Handling customer data deletion requests on your website

An email arrives: "Please delete all my data from your records." Most small businesses have no process for this, so it sits unanswered while everyone hopes it goes away. A customer data deletion request is not difficult to handle once you decide in advance who receives it, how you check the person is who they claim to be, and which records you are allowed to keep. This article sets out a workable process. It is general guidance only, not legal advice, and you should confirm the specifics for your business with a qualified lawyer.

Under India's DPDP Act 2023, people whose personal data you hold have rights over it, including erasure in defined circumstances, and businesses are expected to provide a way to exercise those rights. The practical work is mostly organisational.

Give requests somewhere obvious to arrive

If there is no stated channel, requests land wherever the customer happens to be: a sales inbox, an Instagram message, a WhatsApp thread with a delivery agent. Then they get lost, and a request you never saw is still a request you failed to act on.

Publish one route and repeat it in the places people look:

• A named contact in your privacy notice, with an email address you monitor.
• A short form on the website, so requests arrive structured and logged.
• A line in your account settings or footer pointing to the same place.
• A note in your support macros so staff know where to forward anything that arrives elsewhere.

Keep a simple register of every request: date received, who asked, what they asked for, what you did, date closed. If a question is ever raised later, that register is your evidence.

Verify who is asking, proportionately

Deleting an account because someone else asked is worse than not deleting it. Equally, demanding an ID document to close a newsletter subscription collects more sensitive data than the request was about.

Match the check to the risk:

1. Low risk, for example a mailing list: confirm by sending a link to the address on record and acting when they click it.
2. Account holders: ask them to make the request while signed in, or confirm through the registered email or phone with an OTP.
3. Records with financial history: verify against details only the customer would know, such as a recent order number and the delivery PIN code.
4. Someone acting for another person, such as a parent or an authorised representative: ask for evidence of that authority before proceeding.

If the request comes from an address that is not on file, do not simply refuse. Reply to the address on record explaining how to confirm, so a genuine customer who changed email is not stuck.

Find out what you actually hold

Most businesses underestimate this. Before you can delete, you need a map of where personal data lives, and it is worth drawing that map once rather than per request.

• Website database: accounts, orders, addresses, enquiry tables, comments, reviews.
• Email: the enquiry mailbox, sent items, and any forwarded threads.
• Third-party tools: your CRM, invoicing software, email marketing platform, chat or helpdesk tool, SMS and WhatsApp provider.
• Files: uploaded documents, spreadsheets on a shared drive, exported lists someone kept on a laptop.
• Backups and logs: database backups, server access logs, analytics records.
• Offline: printed forms, delivery registers, a paper ledger.

Write this list into a one-page inventory with the retention period for each store. It converts every future request from an investigation into a checklist.

What you delete and what you may keep

Erasure is rarely all-or-nothing. Businesses generally have to retain certain records for legal and accounting reasons, and deleting an invoice because a customer asked would create a different problem. The common shape of the answer is: delete what you hold for marketing and convenience, retain what the law requires, and stop using the retained data for anything else.

• Usually deleted: marketing lists, saved preferences, abandoned cart records, chat transcripts, profile details, uploaded documents whose purpose has ended, and the login account itself.
• Usually retained for a defined period: tax invoices and GST records, payment and refund records, and anything connected to a live dispute or a statutory obligation.
• Often anonymised rather than deleted: order statistics and analytics, where removing the identifying fields keeps the aggregate useful without keeping the person identifiable.

Tell the customer plainly what you kept and why. "We have removed your account and marketing records. We must retain invoices for your three past orders for the period required under tax law, and we will not use them for marketing" is honest and usually accepted. Because retention periods differ by sector and situation, agree yours with your accountant or a qualified lawyer and write them down before the first request arrives.

Backups, vendors and the awkward cases

Two practical problems come up in nearly every request.

Backups. You cannot sensibly rewrite every historical backup. The common approach is to delete from live systems immediately, note that backups age out on a fixed cycle, and ensure that if a backup is ever restored, the deletion is reapplied. Say this clearly in your response rather than claiming total erasure you cannot deliver.

Vendors. Data you sent to an email platform, a CRM or a courier is still your responsibility. Know how to delete a contact in each tool, and check whether the vendor keeps its own backups or exports. Any tool that cannot delete a record on request is a poor choice for personal data.

Also expect requests that are really about something else: someone who wants to stop marketing messages usually wants an unsubscribe, not erasure of their order history. Ask a clarifying question before deleting an account that the customer may still want.

Respond in time, and close the loop

Acknowledge within a couple of days even if the work takes longer, then complete it within a defined window, commonly thirty days, and confirm in writing what was done. Note the outcome in your register.

Set the process up before you need it: name the owner, publish the channel, draft the acknowledgement and completion templates, and build the data inventory. An afternoon of preparation makes every future request a twenty-minute job. If the technical side, such as a deletion routine across your database and connected tools, needs building, our team can scope it during a software development engagement, while the policy questions are best settled with a qualified lawyer.

Frequently asked questions

How quickly must I respond to a deletion request?

There is no single universal deadline across every situation, and expectations depend on the applicable rules. Responding within thirty days, with an acknowledgement much sooner, is a widely used and defensible standard. Confirm what applies to you with a qualified professional.

Can I refuse a deletion request?

You can decline in part where you have a legal obligation or an ongoing legitimate need to retain specific records, such as tax documents or an active dispute. Explain which records, and the reason, rather than refusing outright.

Does deleting an account delete past invoices?

Usually not. Invoices generally have to be retained under accounting and tax rules. The customer's login, contact preferences and profile can go, while the financial record remains in your books.

What if the request comes through WhatsApp or social media?

It still counts. Acknowledge it, then move the conversation to your published channel so the request is recorded and identity can be confirmed properly.