Data Deletion Requests: What Your Website Keeps

The email was four lines long. No solicitor's letterhead, no threat, no legal citation. A former patient of a physiotherapy clinic in Tralee wrote to ask that the clinic delete everything it held about her, and she wanted confirmation when it was done.

The owner replied inside the hour. She had gone into the website, found the person's account, deleted it, and considered the matter closed. That reply was the mistake, and it was an honest one.

We see a version of this most months on the operations side, so take it as a composite rather than one business's bad week. That account was one copy. Two years earlier the same person had submitted an enquiry through the contact form, and it was still sitting in the form plugin's own database table, untouched. Her details were in the inbox as a notification email, and again in sent items where it had been forwarded to a colleague. A spreadsheet exported the previous autumn had them too. Every one of those copies was inside the backup that ran at two o'clock that morning.

Nobody deletes a customer. They delete one copy of a customer, then tell the customer it is finished.

The clock starts the day it lands

There is no grace period while you work out what a request even is. Under the rules the Data Protection Commission sets out for Irish organisations, you act without undue delay and in any event within one month of receiving the request ^[1]. That month can be extended by two further months where the request is genuinely complex or where several have arrived together, but the extension only counts if you tell the person inside the first month and explain the reason for the delay ^[1].

Read that again, because it is the part that catches people. The extension is not something you claim in week six when you finally open the email.

Volume is going one way. The DPC received 16,160 new cases in 2025, a 45% rise on the previous year, and concluded 11,734 of them ^[2]. That total covers everything from multinational platforms to one-person operations, so do not read it as 16,000 complaints about small websites. Read it as evidence that people now know they have these rights and are willing to use them.

Silence is what turns an email into a complaint. A request ignored for a month rarely stays a request. It becomes a form submitted to the DPC by somebody who is now annoyed as well as concerned, and you find out about it in a letter that asks you to explain your processing, your lawful basis and your retention practice all at once. Answering that letter takes considerably longer than the ten minutes the original email deserved.

One record, several copies. A deletion that only clears the first one is not a deletion.

Where the copies actually live

Before you can erase anything you need an inventory. On a typical small business WordPress site, personal data is scattered across at least six locations, and only one of them is the obvious one.

The form plugin's database table. Most contact form plugins store every submission in the database as well as emailing it to you. Deleting a user account does not touch those rows.
Your email. The notification landed in your inbox. It may also be in sent items, in a colleague's mailbox, or in a shared enquiries account.
Order and customer records. If you sell anything, the order history holds names, addresses and often phone numbers, entirely separately from the user account.
Exports. The CSV you downloaded to tally last quarter's leads is still in a downloads folder, and probably in a cloud drive.
Comments and reviews. A comment carries a name, an email address and an IP address, all stored whether the comment was ever approved.
Backups and logs. Every copy above is inside the nightly backup, and the server access log holds IP addresses for a period set by your host.

That last line is the one that surprises owners, and it is also where your hosting arrangement stops being an abstract technical detail. Server logs, backup retention and the location the data physically sits in are all decisions somebody made on your behalf. If you have never asked, what "GDPR-compliant hosting" actually means in practice is worth twenty minutes of your time.

What you want from a hosting platform here is short to state. Your data sitting in one jurisdiction you can name. A backup schedule you can describe without ringing anybody. Direct access to your own database so you can verify a record is gone rather than take somebody's word for it. That is the standard Web60 was built to, with every site and every nightly backup held on Irish infrastructure and the database manager sitting in the same dashboard as everything else. It turns an erasure request into an administrative task rather than an archaeology project.

Two of those six locations are usually not the website at all. Which is why "I deleted them from the site" is an incomplete answer, however honestly it is given.

What the WordPress erase tool does, and what it does not

WordPress has shipped a deletion workflow since version 4.9.6, and most owners have never opened it. It lives under Tools, then Erase Personal Data. You enter the person's username or email address, WordPress emails them a confirmation link, and once they confirm you click through to erase. The data is permanently removed from the database and the request cannot be reversed ^[3].

Useful. Also, by its own documentation, limited in two specific ways.

The first limit: the tool "ONLY gathers data from WordPress and participating plugins" ^[3]. Participating is doing a lot of work in that sentence. A plugin only surrenders its data if its developers registered an eraser with WordPress. Plenty have. Many have not. If your form plugin sits in the second group, the tool will run, report completion, and leave three years of enquiries exactly where they were.

The second limit is stated just as plainly: the tool does not remove data from backups or archive files ^[3].

So verify rather than assume. Run the export tool first, on the same email address, and look at what comes back. Whatever appears in that export is what the eraser can reach. Anything you know exists and cannot see in the export is a location you will have to clear by hand, most often in the form plugin's own entries screen. That check takes two minutes and it is the difference between a procedure and a hope.

The backup question, answered honestly

Here is the limitation nobody enjoys explaining to a customer. You cannot reach into a backup taken last Tuesday and surgically remove one person from it. That is not a failing of your host, it is what a backup is: a sealed snapshot, valuable precisely because nothing can edit it after the fact.

Regulators understand this. The UK Information Commissioner's Office, whose guidance on erasure is the most detailed published in either jurisdiction, asks that backup data is put "beyond use" where it cannot be immediately overwritten, meaning it is not accessed or processed for any other purpose and is simply held until it is replaced on an established schedule ^[4]. The point is not that the bytes vanish tonight. It is that they are never used again, and that they age out on a schedule you can describe.

