Why a process helps
Sooner or later someone will write to ask what information you hold about them, to correct it, or to have it deleted. Many privacy laws give people rights of this kind, often called data subject requests, though which rights exist, who can use them, and the deadlines involved differ widely. This article describes a simple internal routine. It is general information, not legal advice, so check the rules that apply to your business and audience.
The main point is to decide in advance who does what. A request that lands in a general inbox and sits there for weeks is the usual way small businesses get into difficulty.
Types of request you may see
Names vary by country, but common requests include:
- Access. The person wants to know whether you hold their data and to see a copy.
- Correction. They want inaccurate details fixed.
- Deletion. They want their data erased, sometimes called erasure or “the right to be forgotten”.
- Objection or opt-out. They want you to stop using their data for a purpose such as direct marketing.
- Portability. They want their data in a reusable format.
Not every right applies everywhere, and rights are often subject to exceptions. For instance, you may have to keep certain records for tax or legal reasons even after a deletion request. Do not assume you must delete everything, or that you may refuse without a reason; check the details.
A simple five-step routine
1. Receive
Give people an obvious way to ask, such as a contact address in your privacy notice. Still, requests can arrive through any channel: social media, a support form, a reply to a marketing email. Tell everyone who handles those channels to forward anything that looks like a data request to one named person or shared mailbox.
Log each request the day it arrives: date received, who asked, what they asked for and how it came in. The date matters because many laws set a time limit that runs from receipt.
2. Verify
Before releasing or deleting anything, be reasonably sure the requester is who they say they are. Sending someone’s data to the wrong person is a privacy incident of its own. Often it is enough to reply to the email address already on file. Avoid demanding more information than you need, which would contradict the principle of data minimisation. If an agent writes on someone’s behalf, ask how they are authorised.
3. Find the data
List where personal data about customers may live:
- the customer relationship management system or customer spreadsheet
- your email marketing tool and any SMS service
- the website’s order or account system
- analytics, advertising audiences and forms
- support inbox, shared drives and exports
- backups and tools used by contractors
This is easier if you already know your systems. An inventory made now will save time later. Search for the person under every email address and phone number they may have used.
4. Decide and act
For an access request, collect what you found and send it in a clear, readable form through a secure method. For a correction, update every location and note the change. For a deletion, remove the data where you are able and allowed to, and keep a minimal suppression record, for example the email address on a do-not-contact list, so you do not accidentally message them again. Explain that to the person if it applies.
If you cannot do part of what was asked, because of a legal duty to keep records or a technical limit such as backups that clear on a schedule, say so honestly and explain when the data will be removed or why it is retained. Check the rules before refusing any request.
If you use third-party tools that hold the data for you, check their current documentation and your agreements for how they support these requests.
5. Respond and record
Reply within the time your local rules require. If you need longer where the law allows it, tell the person early rather than going silent. Keep a short record of what was asked, what you did and when; avoid storing more personal detail in that record than necessary.
Preparing ahead
A few low-effort habits make requests much easier:
- Name one person as the owner of the process and one backup.
- Keep a template reply for acknowledging receipt, written in plain language.
- Keep a current list of systems that hold personal data.
- Use consistent identifiers, such as one email per contact, so records can be found quickly.
- Periodically delete data you no longer need, which shrinks the work of any future request.
- Make sure your privacy notice states how to make a request.
Related requests that are easy to miss
Marketing opt-outs are not always labelled as data requests. A reply saying “stop emailing me” should be honoured through your normal unsubscribe process, quickly and across all tools. A message such as “remove me from everything” may be a deletion request and an unsubscribe at once, so treat it with both in mind.
Sensitive situations
Take extra care if a request relates to a child, comes from someone in a legal dispute with you, or involves other people’s data mixed into the records, such as a shared account or a message thread with several participants. In these cases, consider getting qualified advice before responding.
Keep it calm and courteous
Most requests are straightforward, and people are often simply curious or tidying their inboxes. A polite, prompt and clear reply protects the relationship as well as meeting your obligations. Because laws and exceptions vary, treat this routine as a starting framework, and adapt it once you know the rules for your own situation.