An email arrives: “Please delete all my data.” It might come from a former customer, someone who filled in a contact form once, or a person who has had enough of your newsletter. It is polite, short and slightly alarming, because you are not sure where “all my data” actually is, or whether you are allowed to delete all of it.
This post is a practical routine for handling that request on a WordPress website. It covers checking who is asking, finding the data, what you may need to keep, and the tools WordPress already gives you. It is general information, not legal advice. Your obligations depend on where you and your customers are, so check the details with a lawyer.
Why these requests are becoming common
People have more rights over their data than they used to. In India, the Digital Personal Data Protection Act, 2023 gives individuals rights that include correction and erasure of their personal data, and it expects businesses to erase data once consent is withdrawn or the purpose is no longer being served, unless keeping it is required by law. The EU and UK GDPR have a similar right to erasure, and several US states have their own versions. Our overview of what the DPDP Act means for a business website gives the wider context.
The rules under these laws can set timelines for responding. Do not let a request sit in your inbox. Acknowledge it promptly, and check the current requirements that apply to you.
Step 1: Check who is asking
Before you delete anything, make reasonably sure the request comes from the person the data is about. Deleting someone’s account because a stranger asked is a problem. So is sending a copy of someone’s data to the wrong person.
Keep the check proportionate:
- If the request comes from the email address you already hold for that person, that is usually a good start.
- If it comes from a different address, reply to the address on record and ask them to confirm.
- For a customer, you can ask for an order number or another detail only they would know.
- Do not ask for more identity documents than you need. Collecting a copy of an ID card to delete a newsletter address creates more personal data, not less.
Write down what you did to verify. A short note is enough.
Step 2: Find where the data lives
This is the slow part. On a typical small business WordPress site, one person’s details can sit in many places.
On the website
- WordPress user accounts. Customers, members and subscribers often have an account with a name, email and profile fields.
- WooCommerce orders. Billing and shipping names, addresses, phone numbers and emails are stored on each order, even for guest checkouts.
- Form entries. Many form plugins save submissions in the database. Check the entries screen of every form plugin you use, including old ones.
- Comments and reviews. These store a name, email and IP address.
- Booking, membership and chat plugins. Each may keep its own records in its own tables.
Off the website
- Your email inbox, where form notifications and replies pile up.
- Email marketing tools such as your newsletter service.
- A CRM or spreadsheet where enquiries are copied.
- WhatsApp, if you chatted with the person there.
- Accounting software and your payment gateway, which hold invoice and transaction records.
- Backups, which contain a copy of everything above as it was on the day they were taken.
If you have never mapped this before, do it once for your whole site rather than for each request. The list becomes your checklist for every request after this one.
Step 3: Decide what you must keep
A deletion request does not always mean deleting everything. Data protection laws generally allow, and other laws often require, keeping some records. The common example is invoices and order records. Tax and accounting rules in India and elsewhere require businesses to keep financial records for a set period, and erasing an invoice because a customer asked could put you on the wrong side of those rules.
The usual approach is to separate the two:
- Delete what you hold only for convenience or marketing: newsletter subscription, form entries, account profile, comments, chat history.
- Keep what the law requires, such as invoice records, and only for as long as required.
- Restrict what you keep, so it is not used for marketing or anything else.
Tell the person plainly what you deleted and what you kept, and why. “We have deleted your account, enquiry and mailing list subscription. We are required to keep invoice records for tax purposes, and they are not used for anything else” is an honest answer. How long you keep each type of record is a question for your accountant or lawyer, and the answer belongs in your privacy policy. Our post on keeping a website privacy policy current in India covers that review.
One special case: email marketing. Many newsletter tools keep an unsubscribed address on a suppression list so it is never mailed or re-imported again. Deleting the address completely can mean it gets added back by mistake later from an old spreadsheet. Your tool’s documentation will explain the options.
Step 4: Use the tools WordPress already has
WordPress includes a built-in privacy tool for exactly this. In the dashboard, go to Tools > Erase Personal Data.
- Enter the person’s username or email address.
- Leave the confirmation email option on if you want WordPress to email them a link to confirm the request. This is a useful extra verification step.
- Once the request is confirmed, use the option on the request to erase the personal data.
What gets erased depends on which “erasers” are registered. WordPress core handles personal data in comments. WooCommerce adds its own erasers for customer data, and in its privacy settings you can choose whether order data is removed on request. Some form and membership plugins also hook into the tool. Others do not, so check each plugin’s entries separately.
Two things the tool does not do on its own. It does not delete the WordPress user account, which you remove from the Users screen once the data is handled. And it does not touch anything outside the website.
The neighbouring Tools > Export Personal Data screen works the same way for access requests, when someone asks what you hold about them.
Step 5: Backups and the record of the request
Editing old backups to remove one person is usually impractical. A common approach is to let backups expire on their normal schedule and make sure that if you ever restore one, you re-apply the deletions made since. That only works if you know your backup retention period. Our guide to backing up a WordPress website explains how backups are typically stored and rotated.
Keep a short log of each request: when it arrived, how you verified it, what you deleted, what you kept and why, and when you replied. Keep it minimal. The log should not become a new copy of the data you just removed.
Make the next request easier
The best time to handle deletion requests is before they arrive. Collect fewer fields, set form plugins to delete old entries, and keep marketing consent separate so you know who signed up for what. Our guide to consent on website forms covers that side.
We do not offer a compliance package, and we are not lawyers. We can help with the technical part: mapping where personal data sits on your WordPress or WooCommerce site, setting up the erase and retention options, and cleaning out old entries safely. If that would help, tell us what you need.
Next in this series: WCAG Explained: The Standard Behind Accessibility Checklists
