Someone asked me to delete their data. What do I have to do?

The longer version

Requests can reach ordinary inboxes as well as designated forms. Staff need a way to recognize them and send them to the responsible person.

Review the systems holding the information and any legal reason to retain it. Approved deletion and processor instructions should be recorded, including how backups are handled under the applicable procedure.

The deadlines depend on the law. Under the CCPA, confirm receipt within 10 business days and respond within 45 calendar days, extendable by 45 more with notice. Under the GDPR, respond within one month, extendable by two months for complex or numerous requests if you say so within the first month.

Next steps

1. Record receipt and assign responsibility.
2. Identify the applicable right, required verification and response target.
3. Review the relevant systems and retention exceptions.
4. Carry out the approved action and record the outcome.
5. Send the required response, including reasons or extension notices where applicable.

Related guides

• Data requests
• CCPA and CPRA
• GDPR