How to Handle Customer Data Requests

Sooner or later, a customer will email to ask what data you hold about them, or to ask you to delete it. For a small business, that request can feel daunting the first time. With a simple process, a clear deadline and a few templates, you can handle customer data requests calmly, correctly and on time.

Wooden letter blocks arranged on a surface to spell out the word data in capital letters — Customer data is built one block at a time, and customers have a right to see it.

Key takeaways

Under GDPR and UK GDPR, you generally have one month to respond to a subject access request, extendable in some cases. Under California's CCPA, businesses generally have 45 days.
Requests can arrive by any channel, including email, phone, social media or in person, so train everyone to recognize one.
Verify the person's identity in a proportionate way before you share or delete anything.
A data map, a request log and a few reply templates turn a stressful task into a routine one.

Data protection laws give people rights over the personal information businesses hold about them. The most common request is to see that data, often called a subject access request or a "right to know" request. Others ask you to correct, delete or stop using their data, or to send it to them in a portable format.

Most of these requests are perfectly reasonable. A customer might want to know why they keep getting emails, check what is on file before closing an account, or simply be curious. Occasionally a request is part of a wider dispute, which makes accuracy and timing even more important.

A quick note: this article is general information, not legal advice. Which laws apply to you depends on where you and your customers are, the size of your business and the data you handle. Check the guidance from your data protection regulator, such as the Information Commissioner's Office in the UK, and talk to a qualified privacy professional or lawyer for your situation.

Which rules might apply to you

You do not need to memorize the law, but you do need to know which framework you are working under, because it sets your deadline and the rights people have.

EU GDPR. Applies to businesses in the EU, and to businesses outside the EU that offer goods or services to people in the EU or monitor their behavior.
UK GDPR. The UK's version, which sits alongside the Data Protection Act 2018. Similar rights and timelines apply.
CCPA in California. Applies to businesses that meet certain thresholds and handle personal information of California residents. Other US states have their own privacy laws with different rules and thresholds.

Thresholds and details change, and new US state laws keep arriving, so check the current rules for the places your customers live. Even if no law strictly applies to you, handling requests promptly and politely builds trust.

1 month / 45 days The general response time for a subject access request under GDPR and UK GDPR, and for a consumer request under California's CCPA. Extensions are possible in some cases. GDPR, UK GDPR and CCPA

Know where your customer data lives

You cannot answer a request quickly if you do not know where to look. A simple data map is the single most useful thing you can prepare in advance.

List every place you store personal information about customers. For a typical small business, that includes:

Your email inbox and any shared inbox
Your email marketing platform
Your online store, booking system or point of sale
Your invoicing or accounting software
Spreadsheets, shared drives and notes apps
Form builders such as Google Forms, Typeform, Jotform, Microsoft Forms or Tally
Live chat and support tools
Social media messages and comments
Paper files, appointment books and signed forms
Phone call recordings or voicemail, if you keep them

For each one, note what kind of data it holds, who can access it and how long you keep it. This map also helps with your privacy notice and with spotting data you no longer need.

Pro tip

Keep your data map in the same place as your request log and reply templates. When a request arrives, everything you need is in one folder, and anyone covering for you can follow the same steps.

Step by step: handling a request

Here is a simple process you can use for most customer data requests. Adapt it to the laws that apply to you.

Recognize the request. A request does not need to use legal words. "Can you tell me what info you have on me?" or "Please delete my account" counts. Log the date you received it, because your deadline usually starts then.
Acknowledge it. Reply promptly to confirm you have received it and tell the person when to expect a full response.
Verify identity. Make sure the person is who they say they are before sharing or deleting anything. Ask only for what you need. Often, a reply from the email address on file or a detail only the customer would know is enough.
Clarify if needed. If the request is unclear, ask what they are looking for. Check the official guidance on how clarification affects your deadline.
Search your systems. Use your data map to search every location. Note what you find and where.
Review before you send. Remove information about other people, such as other customers or staff, unless you have a clear basis to share it. Check whether any exemptions apply, and get advice if you are unsure.
Respond in a clear format. Send the data in a format that is easy to read, along with the supporting information the law requires, such as why you use the data and how long you keep it.
Record what you did. Update your log with the date, what you sent or deleted and any reasons for refusing part of the request.

Deletion requests

When someone asks you to delete their data, check whether you must keep any of it for another reason, such as tax records or an open dispute. Delete what you can, tell the person what you deleted and explain what you kept and why. Remember backups and connected tools, such as your email platform.

