A contact CSV can lose important information before it ever reaches a campaign tool. Spreadsheet software may change a telephone number, interpret a value as a date or treat a cell as a formula. Use a controlled import process so the reviewed selection stays intact.
Keep the original delivery unchanged
Store a restricted original copy and work on a separate import version. Record the file name, delivery date, encoding and row count. Note whether the count excludes the header. Use a proper CSV reader rather than splitting every line at a comma; quoted values can contain commas or line breaks.
Review the data in a controlled environment. A file received from a known supplier can still contain unexpected values from an upstream source. Avoid opening it directly in a spreadsheet with automatic behavior before checking the import settings.
Map fields before loading records
| Field | Import decision |
|---|---|
| Telephone, postcode and record ID | Use text where required to preserve plus signs, leading zeros and long identifiers. |
| Names and addresses | Check encoding, punctuation and international characters. |
| Country and region | Apply an explicit mapping and hold unknown labels for review. |
| Opt-in date and time | Retain timezone information and avoid guessing the order of an ambiguous date. |
| Source and profile URLs | Preserve the original value; review unexpected schemes or malformed links. |
Check a controlled sample across different field types before importing the full selection. Include long identifiers, accented names and missing optional fields in that review. A successful import status does not show whether those values survived correctly.
Review spreadsheet formula risks
OWASP’s CSV injection guidance explains that spreadsheet applications can interpret untrusted cells as formulas. Formula-leading characters and control characters require attention; CSV quoting alone is not a universal defense. Behavior can also change when a file is saved and reopened.
Use an import or export path that treats untrusted values as text, and test the spreadsheet applications your team actually uses. Preserve the source value separately if a safe presentation value is generated. Do not blindly remove leading plus signs from telephone numbers to solve a spreadsheet issue.
Have the responsible technical team review mitigation for the target workflow. Do not instruct users to bypass a security warning or enable external content merely to inspect the contact file.
Reconcile errors without hiding them
- Count the input records with a CSV-aware reader.
- Separate malformed rows and mapping exceptions.
- Apply agreed duplicate handling.
- Screen the eligible records against current suppression data.
- Reconcile the final output with exclusions and review holds.
- Save the import rules, selection version and reviewer.
Explain how overlapping exclusion reasons are counted. If a row is both malformed and suppressed, reporting it twice can make the release totals impossible to reconcile. Keep a primary disposition and, where useful, additional reason flags.
Check the result in the destination tool
Inspect the imported records using the fields the campaign will use, not only a preview of the original CSV. Verify that the destination has not reformatted values or reset suppression status. Use team-controlled test contacts to check automation behavior.
Keep technical import acceptance separate from marketing eligibility. Preserving an address correctly does not prove it exists or that the intended sender has permission to contact it.
Continue with our database hygiene release process and suppression import checks. Use Request a Sample to discuss column structure before purchase.