KoltrixHandling privacy and data requests by email without panic
A customer emails to ask for a copy of their data or to delete it. A calm runbook for spotting, verifying, logging and answering privacy requests on time.
On this page(10 sections)
- What these requests look like
- Step one: make it impossible to lose
- Step two: know the clock
- Step three: confirm who is asking
- Step four: find the data
- Step five: do the work
- For access or export requests
- For deletion requests
- For corrections and objections
- Step six: write the reply
- Keep a log
- Common mistakes
- Key takeaways
One morning a message arrives in your support inbox: "Please send me all the data you hold about me", or "Delete my account and everything connected to it." It may not use any legal term. It may land in a shared inbox where three people could each assume someone else will deal with it.
Privacy requests are routine for any company with customers, and the first reply matters more than most teams expect. This guide describes a calm way to handle them by email: recognizing the request, verifying who sent it, tracking the clock, doing the work and answering clearly. It is operational advice for support teams, not legal advice. Which laws apply to you, and what exactly they require, is a question for a lawyer or your privacy lead.
What these requests look like
People rarely write "data subject access request". Expect wording like:
- "What information do you have on me?"
- "Please delete my account and my data."
- "Stop using my email for marketing." (This one is an unsubscribe, and it must be honored fast.)
- "Correct my name or address in your records."
- "Send my data to another service in a usable format."
- "Do not sell or share my information."
- "Who have you shared my data with?"
Treat every message like this as a request, even if it arrives as a reply to a newsletter or a one-line complaint. If you are not sure, a short question back is fine, but log it first.
Step one: make it impossible to lose
The most common failure is not a wrong answer. It is a request that sits unseen for weeks.
- Agree one place for requests. Publish a privacy address such as
[email protected]and route it to a small group, not to one person. Shared-inbox ownership rules explain how to make sure a message always has an owner. - Catch requests that arrive elsewhere. Add a label or rule so that anything containing words like "my data", "delete my account", "GDPR" or "CCPA" is flagged for the privacy group. Rules will miss some, so train the team to forward by hand as well.
- Record the date it was received. That date starts every clock that follows. Write it in your tracker on the day the email arrives, not when someone reads it.
- Do not forward the customer's message widely. Share it only with the people who must act on it.
Step two: know the clock
Deadlines depend on the law that applies to the person and to you, and they can change. As a general guide, at the time of writing:
- Under the EU and UK GDPR, the usual deadline to respond is one month, with a possible extension for complex requests if you tell the person why.
- Under California's CCPA, the usual response period is 45 days, with a possible extension.
- Other regions have their own periods, and some contracts with business customers set shorter ones.
Do not rely on this list for decisions. Ask your privacy lead what applies and write the answer into your runbook. What a support team can always do is send a quick acknowledgement, log the due date and set a reminder well before it.
Step three: confirm who is asking
A request for data is a request to hand over personal information, which makes it a target for social engineering. An attacker who writes "I am Maya, send me everything" should not get it.
- Match the sender to the account. If the request comes from the email address on the account, that is a reasonable start. For a deletion or an export, add one more check, such as a confirmation link sent to that address or a re-login in the product.
- Be cautious when the sender differs. If someone writes from another address or on behalf of someone else, ask for proof, and for a representative, written authorization. Verifying identity before account-access requests is a fuller runbook for this.
- Ask only for what you need. Do not demand a passport scan to confirm an email address you already have. Extra documents create extra risk.
- Never put sensitive data in the verification message. Do not quote the data back to prove you found it.
Step four: find the data
A request is only as good as your map of where personal data lives. Before the first one arrives, write down:
- Your main database, and which tables hold personal information.
- Email systems, including the support inbox, a marketing tool and any transactional email logs.
- Billing and payment providers.
- Analytics, error tracking and logging tools.
- Backups, and how long they are kept.
- Any AI tool or assistant that has read the customer's messages. See keeping confidential email out of AI for how to limit that.
Keep the map as a one-page checklist with an owner for each system. When a request comes in, you work down the list instead of searching from scratch.
Step five: do the work
For access or export requests
- Collect what the person is entitled to see from each system on your map.
- Provide it in a common, readable format, such as CSV or JSON for structured data.
- Leave out other people's information. A support conversation may name colleagues or other customers. Remove or redact those parts.
- Send it through a secure route. Avoid attaching a large unprotected file to an ordinary email. A time-limited download link that requires login is safer.
For deletion requests
- Check whether anything must be kept, such as invoices for tax purposes, records for a dispute or security logs. If so, delete the rest and say plainly what was kept and why.
- Remove the data from live systems and queue it for removal from backups according to your retention schedule.
- Tell processors you use, where you are required to, and suppress the email address from future marketing. Suppression list policy covers keeping an address from being re-added.
- Confirm the result in writing. Data export and account deletion emails has wording for the messages that go with this.
For corrections and objections
- Correct the record in each system and confirm what changed.
- For marketing opt-outs, act immediately. They are not on the long clock. A message that says "stop emailing me" is also covered by one-click unsubscribe expectations.
Step six: write the reply
A good response is short, specific and free of legal fog.
- Acknowledge quickly, ideally within two working days: "We have your request and will respond by 12 November."
- Say what you did, in plain words: what you found, what you sent, what you deleted.
- Explain anything you did not do, and why. If you kept an invoice, say so.
- Say what happens next, for example "Your account is closed and you will not receive more email from us."
- Give a contact for questions, and mention any complaint route the law requires you to mention.
A sample structure:
Hello Maya,
Thank you for your request. We have confirmed it came from the address on your account and completed it today.
What we did: we deleted your profile, your saved settings and your conversation history. We kept invoices from 2025 and 2026, which we must retain for tax records, and a note of this request. Your email address is now on our do-not-contact list so that you do not receive marketing from us.
Backups are cleared on our normal schedule, within 35 days.
If you have any question, reply to this message.
Keep a log
For every request, record in one place: received date, type, who verified it and how, systems checked, what was done, the date answered and who did it. Keep the log without the personal data itself. If a regulator or a customer ever asks what happened, the log answers in minutes.
Common mistakes
- Letting the message wait in a personal inbox. Route it to a group address.
- Answering without verifying. This is how data leaks.
- Promising what you cannot do. Do not write "all your data is gone" if backups and invoices remain.
- Forgetting the tools around the product. Support software, analytics and email platforms hold data too.
- Replying in legal language. Plain and kind wins.
- Treating one as a one-off. The second request will come. Write the runbook after the first.
Key takeaways
- Treat any message about someone's data as a request, route it to a shared privacy inbox and log the date it arrived.
- Confirm identity with a proportionate check before sharing or deleting anything.
- Keep a one-page map of where personal data lives so you can respond without a hunt.
- Acknowledge fast, answer in plain words, say what you kept and why, and keep a log without the data in it.
- Ask your privacy lead or a lawyer which deadlines and rules apply to you. This guide does not replace that advice.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
