Question handling
Delete my data, and what an assistant must do with it
This is the one question in support where the correct handling is defined partly by law rather than entirely by preference. Somebody asking you to delete their account is often also, without knowing the vocabulary for it, exercising a statutory right. Treating it as an FAQ that can be answered and closed is the specific mistake that turns an ordinary request into a complaint to a regulator.
What they are really asking
They want confirmation that a person has received the request and that something will happen, not a description of how deletion works in principle.
- delete my account
- i want you to delete my data
- how do i close my account
- i want to be forgotten
- what data do you hold about me
- can i get a copy of my data
- how long until my data is actually deleted
- does deleting my account delete my invoices
- remove me from your mailing list and delete everything
- who do i send a data request to
The material that answers it
An assistant is only as good as the document behind it, and for this question the document usually exists but is written in the wrong shape. What each one has to contain to be answerable:
| The retention section of your privacy notice | What you keep, for how long, and on what basis. This is the material that lets the assistant answer honestly about what survives a deletion, and it is usually the least maintained page a company has. |
|---|---|
| The deletion path inside the product, if there is one | Where the control is, what it removes immediately, what it schedules, and whether it can be undone inside some window. If there is no self service route, say so plainly and give the one that does exist. |
| What is retained after deletion, and why | Transaction records kept for a tax or accounting period, records kept to defend a legal claim, suppression lists kept precisely so that somebody who unsubscribed is not contacted again. Each is normal and defensible, and each surprises people who assume delete means gone. |
| How to make a request, and where it lands | The address or form, what to include so the request can be matched to an account, and the fact that a person receives it. The routing matters more than the wording: a request that arrives in an unwatched inbox is worse than no channel at all. |
| Your response commitment | Statutory deadlines for responding to erasure and access requests exist in most data protection regimes, and the exact period and the grounds for extending it depend on which law applies to your business. Publish the commitment you will actually meet and let the assistant quote that rather than improvise a timescale. |
How to handle it
Recognise it as a request rather than a question
The words delete my account are an instruction. An assistant that responds with a help article has answered a question nobody asked, and the visitor leaves believing they have started a process that has not started.
Configure this so that the reply always ends in a handover, regardless of how well the informational part went. This is one of the few intents where a complete, accurate answer is still an incomplete handling.
Explain what deletion actually does in your product
Whether the account disappears immediately or after a grace period, whether the content they created goes with it, what happens to material shared with colleagues, and whether the same address can sign up again afterwards. People ask for deletion and then discover they have also destroyed something they wanted, which produces a second and angrier conversation.
Be exact about what is kept, and say why
Vagueness here reads as evasion. A specific statement that invoices are retained for a defined accounting period, that a record of the deletion request itself is kept, and that an address may be held on a suppression list so marketing does not resume, is both more honest and more reassuring than a general promise to delete everything.
It also matters because the erasure right in most regimes is qualified rather than absolute: there are recognised grounds on which data is legitimately retained. Saying which ones apply to you is more credible than implying that none do.
Take it to a person every time, and say that you have
The reply should end with the request being handed over, the visitor knowing it has been, and a realistic date by which they will hear. The widget collects a name, an email and a message and sends it to the address you nominate, and it stores the enquiry so nothing is lost if the email fails to send, which for a request with a deadline attached is the property that matters most.
When it stops being an answer
Anything phrased in the vocabulary of the law
Subject access request, right to erasure, right to be forgotten, data protection officer, a named regulator. Somebody using these words has read something and is keeping a record of your response, and the response should come from whoever owns that process in your business.
A request about somebody else
A parent about a child, an executor about somebody who has died, an employer about a former employee, one partner about another. Whether the request can be honoured at all depends on authority that cannot be established in a chat window, and getting it wrong in either direction causes real harm.
A deletion request with a complaint wrapped around it
Delete everything you have on me and tell me how you got it is two requests, one of them angry. Both need a person, and the angry half sets the tone in which the other one is received.
How this one goes wrong
Answered, closed, and never actioned
The characteristic failure is silence dressed up as service. The assistant produces a clear, accurate explanation of your deletion process. The visitor reads it as confirmation that their request is in hand. Nobody in the company ever sees it. The clock the law attaches to the request runs anyway.
