A customer asks you to delete their data. What should your business do?

An email arrives: “Please delete my account and all my personal data.” Your product has an account closure button. Your support system, billing records and email tool hold information about that customer too.

A deletion request means checking what data you still need and whether you have a lawful basis to keep it. Under the EU General Data Protection Regulation (GDPR), customers can request erasure, for example when data is no longer necessary for its original purpose. Exceptions may require particular records to stay. You might therefore retain an invoice while erasing unnecessary profile data. The GDPR right to erasure sets the conditions and exceptions.

Does the customer need to cite the law or use a form?

Imagine Celina receives that email. She runs an application with paid accounts together with Jacob and Tim. The customer has stopped using the service and wants their data deleted. Tim reads the message and asks: “They haven’t cited any legal provision. Do we have to process this?”

Yes. A clear erasure request does not need a legal citation. Nor must the customer rewrite it in a special form. Celina records the request, its arrival date and the response deadline. If the message had simply said “remove this”, she would need to clarify the scope: deleting a profile photo and erasing all personal data are different requests.

Jacob checks that the request came from the account holder. Where there are reasonable doubts about identity, you can request additional information necessary to confirm it. Keep the check proportionate to the risk. A request sent through an authenticated account does not automatically justify asking for an identity-document scan. The European Data Protection Board’s guide to handling individuals’ rights explains this approach.

Celina’s customer has already stopped using the application. For an active service, establish whether the person wants to end it or remove particular information. Data necessary to perform an ongoing contract may still have a lawful basis, but that does not extend automatically to everything the application has collected.

The account is inactive. Is the request complete?

Tim checks the admin panel and finds that the account is marked inactive. Celina opens the email tool, where the customer is still on the mailing list. She also finds their support conversations. Changing the account status has neither erased the data nor addressed the other tools.

Before confirming completion, they list where the customer’s information is held. Tim checks the application database and attachments, Celina checks correspondence and mailing, and Jacob works through the billing records with accounting. Your list may also include analytics and backups. Assign someone to coordinate the request and identify who can perform and confirm the actions in each system.

What about the invoice and customer history?

Jacob comes back with a question: if they must keep the invoice, should they keep the whole account in case of an audit? An obligation to retain one document does not justify retaining the customer’s entire activity history. Separate the information by its continuing purpose:

• Customer profile. Where its purpose has ended and no other lawful basis remains, erase the data. Marking the account inactive does not do that.
• Marketing address. The request may include withdrawal of consent or an objection to direct marketing. Keeping an invoice does not authorise further advertising.
• Billing and legal-claim records. Assess separately any information that must be kept by law or is necessary to establish, exercise or defend legal claims. Limit access and use to the justified purpose.

Jacob checks retention, meaning how long data is kept for a particular purpose, with the accounting team. They need the applicable rule, the period and how it is calculated. These requirements can depend on national law; the GDPR does not set one universal invoice-retention period. For legal claims, record why the information is necessary and when that need should be reviewed. “It might be useful someday” does not justify keeping an entire customer database.

A refusal needs a specific basis. Withdrawal of consent requires erasure where consent was the basis and no other lawful basis remains. The right also covers other situations, including unlawful processing. The Polish data protection authority’s guidance on erasure, in Polish, explains the conditions and exceptions. Former-customer status alone does not settle the request.

Keep the response deadline visible

Celina checks the response deadline she recorded at the start, so the request does not disappear into exchanges between the team and accounting.

Act without undue delay and inform the customer of the action taken within one month of receiving the request. This is a calendar-month rule, rather than a universal 30-day period. Where necessary because of complexity or the number of requests, the period can be extended by two further months. Tell the individual about the extension and its reasons within the first month. GDPR Article 12(3) and (4) sets these requirements.

An acknowledgement saying “we received your message” does not replace the information about action or a justified refusal, and it does not buy another month. Requests are normally handled free of charge. Charging or refusing because a request is manifestly unfounded or excessive is an exception the business must be able to demonstrate.

Include providers and backups

Tim can erase data in the application, but he does not control every external tool. He checks how to instruct the support-system provider and how it will confirm that the work is done.

A provider handling data on the business’s behalf and under its instructions acts as a processor for that processing. It must assist with individuals’ requests. Check the data processing agreement, or DPA, for the deletion channel and confirmation process. If you hold data on a business customer’s behalf, act under that customer’s instructions and within your authority.

Communicate erasure to recipients to whom the data was disclosed unless this is impossible or involves disproportionate effort. Tell the individual about those recipients if asked. This follows GDPR Article 19. Collaboration with independent partners also needs a clear allocation of responsibility for customer data.

Celina asks about an outage: “If we restore yesterday’s backup, will the data come back?” Tim needs to address that before the request is closed. Provide for erasure from backups or another solution that prevents erased data being restored to use. The French regulator CNIL recommends this in its guidance on designing for individuals’ rights, in French. A backup is not itself a reason to refuse. Replacing a name with a number is also insufficient if the person can still be identified.

Can you automate deletion requests?

With the systems mapped, Tim asks whether the next request will require the same manual work. You can automate much of the administration and execution once the rules are defined. First establish identity checks, what to erase or retain, and which cases need individual review. CNIL describes erasure functions and automatic notifications to processors as possible product features.

For the founders’ application, a process could work like this:

• A message or account request creates a case with its receipt date, deadline and owner. Requests arriving outside the form enter the process too.
• After appropriate verification and a decision on scope, the system sends tasks to the application and providers under approved rules. Records subject to retention requirements follow a separate path.
• A failed deletion or missing provider confirmation raises an alert and blocks confirmation that the request has been fully completed. A task being sent does not count as completion.
• Confirmed results produce a response explaining what was erased, what remains and why.

As a starting approach, I recommend human review of refusals, disputes and unclear cases. A straightforward, properly verified request can follow an established automated path. Routine requests can run without manual clicks, provided the system follows tested rules. An AI model recognising “delete my data” in an email is insufficient grounds for erasing records or inventing a refusal reason.

How Celina closes the request

Celina collects confirmations from Tim, Jacob and the providers. She can then give the customer a concrete answer beyond “your account is closed”. Her response explains what was erased, what remains, why it remains, and how long it will be kept or how that period is determined. A refusal, including a partial refusal, needs reasons and information about the right to complain to a supervisory authority and seek a judicial remedy.

Internally, they keep a concise record of receipt, scope, identity checks, the decision, completed actions and response date. Demonstrating completion does not automatically require copies of everything erased. Set the scope and retention of the request record according to its purpose too.

If a similar exercise reveals that nobody knows what your application’s delete button actually does, our GDPR support for technology companies connects data flows, retention and responsibilities across the team and providers. That gives the business a basis for deciding which actions tools can perform and which cases need individual assessment.

Before the next request arrives, follow the whole process using a test account. Include a failed action in one tool and a backup restore. Check that a “deleted” status represents completed work.

Terms and legal references explained

Data retention

The period for which particular data is kept for a specified purpose. Different information about the same customer may have different deletion dates. The period needs a genuine purpose or legal requirement; storage capacity alone does not justify keeping data.

Data processor

A separate business or other body processing personal data on a controller's behalf and under its instructions. The controller determines the purposes and essential means of processing. A processor assists with individuals' requests under the data processing agreement.