Let people see and delete their data

How to do it

Offer a clear contact or a self-service page, and check who is asking before you hand over data. Export in a common format such as JSON or CSV. Delete from the live system, then from backups as they expire. GDPR Article 12 sets one month to answer requests under Articles 15 to 20. Keep a map of where personal data lives, keyed by the person's ID, in every table and store. Build one tested export function and one delete function on that map. GDPR Article 12 allows two more months for complex requests if you tell the person why.

Example

{ "account": { "email": "anna@example.com", "created": "2026-03-02" }, "orders": [ { "id": "1001", "total": "49.00" } ] }

How to check

Create a test person with data in every store. Ask for their data and then for its deletion. The export is complete. A search of every store finds no trace of their ID or email, except records the law requires.