Replying to @tobie
They need to have the right to fix their email address (and name if you have it), to be deleted, to know that they’re in the list. If someone steals that list you need to follow breach procedures.
That’s pretty much it, and even then there are exemptions for being small.