Correction and opt-out requests

Correct inaccurate data promptly and confirm it. If someone asks you to stop sending marketing, stop. Keep their email address on a suppression list so they are not accidentally added back.

Common mistake

Sending a full data export to the email address in the request without checking it matches the one on file. Fraudsters sometimes impersonate customers to get their data. Verify identity in a proportionate way first, and never send personal data to a new address without confirming it.

The word data shown among rows of binary digits, ones and zeros, on a dark background — Behind every request is data spread across your tools, so a map makes the search faster.

A data request log template

Keep a simple log of every request. It helps you meet deadlines and shows a regulator that you take requests seriously. The names, dates and details below are made-up examples for illustration only.

Request ID	Received	Type	Law that applies	Identity verified	Due date	Status
DR-001	3 June	Access	UK GDPR	Yes, reply from email on file	3 July	Sent 20 June
DR-002	7 June	Deletion	EU GDPR	Yes, order number confirmed	7 July	Deleted, invoices kept for tax
DR-003	12 June	Right to know	CCPA	Pending	Check current rules	Awaiting verification

Set a calendar reminder for each due date, with an earlier internal reminder so you have time to review your response before sending it.

Reply templates you can copy

Having wording ready saves time and keeps your tone consistent. Adjust these to fit your business and the laws that apply.

Acknowledgment

Hi [Name], thank you for your request about the personal data we hold about you. We received it on [date] and will respond by [date]. To protect your information, please confirm [verification detail]. If you have any questions in the meantime, just reply to this email. Best wishes, [Your name], [Business name]

Response to an access request

Hi [Name], as requested, attached is a copy of the personal data we hold about you. We use this information to [purposes], we keep it for [period] and we share it with [types of recipients]. You also have the right to ask us to correct or delete it, and to complain to [regulator]. Let us know if anything is unclear. Best wishes, [Your name]

Deletion confirmation

Hi [Name], we have deleted your personal data from [systems]. We need to keep [specific records] for [reason], and we will delete them after [period]. You will no longer receive marketing emails from us. Best wishes, [Your name]

Hypothetical example

Lena runs a small online candle shop in Manchester. A customer emailed asking "what data do you have on me?" Lena logged the request, replied the same day to acknowledge it and confirmed the request came from the email address on file. Using her data map, she checked her shop platform, email marketing tool, inbox and a spreadsheet of wholesale enquiries. She sent a clear summary and a data export within two weeks, well inside the one-month window. The customer thanked her and stayed subscribed.

Making requests easier to handle

A little setup now means less scrambling later. These small changes make a real difference.

Publish a clear contact route. Put a privacy contact email in your privacy notice and on your website. People can still contact you any other way, but most will use this.
Use a shared inbox. Tools such as Front, Help Scout or Missive let you tag privacy requests, assign them and see deadlines. Check current features, pricing and privacy policies.
Collect less data. The less you collect and keep, the less you have to search and the lower your risk.
Set retention periods. Decide how long you keep each type of data and delete it on schedule.
Check your suppliers. Know how to export and delete a customer's data in each tool you use.
Train your team. Anyone who talks to customers should know what a data request looks like and where to send it.

Your customer data request checklist

Confirm which privacy laws apply to your customers
Build a data map of every place customer data lives
Set up a request log with due dates and reminders
Save acknowledgment, response and deletion templates
Decide how you will verify identity proportionately
Learn how to export and delete data in each tool
Add a privacy contact to your website and privacy notice
Train staff to recognize and pass on requests
Review your retention periods and delete data you no longer need

Frequently asked questions

Can I charge a fee for a subject access request?

Under GDPR and UK GDPR, you usually cannot charge for a first request, although there are limited exceptions for requests that are clearly unfounded, excessive or repeated. Check the current guidance from your regulator before charging anything.

Does a request have to be in writing?

Not necessarily. Under GDPR and UK GDPR, a request can be made verbally or in writing, including through social media. Write down what was asked and when, and confirm it back to the person.

What if I cannot find any data about the person?

Tell them clearly that you searched and did not find any personal data about them. Keep a record of where you looked in case they follow up.

Can I refuse a request?

In some situations, yes, for example if a request is manifestly unfounded or excessive, or an exemption applies. The rules are specific, so get advice from a privacy professional before refusing, and explain your reasons to the person.

The bottom line

Customer data requests are a normal part of running a business today. Know which rules apply, map where your data lives, verify identity, log every request and reply within the deadline using clear templates.

Set up your data map and request log this week, before the first request arrives. When it does, you will be able to answer with confidence, and your customers will see a business that respects their information.