself is what's required. This option describes a verification step, not the handling approach.
C. Completely removing the user's information may violate other legal or business requirements for data retention and fails to prevent their re-addition to marketing lists.

1. ISACA. (2020). CDPSE Review Manual. Domain 2: Data Lifecycle, Section 2.5 Data Destruction. The manual discusses the importance of proper data handling at the end of its life cycle, including suppression for marketing purposes as a valid alternative to complete deletion when other business needs exist.

2. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). Section 3.3.3, "Minimization of PII," discusses collecting and retaining only necessary PII. For opt-outs, retaining an email on a suppression list is a minimal, necessary action to ensure compliance with the request.

3. General Data Protection Regulation (GDPR). Article 21, "Right to object." Paragraph 3 states, "Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." A suppression list is the technical mechanism to ensure this.