It starts with the shortest scary email a small business can get:

It starts with the shortest scary email a small business can get:

"Under GDPR/CCPA, I request that you delete all personal data you hold about me."

Nothing is broken. Nobody is angry. And most small teams still freeze — because "all personal data" turns out to live in nine places, one of them is a mailing list you don't fully control, and one of them (invoices) you're not allowed to delete. The clock says 30 days. The panic says do nothing. Both are wrong.

We just shipped the checklist that turns this into two hours of work instead of a compliance incident: Customer Data Deletion Request Checklist for Small Teams.

Here's the shape of it — and the three parts almost everyone gets wrong.

1. Acknowledge, then verify — in that order, and never backwards.
Acknowledge receipt in days, not weeks: "We've received your request and will respond in full by [date]." Then verify the requester is actually the customer, through a channel you already have on file. Because here's the part nobody advertises: fake deletion requests are an account-takeover play. The attacker isn't asking for deletion — they're asking you to list what data exists about "them," or to delete a real customer's account for them. One verification email closes that door.

2. The delete/keep split that surprises everyone.
The right to erasure is not a right to erase your accounting records. Marketing profiles, chat threads, analytics, mailing list subscription: delete outright. Invoices, tax records, fraud records, consent records: keep — retention periods are set by tax law, not by the requester. For what you keep, restrict instead of delete: suppress the email from all sends and mark the record "erasure requested, retained for tax purposes until [date]." The request is satisfied by the combination — not by pretending the invoice doesn't exist.

3. "Deleted" has fine print, and the fine print is your vendors and your backups.
An honest inventory says the quiet part out loud: you don't hold most of the data — your SaaS vendors do. The request isn't done until it's relayed to the mailing list tool, the support desk, the payment processor, and confirmed by each one, on a tracked row. And for backups, nobody expects surgery on last Tuesday's restore file — what's expected is the sentence: "Personal data is deleted from active systems; backup copies age out on our standard rotation, and any restoration re-applies your request." Plus one suppression list entry, so a restored backup doesn't resurrect the person into a marketing send.

Then close in writing: what was deleted, what was kept and why, the backup sentence, the processor confirmations, a contact. Log row + letter + vendor confirmations = your entire evidence file, forever. Regulators don't ask for good intentions. They ask for the log.

The uncomfortable 30-minute follow-up: if you can't find one customer's data everywhere in under an hour, you don't have a deletion problem, you have a sprawl problem — and it's cheaper to fix before the request than during it. (We keep that drill inside the annual security review, one line: can you find one person in an hour?)

Full checklist with the acknowledgment template, the keep-list, and the closing letter:
👉 Customer Data Deletion Request Checklist for Small Teams

More free small-team ops notes: ops-notes index

Incident response for small teams (fill-in, blameless, $14): Ops Starter Kit — launch week code HIVE-LAUNCH30 takes 30% off any paid kit.