GDPR requests, handled calmly.

Recognize the request

The European Data Protection Board (EDPB) says in its guidelines on the right of access that a request needs no set form and no reason. It’s enough to ask what personal data you have about them. You can’t refuse because they didn’t mention the GDPR or Article 15.

A request counts in any channel you offer, such as your support address or the chat on your site. Whoever reads those has to spot it.

Watch for messages like these:

• “What do you have on file about me?” or “Send me all my data” (access, Article 15)
• “Where did you get my address?” (access, including where the data came from)
• “Delete my account and everything you have on me” (erasure, Article 17)
• “Stop emailing me” (an objection to direct marketing: under Article 21(3) you stop using their data for it)

Note the deadline the day it arrives

Answer without undue delay, and at the latest within one month of receiving the request (Article 12(3)). The month starts when the message reaches you, even on a Friday night when nobody reads it.

The EDPB counts it like this: received on 5 March, due on 5 April. Received on 31 August, due on 30 September, because September has no 31st. If the last day falls on a weekend or public holiday, you have until the next working day.

Where necessary, given the complexity and number of requests, you may extend by two further months. Tell the customer within the first month, with the reason. The EDPB calls this an exception: a lot of work alone doesn’t make a request complex.

Handling a request is free. If a request is manifestly unfounded or excessive, you may charge a reasonable fee or refuse, but you must be able to show why (Article 12(5)). If you don’t act on a request, reply within the month anyway: say why, and that they can complain to a data protection authority or go to court (Article 12(4)).

Check who is asking, lightly

Sending someone’s data to a stranger would be a leak, so check that it’s the customer. Keep it in proportion: ask for more information only when you have reasonable doubts about their identity, and only what you need to confirm it (Article 12(6)).

In chat you can’t see who is typing. Send the data to the address you already have, and be careful with a new address from the chat.

If you need something from them, ask right away. The clock pauses until you have it, provided you asked without undue delay (EDPB guidelines, paragraph 157).

The EDPB calls asking for a copy of an ID disproportionate when you can already confirm who someone is. A lighter check usually does:

• Reply to the email address you already have for them
• Send a confirmation link or code to that address
• Ask them to sign in to their account
• Ask something only the customer would know, such as an order number

Send everything for an access request

An access request covers three things: whether you process their data, a copy of that data, and information about how you use it (Article 15). The first copy is free. If they asked by email, send it in a common electronic format, such as PDF (Article 15(3)).

The copy shows their data as it was when the request came in, including your emails and chats with them. Internal notes about the customer are personal data too.

Messages can hold other people’s data, such as a colleague in cc. Your copy may not harm the rights of others (Article 15(4)), so black out those parts and send the rest.

For a small team, the data usually lives in a handful of places:

• Your inbox and chat: conversations, attachments and internal notes
• Your shop or app: account, orders and invoices
• Your mailing list and marketing tools
• Spreadsheets and exports in shared folders

Erase what you can, keep what you must

You must erase personal data without undue delay when one of the grounds in Article 17(1) applies. For a customer, that’s usually because you no longer need the data for its purpose, because they withdraw their consent, or because they object to its use.

Erase it everywhere: conversations, chat transcripts, notes, attachments, their account and your mailing lists. Check copies in exports and spreadsheets too.

If you passed their data on to others, such as a delivery partner, tell them about the erasure, unless that’s impossible or takes disproportionate effort. If the customer asks who they are, tell them (Article 19).

Article 17(3) lets you keep some data, as far as needed. Most often:

• Data the law requires you to keep, such as invoices for the tax authority (in the Netherlands, in principle seven years)
• Data you need for a legal claim, such as an open dispute about a payment

Keep a record

The GDPR expects you to be able to show that you comply (Article 5(2)). For requests, a short log does that.

Keep the log lean: “confirmed from known email address” says enough. Make one person responsible, so a request never waits between two colleagues.

Write down per request:

• The date it arrived, and the channel
• What they asked for
• How you confirmed who they are
• What you sent, erased or kept, and why
• The date you replied, and any extension with its reason

Write the reply

Use plain language and the channel they used: a request by email gets its answer by email, unless they ask otherwise (Article 12(1) and (3)).

Say what you did, what you kept and why, and what they can do if they disagree. Send personal data with care: as a reply to the confirmed address, or with a download link only they can open.