Under GDPR (and similar laws), anyone can ask you for a copy of the data you hold about them, or ask you to delete it — and you're on a legal clock to respond. If your customer data is scattered across leads, form entries, messages and orders, that's a scramble. The answer is first-party tooling that, given an email, gathers everything you hold about that person for a data-access request, and cleanly removes the first-party records for a right-to-be-forgotten request — while preserving what you're legally required to keep, like order records. Compliance becomes a two-minute task instead of a fire drill.
The two requests you must be able to answer
GDPR gives individuals rights you have to honor on request:
Right of access / portability — provide a copy of the personal data you hold about them.
Right to erasure ("right to be forgotten") — delete their personal data, unless you have a legal reason to keep some of it.
Both are time-bound (typically within a month), and "I couldn't find it all" isn't a defense. The practical requirement is simple: given a person's email, produce everything, and be able to remove it.
Why scattered data makes this hard
On a typical WordPress site, one person's data lives in several places: a CRM lead, the activity log for that lead, emails you sent them, native form submissions, and WooCommerce orders. Answering a request by hand means remembering every one of those stores and checking each. Miss one and you're non-compliant. A tool that knows all your first-party stores and queries them by email removes the guesswork.
Export: gather everything by email
A data-access response should collect, for a given email, the lead record, its activity history, messages sent, matching form entries, and a list of related orders — in one bundle you can hand over. Because it's first-party, it reads your own database directly; nothing has to be requested from an outside processor.
Erase: remove the right things, keep the required ones
Erasure is where care matters. The first-party marketing and contact records — the lead, its activity, messages and form entries — can be deleted. But some data you're legally required to retain: order and invoice records usually must be kept for tax and accounting. A good erasure tool deletes the discretionary personal data and preserves the legally-retained records, reporting them rather than removing them — and offers a dry-run so you can see exactly what will be erased before it happens.
In GOMAX ULTIMATE these are built in: retrieve_privacy_status shows your readiness (consent banner, privacy and terms pages, retention windows), export_personal_data gathers everything held for an email, and erase_personal_data removes the first-party records with a dry-run — while WooCommerce orders are preserved for legal retention and reported, not deleted. An AI assistant can run the export and carry out the erasure on your approval.
Key takeaways
GDPR requires you to export and erase a person's data on request, on a legal deadline.
One person's data is scattered across leads, activity, messages, forms and orders.
Export by email gathers everything you hold, first-party, in one bundle.
Erasure should remove discretionary data but preserve legally-retained records like orders.
A dry-run lets you preview an erasure before anything is deleted.
Frequently asked questions
How do I handle a GDPR data request in WordPress? Given the person's email, gather everything you hold about them (CRM lead, activity, messages, form entries, orders) for an access request, and delete the first-party records for an erasure request while keeping legally-retained data.
What is a data subject access request (DSAR)? A request under GDPR for a copy of the personal data an organization holds about someone. You must provide it, usually within a month.
Does "right to be forgotten" mean I delete everything? No. You delete personal data you have no overriding reason to keep, but you may (and often must) retain records like orders and invoices for tax and legal obligations.
Can I preview an erasure before it happens? Yes. A dry-run shows exactly which records would be removed for a given email, so you can confirm before anything is deleted.
Where is a person's data stored in WordPress? Typically across several places: a CRM lead and its activity, emails sent to them, native form submissions, and WooCommerce orders. A DSAR tool checks all of them by email.
Answer data requests in minutes with GOMAX ULTIMATE — first-party export and erasure with a readiness overview, self-hosted and pay-once.
Top comments (0)