How to import an email list into new software

1. Establish that you may mail these people at all

The question is not whether the export is yours. It is whether each person in it did something that counts as agreeing to hear from you, and whether you can still show what that was. Under the GDPR that is Article 7(1): where processing rests on consent, you have to be able to demonstrate that the person consented. Under CAN-SPAM the standard is different and lower — commercial mail may be sent without prior consent provided the header information is accurate, the message is identifiable, a postal address is present and an opt-out is honoured — so the same file can be lawful to send in one jurisdiction and not in another, and the safe reading is the strictest one that applies to anybody on the list.

Sort the file by where each row came from rather than by how old it is. Addresses that filled in your own form, with a date and a page recorded, are the strongest case. Addresses from a checkout, a booking or an event you ran are usually defensible and are exactly what the soft opt-in in national ePrivacy law was written for, within the narrow limits the ICO reads into it. Addresses somebody gave you at a conference, addresses a partner shared, addresses scraped from a directory and addresses bought from anybody are a different category entirely, and no amount of careful sending rescues them.

Write down the answer per source before you upload anything, because the decision is much harder to make afterwards, when the rows have lost their provenance and become one undifferentiated list in a new tool. None of this is legal advice; it is the shape of the questions, with the articles named so you can check them.

2. Export the file and read what is actually in it

Export to CSV and open it, rather than moving it through an integration that promises to do the transfer for you. An integration migrates what the old tool considered a subscriber, which is a category that quietly includes people who unsubscribed and were kept for reporting, people who hard bounced and were kept for history, and people who never confirmed and were kept because the old tool did not enforce confirmation on every route in.

Read the column headings first. A useful export has an address column, a status column, a created-at timestamp, the source or form name, and often the IP and timestamp of a confirmation click. Those last two are the consent record, and they are the part most often lost in a migration, because the importer on the other side only asks for an address and a name. An export with no dates and no status column is not a list you can account for, whatever it says at the top of the file.

Count the rows by status before you do anything else. The number that matters is not how many addresses the file contains but how many of them are confirmed, currently subscribed, and were active in the last few months, because that is the list you are actually moving. It is normal for that figure to be a fraction of the headline one, and much better to learn it now than after a send.

3. Strip the rows that cost more than they are worth

Every address in the file has an expected value and an expected cost, and for a surprising number of them the cost is higher. A hard bounce costs a delivery attempt against a domain that has just started sending. A spam trap costs a listing. A role address costs a complaint from somebody who never signed up personally. None of these is worth keeping in exchange for a slightly larger number on a dashboard.

The rule of thumb is that an address earns its place by having done something, recently, that a machine can see. Opened is no longer such a thing — open tracking stopped being reliable evidence in 2021 — so the signals left are clicks, replies, purchases and logins. An address with none of those in the last year is not a subscriber; it is a line in a spreadsheet, and it is the line most likely to have become a trap.

4. Carry the suppression list across before any subscriber

The suppression list is the most valuable thing you own and the thing most often lost in a move, because importers ask for subscribers and nothing asks for the people you must never contact. Upload it first, on its own, and confirm it is in place before a single subscriber row goes anywhere near the new tool. A platform that offers no way to import suppressions is a platform that is about to let you mail everybody who ever left.

This is also the step that most often resurrects somebody. The classic sequence is an old export taken before a person unsubscribed, imported later into somewhere that has no record of the unsubscribe, and that person receives a message they explicitly refused — which under CAN-SPAM is a violation regardless of intent, and under Article 21(3) of the GDPR is processing after an objection. The export is not wrong. The order of the two imports is.

If your suppression list holds hashes rather than addresses, hash the incoming file the same way and compare before importing, rather than after. The comparison has to happen on the way in; a check that runs at send time is one configuration change away from not running.

5. Re-permission everything you cannot account for

A re-permission campaign is one message to an existing list asking the people on it to confirm they still want the mail, after which everyone who did not answer is suppressed rather than mailed again. It is what you run for the rows that survived the previous two steps but still have no record behind them, and it is the only mechanism that turns a list you cannot account for into one you can.

The message has to stand on its own, because most of the people receiving it do not remember you. Name the thing they signed up for, say when and where if you know, say plainly what happens if they do nothing, and ask for exactly one click. Do not attach an offer to it; a re-permission message that is also a promotion is a promotion sent to people who have not agreed to receive one. Do not send a reminder to the people who ignored it either — the ignoring was the answer.

Expect the list to come back smaller, and treat that as the point rather than the cost. The addresses that do not answer were not going to open, click or buy; they were going to sit in the denominator making every rate look worse and occasionally reporting you. What you have afterwards is a list you can describe to a regulator and a complaint rate you can predict.

6. Ramp the first sends instead of mailing everyone at once

The largest, least engaged, most surprising send you will ever make is the first one after an import, and sending it to the whole list on day one is how a domain gets its reputation set by its worst possible audience. Split the import into batches ordered by how recently each person did something, send to the most recent batch first, and wait long enough between batches to see the result of the one before.

What you are watching for is the spam complaint rate, which Google asks bulk senders to keep below 0.3% and which is worth aiming a long way under, around 0.1%. A batch that comes in over the ceiling is not a batch to push past; it is information about every batch below it, which is by definition less engaged. Stop, and go back to the re-permission step for the remainder.

A course has an advantage here that a newsletter does not, and it is worth using deliberately. A course sends one message per subscriber per day counted from the day that person confirmed, so importing a list into a course staggers itself: nobody is mailed on a schedule shared with anybody else, and the volume spreads across the days on which people happened to click rather than landing in one hour.

7. Import the evidence, not only the addresses

Finish by moving the part of the old system that was never on the subscriber row: what each person was shown when they agreed, when they submitted the form, when they clicked the confirmation link and from where, and what they were told they would receive. Article 7(1) puts the burden of proof on you and does not care which vendor you were using when the consent was given.

Where the old tool recorded a consent sentence, store it as text rather than as a link to the page it used to live on, because the page will be edited and the record will silently become a description of your current copy instead of what that person actually read. Where the old tool recorded nothing, record that too — a row marked as imported without evidence, with the date it arrived and the source it came from, is a far better artefact than a row that looks identical to one collected through a form.

Then write two lines somewhere durable: where this list came from, and what you did to it on the way in. In two years that note is the difference between answering a complaint in a paragraph and reconstructing a migration from memory.