Playbook, mortgage broker
Erasure requests, and the records a broker may still have to keep
A mortgage enquiry generates a heavier data trail than most: income evidence, bank statements, credit information, and copies that have already travelled to a lender or an insurer. So a request to delete it is a bigger question than it looks, and the honest answer has two halves. There are rights of erasure in most data protection regimes, and there are retention obligations that sit on regulated firms and can outlast a customer's wish to be forgotten. The assistant can explain the route, and it must not promise the outcome.
Why this is not the general answer
The handling pattern for data deletion requests holds across every trade. What follows is the part that does not.
- The data in question is financial and unusually sensitive, so the person asking is often anxious rather than merely tidying, and the reply should acknowledge that rather than reciting a policy.
- Copies have frequently already left the broker for a lender, a valuer or an insurer, which means erasure is not a single act inside one business.
- Record keeping duties on regulated firms in most markets mean some material must be retained for a defined period regardless of a request, and pretending otherwise sets up a complaint.
- The request often arrives from somebody whose case did not proceed, which makes it a moment where the firm's conduct is being judged rather than a routine administrative task.
How it arrives
- please delete all my information
- i decided not to go ahead can you remove my details
- do you still hold my bank statements
- how long do you keep mortgage applications for
- who have you shared my information with
- can you take me off your mailing list as well
What has to be indexed for this to work
| Your privacy notice, written for applicants | What you collect, why, the basis for holding it, who it is shared with (lenders, insurers, valuers, referencing providers) and how long each category is kept. Applicants ask the sharing question specifically, because they did not expect their statements to travel. |
|---|---|
| Your retention periods, category by category | How long you hold enquiry records, application files and advice records, and the obligation behind each period. Stating the reason alongside the period is what makes a refusal to delete land as an explanation rather than as resistance. |
| How an erasure or access request is made and where it goes | The address it should reach, what you need in order to identify the person, and the period within which you respond. Data protection regimes in most jurisdictions attach a deadline to this, so it needs to arrive somewhere a person reads. |
| How marketing consent is handled separately | How somebody stops marketing without asking for erasure, and the fact that the two are different requests. A large share of these enquiries are actually about email, and separating them resolves them faster. |
The reply
You can ask us to delete your information, and the request goes to the address on our privacy notice so it is handled properly and within the response period. I should be straight with you about one thing: as a regulated firm we have to keep certain records, such as advice records, for a set period, so some material may be retained even where the rest is removed, and the notice sets out which and for how long. If it is only marketing emails you want stopped, that is a separate and much quicker request. Leave your name and email and I will pass this on today.
It confirms the right first, because a person who is told about exceptions before rights concludes the firm is dodging. The honesty about retention is deliberate: an unqualified promise to delete everything is the one that becomes a complaint. Splitting off the marketing case is practical, since a meaningful share of these requests are only ever about email.
Where it stops
The trigger. Any request to delete, restrict or find out about personal data, including a casual sounding one attached to another question.
This needs to go to the person who handles data requests rather than stay in a chat, because there is a response period attached to it. Leave your name and the email address we hold for you and I will pass it on today.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never confirm that anybody's data has been deleted, or that it was ever held.
- Never say what a lender or third party will do with information already sent to them.
- Never state a retention period that is not in your published notice.
- Never treat an erasure request as though unsubscribing from marketing satisfied it.
Questions
- Can it delete anything itself?
- No. It has no access to any system and cannot write into one, which is the correct position for a request with a legal deadline. It captures the request, sends it to the address you nominate and stores it, so it does not sit only in a chat log.
- Should it explain retention obligations at all?
- Yes, in general terms and drawn from your own published notice. A request that is answered with an unqualified yes and then partially refused in writing two weeks later produces a complaint that the honest version avoids.
- What if the person is upset about how their case was handled?
- Treat it as two things. Pass the data request on, and route the dissatisfaction to a person as well, because an erasure request arriving with a grievance attached is usually the grievance looking for a channel.
Keep reading
- Everything for a mortgage brokerProcess, documents and fees are safe to automate. Rates go stale fast and affordability cannot be answered generically.
- Handling data deletion requests in generalA deletion request is a request with a clock on it, not a question. The characteristic failure is silence, so it always has to reach a person.
- How much can i borrow, and why it goes straight to a personAffordability is assessed lender by lender, and a figure from a widget gets repeated to an estate agent. The trigger and the wording.
- Four separate bills, and a visitor trying to total themThe broker fee, the lender's product fee, the valuation fee and the conveyancing arrive from different places, and only one of them is ours.
- Two payments on one case, and only one arrives as a documentA fee falling due when the offer is issued, and a procuration fee the lender pays on completion which has to be disclosed but is never billed.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.