Sooner or later a customer writes: "Please send me everything you hold about me." In a small company this email often lands in a general inbox, gets forwarded twice and is answered late and incompletely. The request itself is not hard. What goes wrong is that nobody knows who owns it, where the data is or how long there is to answer. A one-page routine fixes all three.
This article describes a practical approach. It is not legal advice; the exact rules and deadlines depend on your country and on the type of request.
Recognise a request when it arrives
Customers rarely use formal language. Treat any of these as a data request:
- "What do you have on me?" or "Send me a copy of my data"
- "Please delete my account and everything linked to it"
- "Correct my details, they are wrong in your system"
- "Stop using my email for marketing"
The message can arrive by email, through a contact form, by phone or via someone in sales. Tell everyone in the company one rule: if a customer asks about their data, forward it the same day to the named owner. Nobody else replies in the meantime except with a short acknowledgement.
One owner, one deputy
Choose one person who owns data requests and one deputy for holidays and sickness. In a company of ten to fifty people this is often the operations lead or the office manager, not the person who runs the customer relationship. The owner does not have to do all the work, but they keep the log, watch the deadline and send the reply.
Start the clock and write down the deadline
Many privacy rules give about one month to respond, counted from the day the request is received. Check the period that applies to you. On day one, write the received date and the deadline in the log, and add a reminder one week before the deadline. The most common failure is not a refused request, it is a forgotten one.
Send a short acknowledgement within a few working days:
Thank you for your message of [date]. We have received your request and will reply by [deadline]. To protect your data, we may ask you to confirm your identity first.
Confirm who is asking
Sending a person's data to the wrong recipient is worse than answering late. Before you release anything:
- Check that the request comes from the email address or phone number you have on file.
- If it does not, or if the data is sensitive, ask for a simple confirmation, for example an answer to a question only the customer would know or a message from the registered address.
- Do not ask for more documents than you need. A copy of an identity card is rarely necessary if you can confirm identity another way.
If someone writes on behalf of the customer, ask for written authorisation from the customer.
Know where the data lives
Most small companies hold customer data in more places than they think. Keep a short list, one line per place, and update it twice a year:
| Place | Typical content | Who can search it |
|---|---|---|
| CRM | Contacts, notes, deal history | Sales lead |
| Invoicing or accounting | Invoices, addresses, payments | Finance person |
| Email and shared inboxes | Conversations, attachments | IT or the owner |
| Support or ticket tool | Questions, complaints | Support lead |
| Newsletter tool | Subscription status, opens | Marketing |
| File storage | Contracts, quotes, uploads | Office manager |
| Backups and exports | Copies of all of the above | IT |
Mismatched records are a common surprise. If the same customer appears under two spellings in two systems, search for both. The article on reconciling customers between a CRM and invoicing shows how to keep one reliable customer identity.
Collect, check and decide what you can send
Ask each data holder to export what they have on the customer into one folder. Then the owner checks three things:
- Completeness. Did every place on the list answer, even if only with "nothing found"?
- Other people's data. Remove or hide details about colleagues or other customers that appear in the same emails or documents.
- Exceptions. Some records you must keep, such as invoices required by tax or accounting rules. If the customer asked for deletion, explain what you delete and what you keep and why.
If you are unsure about a legal point, ask your lawyer or data protection adviser before replying, not after.
What the reply should contain
A good reply is short and clear:
- A confirmation of what the customer asked for.
- The data itself, in a common readable format such as PDF, CSV or a folder of files, sent in a secure way. Avoid attaching sensitive data to a plain email if a protected link or password-protected file is available.
- A plain description of what you use the data for, how long you keep it and who it is shared with, for example your accounting provider.
- For deletion or correction: what was changed, what was kept and the reason.
- A named contact for follow-up questions.
Use the same template every time. It saves time, and the customer sees a consistent process.
Keep a simple log
One row per request is enough: date received, customer, type of request, identity checked, deadline, date of reply, what was sent or deleted, and who handled it. Review open rows in your weekly operations meeting so that nothing waits. If a request arrives together with a complaint, link the two in your complaint log.
Common mistakes
- Replying from several mailboxes. The customer receives partial answers and you lose track of what was sent.
- Searching only the CRM. Email and shared drives often hold more.
- Missing the deadline in silence. If you need more time, tell the customer before the date and explain why.
- Sending too much. Other people's details do not belong in the reply.
- No record. Without a log you cannot show what you did.
How to start
- Name the owner and the deputy and tell the whole team.
- Make the list of places where customer data lives.
- Write the acknowledgement and the reply templates.
- Create the log with received date and deadline columns.
- Run a practice request using an internal test customer and fix what is unclear.
Summary
A data request is easy to answer when the routine exists before it is needed. One owner, a deadline noted on day one, a list of data locations, an identity check and a standard reply turn an uncomfortable email into a short, predictable task.
Sources
- Our related articles linked above.
- The approach described here is common practice for small companies, used as a practical guide. It is not legal advice; check the data protection rules and deadlines that apply in your country. No client results or market figures are claimed in this article.
