Handling Access and Deletion Requests for Customer Data

Access, erasure and portability

The GDPR gives people several rights over their data. The European Data Protection Board (EDPB) lists them in its SME guide to individuals' rights, and says the controller "is under an obligation to respond to requests" and "must facilitate the exercise of these rights". This guide covers the three most tied to your website and systems:

• Access (Article 15): confirmation of whether you process their data, a copy of it, and information such as the purposes, the recipients, how long you keep it and where it came from.
• Erasure (Article 17, the "right to be forgotten"): deletion of their data in defined situations.
• Portability (Article 20): the data they gave you, in a "structured, commonly used and machine-readable format".

Requests rarely arrive labelled as such: a message to your support inbox saying "send me everything you have on me" is asking for access under Article 15. Make sure whoever reads your inboxes and social messages knows to pass these on. Our guide to privacy policy and cookie basics covers telling people about their rights in the first place.

Deadlines, fees and refusals

The EDPB guide says to "always answer a data subject request within one month". If a request is complex and you need more time, you "may extend the time limit by two further months, provided that the data subject is informed within one month after receiving the request". If you will not do what was asked, you must tell the person within one month why, and that they can complain to a supervisory authority.

In the UK, the Data (Use and Access) Act 2025 added Article 12A to the UK GDPR. The one month runs from the latest of: when you receive the request, when you receive any identity information you asked for, or when any permitted fee is paid. You can extend by two further months for complex or numerous requests, with notice and reasons inside the first month. For an access request, if you reasonably need the person to clarify what they are asking for, for example because you hold a large amount of information about them, the time until they reply does not count.

Responses are normally free. Under Article 12, where requests are "manifestly unfounded or excessive, in particular because of their repetitive character", you may charge a reasonable fee or refuse, but you carry the burden of showing that. For access requests, you may charge a reasonable fee for further copies.

Checking who is asking

Sending someone's data to the wrong person could itself be a personal data breach, so identity matters. Article 12 lets you ask for "additional information necessary to confirm the identity" where you have reasonable doubts. The EDPB gives two examples of when doubt is reasonable: a request "made with another email address than the one usually used by your customer", or one "made outside of an authenticated customer account".

Ask only for what you need. If the person writes from the email address on their account, or makes the request while signed in to your portal, that may be enough. Do not ask for a passport copy by default when you only hold a name and an email address. Record what you checked.

Answering an access request

Article 15 says you must provide "a copy of the personal data undergoing processing", plus the supporting information listed in the article. Where the request arrives electronically, the information should be given "in a commonly used electronic form" unless the person asks otherwise. The copy must not "adversely affect the rights and freedoms of others": the EDPB mentions files holding information about more than one person, and trade secrets. Remove other people's data before you send.

In the UK, a new paragraph 1A of Article 15 says the person is entitled to what you can provide "based on a reasonable and proportionate search". That is still a real search: the website database, the CRM, the email inboxes of staff who dealt with the customer, your newsletter tool, support tickets, and spreadsheets.

Answering a deletion request

Erasure is not absolute. The EDPB lists when people can ask for it, including when the data is "no longer necessary" for its purpose, when they withdraw consent and there is no other legal basis, when they successfully object, and when the processing is unlawful. You can refuse in a limited number of cases, such as freedom of expression, legal claims, or "compliance with a legal obligation". An example of the last is invoices you must keep under tax law.

When you do delete, delete everywhere the data is used, not just in one system. If you passed the data to other organisations, the EDPB says you "must inform these recipients" of the erasure request "unless this proves impossible or would require disproportionate efforts". Tell the person what you deleted, and what you kept and why.

Data portability and export formats

Portability only applies when three conditions are met together: the processing is based on consent or a contract, it is automated, and the person provided the data, which the EDPB says includes data observed from their behaviour, such as from connected devices. It does not cover data you create yourself from that information.

The format has to be reusable. The EDPB says "XML, JSON and CSV are common formats that meet this criterion", that metadata must be included, and that "a PDF format is not sufficient". Where it is technically feasible, the person can ask you to send the data directly to another organisation.

Building it into your systems

Requests are easy to answer when the systems were designed for them, and slow when they were not. The EDPB's checklist starts with "Be prepared" and "Know your data flows": keep a record of what data you process so you can "locate and retrieve information efficiently". In practice:

• Map where customer data lives. Website forms, the app database, the CRM, email marketing, payments, support and analytics. Our guide to connecting your website to a CRM covers how data flows between them.
• Use one customer identifier. If every system can be searched by the same email address or customer ID, a search takes minutes, not days.
• Build export and delete functions. A web app or portal can include an admin action that exports one customer's records as JSON or CSV, and one that deletes or anonymises them while keeping what law requires. See our guide to planning a customer portal.
• Ask your suppliers. The EDPB says processors "must assist the data controller". Check how each service you use exports or deletes one person's data.

A simple procedure

• Log the request with the date received.
• Check identity if there is reasonable doubt; note the new start date if the UK clock applies.
• Clarify the request if needed, and decide whether an extension is justified.
• Search every system on your data map; collect, review and redact.
• Respond in a commonly used electronic form, with the information Article 15 requires, or confirm the deletion.
• Tell recipients about erasures, and keep a record of the request and your reasoning, as the EDPB recommends.

Frequently asked questions

How long do we have to answer a request?

One month. Under the GDPR you can extend by two further months for complex requests if you tell the person within the first month. Under the UK GDPR, Article 12A sets the same one month and two-month extension, and the month starts from the latest of receiving the request, any identity information you asked for, or any permitted fee.

Can we charge for a copy of someone's data?

Normally no. Article 12 makes responses free of charge. You may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and you must be able to show that. For access requests, a reasonable fee is allowed for further copies.

Do we have to delete data we need for accounting?

No. The right to erasure does not apply to the extent that processing is necessary to comply with a legal obligation. Delete what you can, keep what the law requires, and tell the person what you kept and why.

Is a PDF export good enough?

For an access request, a commonly used electronic form is required where the request was made electronically, unless the person asks otherwise. For a portability request, the EDPB says formats such as XML, JSON and CSV are suitable and a PDF is not sufficient.

Planning a portal or web app that holds customer data? See our web app development service and all our services, or email [email protected].