Motta Industries Blog

Sooner or later, someone will probably ask your business what personal information you hold about them, or ask you to delete it. The request might arrive through a web form, a support email, a phone call or a message to a staff member’s personal inbox. It might come from a long-time customer, a former employee, a person who once filled out a contact form or someone acting on their behalf.

How you handle that moment says a lot about your business. A clear, respectful process builds trust. A confusing one, with demands for unnecessary documents and weeks of silence, creates frustration and, under a growing number of privacy laws, legal risk. This guide explains how to build a practical workflow for privacy requests, from intake and verification through deletion, records and training.

This article is general information, not legal advice. Privacy laws differ by location, business size and industry, so confirm your specific obligations with a qualified attorney.

Why a defined workflow matters

Privacy requests are easy to mishandle when nobody owns them. One person forwards an email and assumes someone else will reply. Another deletes a customer from the mailing list but not from the order system. A third asks for a copy of a passport to confirm an unsubscribe request.

Regulators have noticed these patterns. In March 2025, the California Privacy Protection Agency announced a $632,500 fine against Honda to resolve allegations that included requiring consumers to verify themselves and provide excessive personal information to exercise certain privacy rights, using a privacy tool that did not offer choices in a symmetrical way and making it difficult for authorized agents to act for consumers. To resolve the matter, the company agreed to implement a new and simpler process, train its employees and consult a user experience designer to evaluate its methods for submitting privacy requests.

The remedy is instructive for almost any business: a simpler process, trained staff and a request experience designed for the people using it.

Common types of requests

Depending on where you operate and who your customers are, you may receive several kinds of requests:

• Access. A person wants to know what information you hold and how you use it, and may want a copy.
• Deletion. A person wants their information erased.
• Correction. A person wants inaccurate information fixed.
• Opt-out. A person wants you to stop selling or sharing their information, or to stop certain uses such as targeted advertising.
• Marketing removal. A person wants to stop receiving emails, texts or calls.

Even when no law requires a response, handling these requests respectfully is good practice, and the same workflow can cover them all.

Make requests easy to submit

People should be able to find out how to make a request without a search. Describe the process in your privacy notice, and provide at least one simple online method, such as a form, alongside an email address.

European guidance offers a useful model. The European Data Protection Board’s guidelines on the right of access, adopted in March 2023 and corrected in May 2024, state that there are no specific requirements on the format of a request and that controllers should provide appropriate and user-friendly communication channels. They also note that a person is not required to use those specific channels and may send a request to an official contact point.

In practice, that means:

• Keep the request form short and ask only what you need to find the person’s records.
• Accept requests that arrive by other reasonable routes, such as customer support.
• Teach staff to recognize a request even when it does not use legal language.
• Send an acknowledgment so the person knows the request was received.
• Publish the process clearly in your help center or privacy page.

Verify in proportion to the request

Verification protects people from impostors who might try to obtain or delete someone else’s data. But excessive verification becomes its own problem: it collects more sensitive data and discourages legitimate requests.

In April 2024, the California Privacy Protection Agency’s Enforcement Division issued an enforcement advisory on applying data minimization to consumer requests. It observed that certain businesses were asking consumers to provide excessive and unnecessary personal information in response to requests made under the California Consumer Privacy Act. The advisory quoted the regulation stating that a business shall generally avoid requesting additional information from the consumer for purposes of verification, and that any new information collected for verification should be deleted as soon as practical after processing the request. It also noted that a business shall not require a consumer to verify their identity to make a request to opt out of sale or sharing, and that asking for something like a driver’s license might exceed the minimum personal information necessary.

The EDPB guidelines make a similar point. Requests for additional information must be proportionate, and it is disproportionate to require a copy of an identity document when the person is already authenticated by the controller.

A practical approach is to match verification to risk:

1. Opt-outs and marketing removal. No identity check beyond what is needed to find the record.
2. Requests from logged-in customers. Use the existing account login.
3. Deletion requests by email. Confirm control of the email address on file.
4. Access to sensitive data. Match several data points you already hold, or use a stronger method when the potential harm is high.

Whatever you collect for verification, use it only for that purpose and delete it when you are done.

