How do I respond when a customer asks me to delete all their personal information?

A request to “delete all my personal information” feels straightforward, but it rarely is. Your job is to honor the person’s privacy interest while staying inside the law and your organization’s records obligations. Slow down and work through a structured process before deleting anything.

Start by Confirming the Request

First, verify the requester’s identity so you do not disclose or destroy data based on an impersonated request. Then clarify scope: do they mean a specific account, a single dataset, or every system that holds their information? People often want one thing fixed, not a wholesale purge. Document the request, the date received, and how you handled it.

Check Whether You Are Even Allowed to Delete

Deletion is not automatic. Before acting, confirm that no competing obligation requires you to keep the data:

• Records retention schedules. If the information is part of a record under an approved retention period, you generally cannot destroy it early.
• Legal holds and litigation. Active or reasonably anticipated litigation, audits, or investigations override deletion requests until the hold lifts.
• Statutory or contractual duties. Tax, employment, financial, and regulatory rules often mandate keeping certain data for set periods.

If any of these apply, you may need to deny or defer the deletion and explain why.

Know Which Privacy Rules Apply

Different frameworks grant different rights. A consumer privacy law, a sector regulation, or an internal policy may each define what “personal information” covers and when erasure is required versus optional. Apply the rule that actually governs the data in question rather than assuming a universal “right to be forgotten.” When unsure, route the request to your privacy officer or legal counsel.

Respond and Record

Give the requester a clear, timely answer: what you will delete, what you must retain and why, and the timeframe. Where you cannot delete, consider alternatives such as restricting use, de-identifying, or anonymizing the data. Finally, log the outcome so you can demonstrate accountability if asked later.

Building these steps into a repeatable workflow keeps you compliant and defensible. For more on managing sensitive data responsibly, see the privacy and PII topic hub.