Data Deletion Request Procedure

DATA DELETION REQUEST DECISION AND EXECUTION PROCEDURE

Organization: [________________________________]

Procedure owner: [________________________________]

Legal approver: [________________________________]

Request ID: [________________________________]

1. Purpose and Control Principle

This procedure provides a controlled record for:

• determining whether a deletion request is covered;
• identifying the data, entities, systems, and recipients in scope;
• authenticating the requester when the approved rule requires it;
• separating data approved for deletion from data approved for retention;
• suspending deletion where a preservation or other approved override applies;
• issuing and tracking internal and downstream deletion instructions;
• testing the actual result; and
• sending a source-aligned response.

A request does not authorize deletion by itself. A retention schedule, contract, business preference, or technical limitation does not defeat a request by itself. Legal must approve the rule and facts for each disposition.

2. Use Gate

3. Request Intake

4. Applicability and Rule Activation Record

Create one row for each framework that may independently govern the request. Do not blend rights, exceptions, deadlines, or appeal rules between rows.

4.1 Coverage Decision

☐ A deletion right applies.

☐ Multiple frameworks apply; each will be satisfied separately.

☐ No identified deletion right applies, but voluntary deletion is approved.

☐ No deletion will occur; the source-based decision is documented below.

Coverage analysis: [________________________________]

5. Deadline and Work Plan

Use the controlling source's trigger. Internal target dates must leave enough time for legal review and delivery but must not be presented as statutory unless the source says so.

Calendar convention and calculation evidence: [________________________________]

6. Authentication and Authority

Final status: ☐ Authenticated ☐ Additional information requested ☐ Unable to authenticate ☐ Authentication not required under approved rule

6.1 Representative, Guardian, or Agent

7. Data Map and Search Plan

7.1 Identity Resolution

7.2 Search Population

Search limitations and approved explanation: [________________________________]

8. Preservation and Conflict Check

Before deletion, Legal must check every potentially applicable preservation or retention source.

Conflict decision and source: [________________________________]

9. Item-Level Disposition Matrix

Do not apply a generic exception list. Approve each action against the activated source and facts.

Checks:

• ☐ Another person's data and shared accounts reviewed.
• ☐ Privilege, confidentiality, trade-secret, security, fraud, and legal-claim issues reviewed.
• ☐ Sector, employment, health, financial, education, child, and public-record regimes reviewed.
• ☐ Minimum suppression data approved where needed to keep data deleted or an opt-out effective.
• ☐ The response can accurately explain each retained category without exposing protected details.

10. Technical Execution Plan

10.1 Execution Ticket

10.2 System Results

10.3 Backups, Archives, Replicas, Caches, and Logs

Do not claim immediate deletion or permanent inaccessibility without testing the actual system. Record the approved treatment for each technical copy.

11. Processor, Affiliate, and Recipient Instructions

11.1 Instruction Module

[ORGANIZATION LETTERHEAD]

[DATE]

Re: Data Action Instruction [REQUEST ID / VENDOR TICKET]

To [RECIPIENT]:

Under [CONTRACT, INSTRUCTION RIGHT, OR APPLICABLE SOURCE], perform the following approved action for the identified records:

• approved identifier or token: [________________________________];
• data and systems in scope: [________________________________];
• action: [DELETE / RESTRICT / DE-IDENTIFY / SUPPRESS / OTHER];
• exclusions or retained data: [________________________________];
• completion date derived from source or contract: [________________________________];
• evidence required: [________________________________]; and
• escalation contact: [________________________________].

Do not use the identifier or retained minimum data for another purpose unless separately authorized.

Authorized by: [NAME / ROLE]

12. Response Modules

12.1 Acknowledgment or Authentication Request

[ORGANIZATION LETTERHEAD]

[DATE]

Re: Deletion Request [REQUEST ID]

Dear [REQUESTER NAME]:

We received your request on [DATE AND TIME] concerning [SCOPE].

The request is being evaluated under [APPLICABLE SOURCE OR APPROVED VOLUNTARY PROCESS]. Our current response deadline is [DATE], calculated from [SOURCE-DEFINED TRIGGER].

