A UK marketing automation migration checklist to avoid losing consent and suppression data

What to take away

Treat a platform switch as a data protection project, because your business stays the controller for every record it moves.
Export contacts, consent records and suppression lists before you cancel, and keep that export controlled.
Agree deletion, portability and exit support in the contract before the new platform sends anything.
Test one workflow end to end, including unsubscribes, before switching off the old tool.

Why the records matter more than the software

Platform reviews concentrate on features, deliverability and price. Migration is usually left to the final week of a contract, handled by whoever has capacity. That order creates avoidable risk.

The business sending the messages is the controller under the UK GDPR. That role does not pass to a supplier when you change tools. The ICO's UK GDPR guidance describes accountability as a duty to demonstrate compliance, not merely to intend it.

What UK data protection law asks of a switch

The Data Protection Act 2018 sits alongside the UK GDPR. It gives people rights you must keep serving mid-migration, including access, rectification and erasure. Asking a customer to wait until the project finishes is not a defence.

The right to data portability applies where processing is automated and based on consent or contract. That covers a large share of campaign and CRM records.

Direct marketing adds the Privacy and Electronic Communications Regulations. Consent has to be specific and recorded, so the audit trail must travel with the contact rather than stay behind. The ICO's direct marketing guidance explains what this means for email and SMS.

A migration checklist for UK teams

List every field, list and integration in the current platform, including unused ones.
Confirm who owns each data set and who can authorise its export.
Export contacts with timestamps, source and consent wording intact.
Export suppression lists, unsubscribes, bounces and complaints separately.
Check the new platform's field limits before mapping, and decide what gets dropped.
Rebuild the smallest useful set of workflows first, not the whole library.
Keep the old platform read-only for a set period instead of deleting it.
Test a send to an internal list and check tags and unsubscribe paths.
Send a deletion instruction to the old supplier and record the reply.
Record what moved, what was dropped, who approved it and when.

The risks that actually cause loss

Consent flags break first. A CSV export often carries addresses and nothing about how permission was obtained, so the new platform treats everyone as opted in. That breaks the record-keeping the UK GDPR expects.

What breaks and why

Risk

Consent flags: CSV drops permission
Suppression lists: Unsubscribes stay behind
Duplicate records: Two consent states

What happens

Consent flags: Everyone treated as opted in
Suppression lists: New tool emails objectors
Duplicate records: Automation picks first found

Suppression lists break second. If unsubscribes and complaint records stay behind, the new tool can email people who already asked you to stop.

Duplicate records cause a quieter problem. Two records for one person can hold two consent states, and automation picks whichever it finds first.

Contract terms and a clean exit

A migration is calmer when the previous contract anticipated it. Look for defined export formats, a stated notice period, deletion confirmation and help with a parallel run. Our review of marketing automation contract issues covers processing instructions and exit clauses.

Testing and the parallel run

Run both systems side by side for a fixed period. Point new sign-ups at the new platform, keep the old one for historical sends, and check each morning that subscription states match. Reconcile a sample of records by hand rather than trusting a row count. A mismatch found in testing is a fix. The same mismatch found by a customer is a complaint.

Decide in advance who approves the cutover and who can stop it. If you are still choosing the destination platform, our guide to how to pick GDPR compliant marketing automation tools sets out the questions to ask before signing.

Common questions

How long does a migration take?

Two to six weeks for a small UK business with a few thousand contacts, longer where workflow logic is complex. The export is quick; rebuilding and testing takes the time.

Can consent records move to a new platform?

Yes, but only when the record shows what was agreed, when and through which channel. If that detail is missing, re-permission rather than assume consent.

What happens to unsubscribes during a migration?

They must travel with the contact, or sit on a suppression list the new platform checks before every send. Losing them risks emailing people who have opted out.

Do I need a new processing agreement?

Yes. A new supplier is a new processor, so a fresh data processing agreement is needed before any personal data is loaded.