DATA DELETION REQUEST PROCEDURE

[ORGANIZATION NAME]

Procedure Number: [PROC-PRIV-002]
Effective Date: [DATE]
Last Reviewed: [DATE]
Procedure Owner: [Chief Privacy Officer / Privacy Team]

1. PURPOSE AND SCOPE

1.1 Purpose

This procedure establishes the process for handling consumer/data subject requests to delete their personal information pursuant to applicable privacy laws including CCPA/CPRA, VCDPA, CPA, CTDPA, and other state privacy laws.

1.2 Scope

This procedure applies to:

☐ All deletion requests from consumers/data subjects

☐ All personal information held by [ORGANIZATION NAME]

☐ Personal information held by service providers on behalf of [ORGANIZATION NAME]

☐ All employees, contractors, and third parties processing deletion requests

2. LEGAL FRAMEWORK

2.1 Right to Delete Under State Privacy Laws

2.2 Statutory Exceptions to Deletion

Under most privacy laws, deletion may be refused when the personal information is needed to:

1. Complete a transaction or provide goods/services requested
2. Detect security incidents or protect against malicious/fraudulent activity
3. Debug to identify and repair errors
4. Exercise free speech or another legal right
5. Comply with legal obligations
6. Conduct research in the public interest with safeguards
7. Enable solely internal uses reasonably aligned with consumer expectations
8. Make other internal and lawful uses compatible with the context of collection

3. DELETION REQUEST PROCESS

3.1 Process Overview

[Request Received] --> [Intake & Logging] --> [Identity Verification]
| |
| [Verification Failed] <-+-> [Verification Successful]
| | |
v v v
[Deny Request] [Request Info] [Data Collection]
|
v
[Exception Analysis]
|
[Exceptions Apply] <-+--> [No Exceptions]
| |
v v
[Partial Deletion] [Full Deletion]
| |
+-------+-------+-------+
|
v
[Notify Service Providers]
|
v
[Confirm Deletion]
|
v
[Send Response to Consumer]

3.2 Step-by-Step Procedure

STEP 1: REQUEST INTAKE

Timeframe: Within 24 hours of receipt

Responsible Party: Privacy Team / Customer Service

Actions:

☐ Log request in tracking system with unique ID

☐ Record receipt date (starts clock for response deadline)

☐ Document request channel and details

☐ Identify jurisdiction/applicable law based on consumer location

☐ Send acknowledgment to consumer within 10 business days (CCPA requirement)

Checklist:

STEP 2: IDENTITY VERIFICATION

Timeframe: Within 5 business days of receipt

Responsible Party: Privacy Team

Actions:

☐ Determine verification level required:
- Standard request: Match 2+ data points
- Sensitive data or high-risk: Match 3+ data points

☐ Verify identity using approved methods:
- Account login verification
- Matching provided information to records
- Signed declaration under penalty of perjury
- Third-party verification service

☐ Document verification process and results

☐ If verification fails, request additional information (provide 15 days to respond)

Verification Methods:

STEP 3: DATA DISCOVERY

Timeframe: Within 15 business days of verification

Responsible Party: Privacy Team / IT / Data Owners

Actions:

☐ Search all relevant systems for consumer's personal information:

☐ Document all personal information found

☐ Identify data owners for each system

STEP 4: EXCEPTION ANALYSIS

Timeframe: Within 5 business days of data discovery

Responsible Party: Privacy Team / Legal (if needed)

Actions:

☐ Review each category of data for applicable exceptions:

☐ Consult Legal if complex exceptions apply

☐ Document exception analysis

Common Exception Scenarios:

STEP 5: DELETION EXECUTION

Timeframe: Within 10 business days of exception analysis

Responsible Party: IT / Data Owners / Service Providers

Actions:

☐ Delete personal information from all systems where no exception applies

☐ Use appropriate deletion method based on system type:

☐ Document deletion for each system:

STEP 6: SERVICE PROVIDER NOTIFICATION

Timeframe: Concurrent with internal deletion

Responsible Party: Privacy Team / Vendor Management

Actions:

☐ Identify all service providers with consumer's personal information

☐ Send deletion directive to each service provider:

☐ Use Service Provider Deletion Directive template (see Section 5)

☐ Track confirmation from each service provider

☐ Follow up if confirmation not received within 15 days

STEP 7: RESPONSE TO CONSUMER

Timeframe: Within 45 calendar days of request (or extended deadline)

Responsible Party: Privacy Team

Actions:

☐ Prepare response letter using appropriate template:
- Full deletion confirmation
- Partial deletion with exceptions explained
- Denial with reason

☐ Include required disclosures per applicable law

☐ Send response via verified contact method

☐ Document response sent

3.3 Timeline Summary

Extension: Additional 45 days permitted when reasonably necessary (must notify consumer)

4. SPECIAL SCENARIOS

4.1 Household Requests

☐ Verify requestor has authority to request deletion for household

☐ Obtain consent from other household members if feasible

☐ Document basis for household authority

4.2 Authorized Agent Requests

☐ Verify agent authorization (written permission or power of attorney)

☐ Separately verify consumer identity

☐ Document agent verification

4.3 Employee/HR Data Requests

☐ Route to HR/Legal for review

☐ Consider employment law retention requirements

☐ Document employment-related exceptions

4.4 Data Subject is Deceased

☐ Verify identity of requestor and relationship to deceased

☐ Obtain death certificate or legal documentation

☐ Consult Legal on applicable law (some states extend rights to estate)

4.5 Legal Hold in Effect

☐ DO NOT DELETE data subject to legal hold

☐ Document that deletion was not completed due to legal hold

☐ Notify Legal

☐ Inform consumer that some data cannot be deleted at this time (without disclosing litigation details)

5. TEMPLATES

5.1 Service Provider Deletion Directive

[COMPANY LETTERHEAD]

DELETION DIRECTIVE TO SERVICE PROVIDER

Date: [DATE]
To: [SERVICE PROVIDER NAME]
From: [ORGANIZATION NAME]
Re: Deletion of Personal Information - Directive ID: [ID]

Pursuant to our Data Processing Agreement and applicable privacy law, we direct you to delete the following personal information:

Consumer Identifier: [ANONYMIZED IDENTIFIER OR ACCOUNT NUMBER]

Data to Delete:
- [SPECIFY DATA CATEGORIES]

Directive:

☐ Delete all personal information associated with the above identifier from your systems

☐ Do not retain copies except as required by law

☐ Confirm deletion within 15 calendar days

Compliance Required By: [DATE]

Please send written confirmation of deletion to [EMAIL].

Questions: Contact [PRIVACY CONTACT] at [PHONE/EMAIL].

Authorized By:
[NAME]
[TITLE]

5.2 Deletion Confirmation to Consumer

[See Data Subject Access Request Response Template for full response letters]

6. BACKUP AND ARCHIVE HANDLING

6.1 Production Systems

☐ Delete immediately from production systems

☐ Verify deletion through system query

6.2 Backup Systems

Option A: Delete from Backups

☐ If technically feasible, delete from backup media

☐ Document deletion from each backup set

Option B: Anonymize in Backup Rotation

☐ If deletion from backups is not feasible, ensure data is:
- Anonymized when backup is restored (if ever)
- Deleted when backup ages out of rotation

☐ Document backup retention schedule

☐ Ensure data is not restored from backup after deletion

Note: Under CCPA, deletion from backups is not required if:
- Backup system does not allow access to the specific data
- Data will be deleted when backup is accessed for restoration

6.3 Archive Systems

☐ Delete from active archives

☐ Document archive deletion

☐ Ensure archived data is not accessed after deletion

7. DOCUMENTATION AND RECORD KEEPING

7.1 Required Documentation

For each deletion request, maintain:

☐ Original request

☐ Verification documentation

☐ Data discovery results

☐ Exception analysis

☐ Deletion logs for each system

☐ Service provider notifications and confirmations

☐ Consumer response

☐ Processing notes

7.2 Retention of Deletion Records

☐ Retain deletion request records for 3 years

☐ Store in secure, centralized location

☐ Do not retain personal information in deletion records (use anonymized identifiers)

8. METRICS AND REPORTING

8.1 Metrics to Track

8.2 Reporting

☐ Monthly metrics to Privacy Officer

☐ Quarterly summary to Legal/Compliance

☐ Annual report to Executive team

9. ROLES AND RESPONSIBILITIES

10. ESCALATION

10.1 Escalation Triggers

☐ Consumer disputes denial

☐ Deadline at risk (>30 days elapsed)

☐ Legal exception unclear

☐ Service provider non-compliance

☐ Consumer complaint to regulator

10.2 Escalation Path

1. Level 1: Privacy Team Lead
2. Level 2: Chief Privacy Officer
3. Level 3: Legal Counsel
4. Level 4: Executive Leadership

DOCUMENT CONTROL

Approval:

This procedure is confidential and for internal use only. Questions should be directed to the Privacy Team at [EMAIL].