☐ We have the information needed to continue.

☐ We need the following information that the approved authentication rule permits and requires: [________________________________].

This communication changes the response calculation only if [CONTROLLING SOURCE AND FACTS].

Sincerely,

[NAME / TITLE / ORGANIZATION]

12.2 Extension Notice

[ORGANIZATION LETTERHEAD]

[DATE]

Re: Extension for Deletion Request [REQUEST ID]

Dear [REQUESTER NAME]:

Under [CITATION OR APPROVED VOLUNTARY STANDARD], we are extending the response period from [ORIGINAL DATE] to [NEW DATE].

The extension is permitted because [SOURCE-ALIGNED REASON AND FACTS]. We provided this notice on [DATE] under the calculation recorded for this request.

Sincerely,

[NAME / TITLE / ORGANIZATION]

12.3 Completion, Partial Completion, or Refusal

[ORGANIZATION LETTERHEAD]

[DATE]

Re: Decision on Deletion Request [REQUEST ID]

Dear [REQUESTER NAME]:

We evaluated your request under [APPLICABLE SOURCE OR APPROVED VOLUNTARY PROCESS].

We sent applicable instructions to [PROCESSOR / AFFILIATE / RECIPIENT CATEGORIES] as required by [SOURCE OR CONTRACT].

The response does not claim deletion from any backup, archive, recipient, or system that has not been confirmed. Approved treatment for remaining technical copies or retained data is: [________________________________].

[IF REQUIRED: Appeal deadline, method, and regulator-contact information: [________________________________].]

Sincerely,

[NAME / TITLE / ORGANIZATION]

12.4 Appeal Decision

[ORGANIZATION LETTERHEAD]

[DATE]

Re: Appeal Decision [REQUEST ID]

Dear [REQUESTER NAME]:

We received your appeal on [DATE] and reviewed [ISSUES].

☐ The original decision is reversed as follows: [________________________________].

☐ The original decision is modified as follows: [________________________________].

☐ The original decision is upheld for these source-based reasons: [________________________________].

[IF REQUIRED: Regulator or complaint route: [________________________________].]

Sincerely,

[NAME / TITLE / ORGANIZATION]

13. Final Quality Control

• ☐ The activated source version and effective date govern this request.
• ☐ Every deadline uses the source-defined trigger, not a generic 45-day assumption.
• ☐ Authentication did not stop or restart a clock unless the source permits it.
• ☐ The data map covers each in-scope entity, system, processor, affiliate, and recipient.
• ☐ Every deletion, retention, restriction, de-identification, or suppression decision has a source and facts.
• ☐ No deletion occurred while an approved preservation conflict remained unresolved.
• ☐ Execution evidence proves the claimed system result.
• ☐ Backup, archive, replica, cache, index, and log language matches actual tested behavior.
• ☐ Downstream instructions and confirmations are complete or accurately disclosed as pending.
• ☐ Appeal and regulator-contact language appears only when required or voluntarily offered.
• ☐ The response does not overstate deletion or conceal an approved exception.
• ☐ Legal approved the final response and evidence package.

Final legal approval: [NAME / DATE]

Sent by / date / time zone: [________________________________]

Delivery evidence: [________________________________]

14. Request Record and Retention Decision

No retention period is supplied by this template. Enter the approved source, trigger, period, hold override, access restriction, and disposal method for each record.

Metrics and Review

Procedure review date and source-currency check: [________________________________]

Sources Reviewed for This Rebuild

These official sources were reviewed on 2026-08-15 to test the former universal deletion scope, deadline, exception, verification, appeal, and backup assumptions. Recheck the current version and applicability before use.

• California Privacy Protection Agency — CCPA statute and regulations effective January 1, 2026
• Code of Virginia § 59.1-577 — Personal data rights; consumers
• Colorado Revised Statutes, Title 6 — including § 6-1-1306
• Utah Code § 13-61-201 — Consumer rights, effective July 1, 2026
• Official Journal of the European Union — Regulation (EU) 2016/679, Articles 12 and 17