Delete a customer’s data request: what to do and your deadline

TL;DR — When a customer asks you to delete their data, first verify who is asking, then find every place their personal data (information that identifies them) is stored, delete or anonymize it, stop future processing, and record what you did. In most cases, your working deadline is 1 month from receiving the request, unless a law or contract requires you to keep specific records longer. Reading time: ~5 min

Goal

When you are done, the customer’s personal data has been deleted or irreversibly anonymized from your live systems, any required exceptions are documented, any third parties holding that data have been told to delete it too, and you have a dated record showing when the request was received, what was deleted, what was retained, and why.

Prerequisites

• Access to your app admin area or customer dashboard with permission to view and delete customer records
• Access to the systems where customer data may exist: app database, CRM (customer management system), support inbox, billing system, file storage, analytics, and backups policy documentation
• Your privacy policy, data processing agreement, or internal retention policy
• The customer identifier at hand: email address, account ID, full name, order number, or ticket number
• A place to record actions, such as your ticketing system or an internal document
• If you use a database directly: database access and the correct client version
• If you use PostgreSQL, a client that can run psql --version
• If you use MySQL, a client that can run mysql --version

Steps

Step 1: Log the request date and calculate the deadline

In your ticketing system or internal tracker, create a case with these exact fields and values:

{
  "request_type": "erasure request",
  "received_at": "2026-10-30",
  "received_via": "email",
  "customer_identifier": "customer@example.com",
  "deadline": "2026-11-30",
  "status": "identity check pending"
}

What you should see when this succeeds: a dated case exists with a clear deadline exactly 1 calendar month after receipt.

Step 2: Verify the requester’s identity

Use the email address already associated with the customer account. Send this exact message from your support system or mailbox:

Subject: Please confirm your data deletion request

We received a request to delete personal data for the account linked to this email address.

To continue, reply from the same email address and include:
- Your full name
- The account email address
- The words: "I confirm this deletion request"

If you no longer have access to this email address, tell us and we will provide an alternative verification method.

What you should see when this succeeds: you receive a reply from the same email address, or you complete your documented alternative verification process.

Step 3: Put the account on hold so no new data is added

In your app or provider dashboard, open the customer record and use the account status control.

Exact menu path to look for in your provider’s dashboard: Customers/Users → Search customer@example.com → Account Status → Suspend or Disable

If your system has a marketing tool, also stop future messages:

Exact menu path to look for: Audience/Contacts → Search customer@example.com → Unsubscribe or Suppress

What you should see when this succeeds: the account shows Suspended, Disabled, or equivalent, and the contact shows Unsubscribed or Suppressed.

⚠️ Deleting before you identify legal exceptions can destroy records you are required to keep, such as invoices or tax records. Do Step 4 before you permanently delete anything.

Step 4: List what must be deleted and what must be retained

Create a simple table in your case record and fill it with literal values like these:

Use these retention rules in plain language:

• Delete profile data, messages, uploaded files, device data, marketing data, and support notes unless you have a legal reason to keep them.
• Retain invoices, tax records, and fraud-prevention records only if a law or contract requires retention.
• For anything retained, replace the result with: retained — legal obligation.

What you should see when this succeeds: every system has a named action, and any exception has a written reason.

Step 5: Delete or anonymize the data in each system

Use the dashboard path first. If your system has no delete button, use the database command that matches your database.

Dashboard path to look for in your provider’s dashboard: Customers/Users → Search customer@example.com → Delete or Remove personal data

If you use PostgreSQL, run a transaction (a grouped change you can commit together) like this after replacing the values:

psql "$DATABASE_URL"

BEGIN;
SELECT id FROM users WHERE email = 'customer@example.com';
UPDATE orders SET email = NULL, name = 'deleted user' WHERE user_id = 12345;
DELETE FROM sessions WHERE user_id = 12345;
DELETE FROM support_notes WHERE user_id = 12345;
DELETE FROM uploaded_files WHERE user_id = 12345;
DELETE FROM users WHERE id = 12345;
COMMIT;

If you use MySQL:

mysql -u USER -p DATABASE_NAME

START TRANSACTION;
SELECT id FROM users WHERE email = 'customer@example.com';
UPDATE orders SET email = NULL, name = 'deleted user' WHERE user_id = 12345;
DELETE FROM sessions WHERE user_id = 12345;
DELETE FROM support_notes WHERE user_id = 12345;
DELETE FROM uploaded_files WHERE user_id = 12345;
DELETE FROM users WHERE id = 12345;
COMMIT;

What you should see when this succeeds: the user record no longer appears in the app, and related personal fields are blank, deleted, or replaced with non-identifying values.