The cost is out of all proportion to the effort of avoiding it. A request that was never logged is indistinguishable, from the outside, from a request ignored on purpose, and the escalation route from there is a complaint to a supervisory authority rather than a bad review. Make the handover unconditional on this intent, and check that the nominated address is one somebody reads.
The same question, trade by trade
The pattern above holds everywhere. The wording, the escalation line and the material behind it do not, so there is a page per trade.
- For a dental clinicDental records carry a statutory retention period. What the assistant may explain, and why the request still has to reach a person.
- For a medical practiceMedical records cannot simply be erased. Explaining deletion, corrections and where a formal request has to go.
- For a physiotherapy clinicWhy most of a physiotherapy file cannot be erased on request, and what happens to a report already sent to an insurer.
- For a pharmacyA dispensing record has a retention period the pharmacy did not set, and a nomination is changed elsewhere rather than deleted here.
- For a law firmRetention periods, conflict records and identity evidence outlive a matter, so this is the one request a firm cannot simply agree to.
- For a accounting firmRetention duties, working papers and the identity records kept after a client leaves. What may be explained and why a person still decides.
- For a insurance brokerMarketing contact, client record and claims file are deleted on different terms, and the insurer holds a copy the broker cannot touch.
- For a mortgage brokerMortgage enquiries leave unusually sensitive records in several places. What the assistant explains about erasure, and what it must not promise.
- For a estate agencyReferencing packs, identity copies and rent ledgers. Some of it belongs to a landlord, some to a scheme, and some cannot go yet.
- For a recruitment agencyA CV holding is exactly what erasure rights were written for. How the assistant routes the request and separates it from unsubscribing.
- For a marketing agencyThe stranger writing to an agency is usually in a client's list rather than the agency's, and the assistant cannot even say whose.
- For a online storeClosing an account does not remove the sales records a seller has to keep. Separating the two is what makes this answerable at all.
- For a fashion retailerSaved measurements are body data and do not feel like an address. Deleting the history also deletes the proof behind a later claim.
- For a gymA health commitment statement, a year of barrier scans and an unpaid balance. Why deletion and a debt are handled as separate things.
- For a universityDeletion, access and correction requests arrive on the enquiries channel with a legal clock attached. Explain the route and never close the conversation.
- For a private schoolRegistration papers, assessment scripts and a reference from another school are different records, and a child cannot make the request.
- For a driving schoolLesson notes, licence details taken at the first lesson and two sets of hands holding them. Who a driving school request has to reach.
- For a online courseErase me and keep my certificate do not sit together. What a provider holds afterwards, and why lifetime access ends with the record.
- For a SaaS companyDeactivating a member is not deleting them. Backups, subprocessors and who is asking decide the answer, and none of it happens in chat.
- For a developer tools companyFor a self hosted install there is nothing on your side to delete. For the hosted one, request logs and telemetry each run their own clock.
- For a fintech appClosure does not end a retention duty. Why erasure here is partial by law rather than by preference, and why chat removes nothing.
- For a healthtech appA deletion request in health data carries deadlines and retention exceptions. What the assistant explains exactly, and routes immediately.
Questions
- Can the assistant delete an account when somebody asks?
- No. It does not write into any system. It can explain the process precisely and pass the request to a person, which for a request with a statutory deadline attached is the part that actually matters.
- What is the deadline for responding to one of these?
- That depends on which data protection regime applies to your business, and most set a defined period with limited grounds for extension. Publish the commitment you can meet, let the assistant quote it, and do not let it improvise a number.
- Should the assistant answer what data do you hold about me?
- It can describe the categories from your privacy notice, which is genuinely useful. It cannot tell an individual what is held about them specifically, and that version of the question is an access request that belongs with a person.
- Does this need to be separate from unsubscribing?
- Yes. Unsubscribing is a preference change and can often be self service. Deletion is a request with legal weight, and merging the two teaches the assistant to answer the second with the first.
Keep reading
- Handling password resetsAn assistant cannot reset anything. It can walk somebody through your real flow and name the step that usually breaks.
- Handling account access problemsLocked out, wrong email, a colleague who left, no admin remaining. Identity cannot be checked in a widget, so explain, collect, hand over.
- Handling accessibility requestsTwo different things arrive as one message. A published accessibility statement answers the first. The second is a request, and it needs a person.
- Every question typeHandling patterns for the questions every support inbox gets.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.