How often should you clean an email list?

Remove hard bounces and unsubscribes after every send, review inactive subscribers about twice a year, and check once a year that you still have a reason to hold everything else. No UK law sets those intervals. They are our suggestion for a small list, built on two duties in UK GDPR: keep personal data accurate, and keep it no longer than you need it. A smaller, wanted list also tends to protect your standing with mailbox providers, which is reason enough on its own.

A routine that fits on a postcard

A monthly newsletter of a few hundred people can do all of this in an hour or so across the year, because most email platforms handle the first row by themselves. Make sure yours does rather than assuming.

Bounces first, because they are the easy win

A hard bounce means delivery failed for a lasting reason, usually that the address does not exist. A soft bounce means a temporary problem, such as a full mailbox or a server that was briefly unavailable.

Remove hard bounces straight away. Give soft bounces a little patience, then suppress any address that keeps failing over several issues. Most tools have an automatic rule, and it is worth finding out what theirs is. Sending again and again to dead addresses is one of the plainest signs of an unkempt list.

The law has also tightened here. The government's factsheet on the 2025 Act says a PECR infringement can occur even if the communication did not reach the intended recipient, so a bounce does not turn an unlawful send into a harmless one.

Do not delete people who unsubscribed

This feels backwards, and it is the point most often got wrong. If you delete someone who asked to leave, nothing stops their address coming back the next time you import a spreadsheet from an event or a colleague.

So the ICO's guidance on respecting people's preferences recommends a suppression list, sometimes called a do-not-contact list. Keep only enough to honour the request, which for a newsletter is usually the address and the date, and mark it clearly so it cannot be mailed. Check new lists against it before any import. Your platform may do this for its own account, but it will not know about the spreadsheet in your shared drive.

A person who asks to have all their data erased is a different request, and the right reply needs some thought. Explain that keeping a bare suppression record is how you make sure they are not contacted again.

Why "inactive" is harder to judge than it was

The classic method was to remove anyone who had not opened an email in six months. Open data is now too unreliable to use on its own. Apple says its Mail Privacy Protection prevents senders from seeing whether a message has been opened, and it hides the reader's IP address. Other people read with images turned off. Your open figure therefore contains people who did not read, and misses people who did.

There is a legal wrinkle as well. Open tracking normally depends on a tiny hidden image. The ICO treats tracking pixels as falling under regulation 6 of PECR, separately from the rules on the email itself. Its storage and access guidance is the place to read about pixels that record when, where or on what system a message was opened. If you keep tracking on, your privacy notice and sign-up wording should deal with it, and it is worth asking whether you really use the numbers. Many small publications could switch it off and lose little.

Better signs of life are clicks, replies, purchases, renewals, attendance at an event and recent sign-up dates. Set your own window based on how often you send. A quarterly newsletter cannot judge anybody on six months of silence, because that is only two issues.

The last-call email

Once you have your quiet group, write to them once. Keep it short and honest, with the choice visible in the first lines:

You signed up for our letter a while ago and we can't tell if you still read it. If you'd like to stay, click here. If we don't hear from you by 30 June, we'll stop writing. No hard feelings.

Then keep your word. Bear in mind that a click-to-stay message suffers from the same measurement problems, so some silent readers will go. They can rejoin, and you can mention how in the same email.

Only send this to people you can lawfully keep mailing. It is no way to rescue addresses without valid consent, and it must never go to people on your suppression list.

What to keep, and for how long

Nobody can give you a universal retention period, since Article 5 asks only that you keep data no longer than necessary for the purpose. Decide your own and write it down. A reasonable shape is: active subscribers for as long as they stay; lapsed subscribers removed after your last-call email; suppression records kept for as long as you run the list; and consent evidence kept long enough to answer a question or complaint about it. Have a look at any extra fields as well. If you collected dates of birth or job titles and no longer use them, remove them.

The ICO also advises keeping consent under review and refreshing it if you are in any doubt that it is still valid. Consent gathered for a monthly events email does not stretch to a daily sales campaign, so if your newsletter changes substantially, ask again.

Measuring whether it worked

Expect the subscriber count to fall, and do not panic when it does. Watch complaints, bounces and clicks instead. If your readers are mostly on Gmail and you have enough volume to appear in Postmaster Tools, Google's spam rate is worth checking against the limits we set out in our deliverability letter.

Cleaning a list will not cure dull issues, though. If readers are drifting away in numbers, the answer may be in the writing, and if you doubt how some of these addresses got there, check the consent question first.