The CBA didn't explicitly address this in our brief, so this will be more of a personal opinion.
It would make sense that it would take place as rapidly as reasonably possible in the circumstances, to a maximum of whatever would be reasonable, be it 10 days or 31 days. The onus should be on the organization to take them off. If they do have the technology to add you to the list instantly, they should be able to take you off it instantly. But there are probably still e-mail lists, if you can think of it, that are manually managed by somebody cutting and pasting e-mail addresses. You need to account for that.