Plan for agents and unusual requests

Some requests come from someone other than the person whose data is involved. A family member, an attorney or a service that helps consumers exercise their rights may act as an authorized agent. Decide in advance what proof of permission you will accept, and keep the process no harder than a direct request. The Honda matter shows that making it difficult for agents to act can itself draw scrutiny.

Plan as well for requests that are unclear, repeated or involve information about several people, such as a shared household account. Write down how staff should handle them so decisions are consistent rather than improvised.

Map where personal data lives

You cannot delete what you cannot find. Before your first request arrives, make a simple inventory of where personal information is stored:

• Website databases, contact forms and user accounts
• Email marketing and text message platforms
• Customer relationship management and help desk tools
• Order, payment and booking systems
• Spreadsheets, shared drives and email inboxes
• Analytics, advertising and other third-party services
• Backups and archives

For each system, note who manages it, what data it holds and how a record can be found, exported or deleted. This inventory becomes the checklist for every request. A careful web development partner can help you identify forms, plugins and integrations that collect data you may have forgotten.

Carry out deletion across systems and vendors

Deletion is rarely a single click. A complete workflow:

1. Locate every record using your data inventory.
2. Check for exceptions. Some information may need to be retained, for example for tax records, warranty obligations or legal claims. Document what you keep and why.
3. Delete or de-identify the remaining data in each system.
4. Notify vendors that process data on your behalf and confirm they have acted.
5. Suppress, rather than forget, marketing contacts. Keep a minimal suppression entry so the person is not re-added from an old list.
6. Handle backups sensibly. If immediate deletion from backups is impractical, ensure restored data is deleted again before use.
7. Confirm completion to the person in plain language.

Respond on time

Privacy laws set deadlines, and they vary. Under the EU framework described in the EDPB guidelines, a request must be fulfilled as soon as possible and in any event within one month of receipt, extendable by two further months where necessary, with the person informed of the reason for the delay. Other laws use different time limits, so check those that apply to you.

Whatever the deadline, build your process around it:

• Log the date each request arrives.
• Assign an owner immediately.
• Set reminders well before the deadline.
• Tell the person promptly if you need more time or more information.

Keep records without keeping too much

Records show that you handled requests properly, help you spot recurring problems and support responses to complaints. A simple log might include the request date, type, verification method, systems searched, actions taken, any data retained with the reason, completion date and who handled it.

Keep the log factual and limited. It should document the request without becoming a second copy of the personal information you just deleted. Protect it with the same care as other sensitive records, a topic that fits naturally into broader trust and security practices.

Train the people who receive requests

Requests often arrive through front-line staff who are not privacy specialists. Training should help them:

• Recognize a privacy request in everyday language, such as “please remove me from everything.”
• Forward requests to the owner immediately, using a defined route.
• Avoid asking for unnecessary documents.
• Respond politely and avoid promising outcomes they cannot control.
• Know when to escalate, for example if a request seems fraudulent or involves a dispute.

A short practice session using a few realistic sample requests, including one that arrives by phone, helps staff respond with confidence when a real one appears.

A fictional example

Consider a fictional dance studio with an online booking system, a newsletter and a parent contact form. A former student’s parent emailed asking the studio to delete all their family’s information.

Before the studio built a workflow, the request would have sat in a shared inbox. Instead, the office administrator logged it, confirmed the request came from the email address on file and checked the studio’s data inventory. She deleted the family from the booking system and contact form records, removed them from the newsletter while keeping a suppression entry, and asked the booking software vendor to confirm deletion from its systems. Payment records required for tax purposes were retained and noted in the log. Within a week, she sent the parent a short confirmation describing what was deleted and what was kept.

A workflow checklist

• A clear process is published and easy to find.
• Requests are accepted through reasonable channels and acknowledged.
• Verification matches the risk and collects minimal data.
• A data inventory covers internal systems and vendors.
• Deletion steps include exceptions, suppression and backups.
• Deadlines are tracked with assigned owners.
• A limited request log is maintained securely.
• Staff are trained to recognize and route requests.
• The process is reviewed when systems or laws change.
• Recurring problems found in the log lead to process fixes.

A privacy request is a chance to show customers that you take their information seriously. With a simple, well-documented workflow, your team can respond quickly, fairly and consistently every time.