What you do owe is the restore discipline. If you roll a site back three weeks to recover from a bad update, you have just reinstated every record that existed three weeks ago, including the one you erased. WordPress documentation flags the same risk and asks that erasure requests be respected when an archived copy is restored ^[3]. In practice that means keeping a short suppression list, a plain text file of erased email addresses, and re-running the deletion immediately after any restore. Not elegant. It works, and it is the sort of thing worth building into your wider backup and recovery routine rather than remembering under pressure.

One honest note on where this stops being a website problem. If you are holding tens of thousands of customer records, running consent-based marketing at scale and employing someone whose job is data protection, a purpose-built CRM with automated retention rules will handle this far better than any set of admin screens. That is a real category of business with a real need. It is not the clinic in the opening paragraph, and it is not most local firms.

A written procedure turns a panicked afternoon into a ten minute task.

Five Steps When a Deletion Request Arrives

Verify. Confirm the request came from the person it concerns, usually by replying to the address already on the record. Ask for identification only where you have a real doubt.

Locate. Work the inventory above and write down every place that person appears, including email and any export files. Do this before you delete anything, because deleting the account first can make the other copies harder to find.

Erase. Clear the live records: the WordPress tool for what it reaches, the form plugin's entries screen and your mailbox for the rest. Confirm each one rather than assuming.

Suppress. Add the email address to a suppression list so that any future rollback or restore is followed by an immediate re-deletion.

Record. Note the date the request arrived, what you erased, what you kept and why. If a query ever comes back to you, this file is the answer.

When "no" is a legitimate reply

The right to erasure is not absolute, and it is worth knowing that before you delete something you are obliged to keep. The DPC's own guidance sets out where the right does not apply, including where processing is necessary to comply with a legal obligation or to establish or defend a legal claim.

The practical version: a customer who bought from you can ask you to remove them from your mailing list and your enquiry records, and you should. The invoice underneath that sale is a different matter, because tax and company law impose their own retention periods, and those are not yours to waive. Confirm the specific periods with your accountant rather than working from memory. A partial refusal is perfectly acceptable as long as you reply inside the month, say plainly which data you are retaining and on what basis, and tell the person they have the right to complain to the DPC.

Do not overreach in the other direction either. A DPC erasure case study records a platform insisting on a copy of photographic identification before it would act, with no proper justification for demanding it ^[5]. Asking a former patient to email a passport scan so you can delete her physiotherapy enquiry collects more personal data than the deletion itself removes.

The part worth fixing before the email arrives

The clinic sorted it out in the end, inside the month, and the reply that eventually went back was a good deal more useful than the first one. What changed was not the software. It was having a written list of where the data lived, so the second request took ten minutes instead of an afternoon.

That list is the whole job. Open your site this week, run the personal data export on your own email address, and see how much comes back. Then check your form plugin's entries screen separately, because that is usually where the gap between what you think you hold and what you actually hold shows up. Most owners find something they had genuinely forgotten was there, and it is far better to find it on a quiet Tuesday than in the fourth week of somebody else's deadline. If you have never audited what your contact form is collecting and storing in the first place, start there.

You do not need to become a data protection expert. Knowing where your customers' details are kept, and being able to show you can clear them out when somebody asks, is the whole of it.

Frequently Asked Questions

How long do I have to respond to a data deletion request in Ireland?

One month from receipt. The Data Protection Commission states that a controller must act without undue delay and in any event within one month. That period can be extended by two further months where the request is complex or where you have received several, but you must tell the person about the extension, and explain why, inside the first month.

Does the WordPress Erase Personal Data tool delete everything?

No. WordPress documentation is explicit that the tool only gathers data from WordPress and participating plugins, and that it does not remove data from backups or archive files. If your contact form plugin has not registered an eraser, its stored entries survive a run that reports success. Run the export tool on the same address first to see what the eraser can actually reach.

Do I have to delete personal data from my website backups?

You cannot usually rewrite an existing backup, and no regulator expects you to. The ICO's guidance on erasure asks that backup data is put beyond use: not accessed or processed for any other purpose, simply held until it is overwritten on your normal schedule. The obligation that matters is that a restore must not quietly bring the record back to life.

Can I refuse a request to delete customer data?

Sometimes. The right to erasure is not absolute. Where you need the data to comply with a legal obligation, or to establish or defend a legal claim, you can decline that part of the request. You still have to reply inside the month, say which data you are keeping and why, and tell the person they can complain to the DPC. Check retention obligations with your accountant or solicitor rather than guessing.

Can I ask for photo ID before deleting someone's data?

Only where you have a genuine reason to doubt who is asking, and only for what you actually need. A DPC case study on erasure records a platform demanding a copy of photographic ID without proper justification. If the request arrives from the same email address sitting on the record, a confirmation reply to that address is usually proportionate.

Where does customer data actually live on a WordPress site?

More places than most owners expect: the form plugin's own database table, the notification emails in your inbox and sent items, order and customer records, user accounts and comments, any CSV you exported to a laptop, your email marketing list, server logs, and the nightly backups of all of it. A deletion procedure has to name each location before it can clear it.