Step 6: Tell third parties to delete the same data

For each external service that received the customer’s data, open its dashboard and submit a deletion request.

Exact menu path to look for in your provider’s dashboard: Contacts/People → Search customer@example.com → Delete, Privacy → Data requests → New deletion request, or Users → customer@example.com → Delete

Record each third party in your case like this:

[
  {
    "provider": "email marketing provider",
    "identifier": "customer@example.com",
    "action": "deletion requested in provider dashboard",
    "requested_at": "2026-10-30"
  },
  {
    "provider": "help desk provider",
    "identifier": "customer@example.com",
    "action": "user deleted in provider dashboard",
    "requested_at": "2026-10-30"
  }
]

What you should see when this succeeds: each provider shows the contact as deleted, queued for deletion, or confirms the request.

Step 7: Handle backups correctly

Do not restore a backup just to delete one person’s data. Instead, record your backup expiry date and your restore rule.

Add this exact note to the case, replacing the date:

Customer data may remain in encrypted backups until backup rotation expires on 2026-11-29. We will not restore backups for normal operations in a way that reintroduces deleted data. If a backup is restored, the deletion will be re-applied immediately.

What you should see when this succeeds: the case contains a backup note with an expiry date and a re-delete rule.

Step 8: Send the completion response

Send this exact message to the customer after deletion is complete:

Subject: Your data deletion request is complete

We have completed your request to delete your personal data.

Deletion date: 2026-10-30
Systems updated: application account, support records, file storage, and connected providers where applicable
Retained items: invoices and tax records only where we are legally required to keep them

If you believe we have missed a system or record, reply to this email and include any account details that will help us locate it.

What you should see when this succeeds: the email is sent, and the case status is updated to completed.

Verify it works

Run these checks end to end.

In your app or admin area:

• Search for the customer by email and account ID.
• Expected result: no active account appears.

If you have database access, run the query that matches your database.

PostgreSQL:

psql "$DATABASE_URL" -c "SELECT id, email FROM users WHERE email = 'customer@example.com';"

MySQL:

mysql -u USER -p -e "SELECT id, email FROM users WHERE email = 'customer@example.com';" DATABASE_NAME

Expected result: zero rows returned.

Also verify:

• The contact is unsubscribed or deleted in your email tool
• Uploaded files for that account no longer open in storage
• The case record shows completed, with deletion date, retained items, and backup note

[Customer Request]
      |
      | 1. verify identity
      v
[Case Record] ---- 2. list systems ----> [Deletion Plan]
      |
      | 3. delete/anonymize
      v
[App + Providers] ---- 4. confirm ----> [Completion Email]

Common pitfalls

Deleting the account before checking legal retention

Mistake: You permanently delete billing or tax records with the rest of the profile.

Symptom: Finance cannot produce invoices or required records later.

Fix: Restore only the required financial record from your source system if possible, then keep invoices and tax records marked as retained — legal obligation in future cases.

Accepting a deletion request from an unverified email address

Mistake: You act on a request sent from a different address than the one on the account.

Symptom: The real customer later says their account was deleted without permission.

Fix: Pause the case and send the identity confirmation message to the email already stored on the account.

Forgetting third-party tools

Mistake: You delete the user in the app but leave them in your CRM, help desk, or mailing list.

Symptom: The customer still receives emails or support staff can still see their profile.

Fix: Use the Step 4 system table and do not close the case until every listed provider shows deleted, suppressed, or retained with a reason.

Confusing deletion with backup erasure

Mistake: You try to edit or restore backups to remove one user.

Symptom: Extra risk, wasted time, or accidental reintroduction of deleted data.

Fix: Leave backups alone, record the backup rotation date, and document the rule to re-apply deletion after any restore.

Hard-deleting rows that other records still reference

Mistake: You delete the main user row first while orders, tickets, or files still point to it.

Symptom: Database errors, broken admin pages, or failed deletes.

Fix: First delete dependent rows or replace personal fields with neutral values like NULL or deleted user, then delete the main user record.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.