How Should a Small Business Handle Customer Requests to See or Delete Their Data?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Set up one simple way for customers to ask to see, fix, or delete their data, or to stop marketing. Log every request, confirm who is asking, answer within the time your laws require, and keep a record of what you did. Federal law already requires you to honor email unsubscribes within 10 business days, and some states give customers broader rights, so check which rules apply to you.

What this means

A privacy request is when a person asks you to do something with the information you hold about them. The common types are:

Access: “What do you have on me?”
Correction: “My address is wrong. Fix it.”
Deletion: “Delete my information.”
Opt out: “Stop emailing me,” “Stop texting me,” or “Don’t sell or share my data.”

Some of these are required by law everywhere. The federal CAN-SPAM Act says you must honor an email opt-out within 10 business days, and you can’t charge a fee for it. Other rights, like access and deletion, come from state laws. California’s law, the California Consumer Privacy Act (CCPA), covers for-profit businesses that meet certain tests, such as annual gross revenue over $26,625,000 (the amount in effect since January 1, 2025). A growing number of other states have their own privacy laws with different thresholds.

Made-up example: Pine Ridge Lawn Care gets an email from a former customer asking to be deleted. The owner checks the customer list, the scheduling app, the email marketing tool, and the invoicing system. He deletes the contact from marketing and scheduling, keeps the paid invoices because tax rules require him to keep them for a time, and emails the customer a short note saying what was deleted and what was kept and why.

Why it matters

Unsubscribe rules apply to almost everyone. Missing the 10 business day window for email breaks federal law.
State laws can carry penalties. If a state privacy law covers you, it sets deadlines and fines.
Ignored customers complain in public. A one-star review that says “they won’t stop texting me” hurts more than the request ever would.
Data spreads. Without a data map, you’ll miss copies in your phone, email, or old spreadsheets.

Who this applies to

Every business that sends marketing email must handle opt-outs, and text messages have their own consent rules (see 18.4 Text Message Marketing Rules). Broad access, correction, and deletion rights mostly apply to larger businesses or businesses that handle a lot of personal data, but the thresholds vary by state. Even when no law requires it, answering these requests is good practice. Check your state attorney general or state privacy agency website to see whether your state has a consumer privacy law and who it covers.

How to do it

Pick one intake channel. A privacy email address or a form linked from your privacy notice (see 11.1.10 Privacy Notice). One channel makes requests easy to track.
Make a request log. Record the date received, the person’s name, request type, how you confirmed identity, who handled it, what you did, and the date closed.
Confirm who is asking. Match the request to information you already have, like the email on file. Don’t ask for more sensitive data than you need to verify them. This stops someone from getting another person’s data.
Find every copy. Use your data map (see 11.5 Data Map) to check your customer relationship management (CRM) system, email, scheduling, invoicing, and marketing tools.
Act on it. Send the data, fix it, delete it, or add the person to your do-not-contact list. For deletion, keep anything you must keep by law, like tax and payment records (see 9.8.2 Record Retention Periods), and say so in your reply.
Tell your vendors. If a vendor holds the data for you, ask them to make the same change (see 11.2.7 Data-Processing Terms).
Reply in writing. Say what you did and what you kept and why.
Meet the deadline. Email opt-outs within 10 business days. If the CCPA covers you, the California Attorney General says businesses must respond to requests to know, delete, or correct within 45 calendar days, and can extend once by another 45 days if they tell the customer. Opt-outs of sale or sharing have a shorter deadline. Other states set their own deadlines.

What proof to keep

The request log
The original request and your written reply
Notes on how you confirmed identity
Screenshots of the unsubscribe or deletion in each tool
Vendor confirmations

Keep these in a private folder with limited access (see 11.7.6 Least Privilege Access).

Common mistakes

Unsubscribing someone in one tool only. They stay on a second list and keep getting messages.
Deleting a customer and then re-importing them from an old spreadsheet. Keep a do-not-contact list that survives imports.
Deleting tax or payment records you’re required to keep.
Sending data to the wrong person because you didn’t confirm who asked.
Asking for a driver’s license copy just to process an unsubscribe. The FTC (Federal Trade Commission) says you can’t require more than an email address for an email opt-out.
Letting requests sit in a personal inbox of someone who left the business.

When to get help from a pro

Privacy attorney: if you sell online across many states, handle large amounts of personal data, or get a request you’re not sure you must honor. Questions to ask:

Does any state consumer privacy law cover my business, based on my revenue and the data I handle?
What can I lawfully keep after a deletion request?
How should I verify identity for access requests?

Bill’s note

[Bill: add a short note. For example, how SiteSmarty handles a client who asks to be removed from your email list, or a time a business you helped kept texting someone who had opted out.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: setting up the SiteSmarty privacy request inbox and log]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the request log and one closed test request]
[Result so far:]

Questions people ask

Does the California privacy law apply to my small business? Only if you meet one of its tests. One is annual gross revenue over $26,625,000. Others are based on how much personal information you buy, sell, or share. Check with the California Privacy Protection Agency or an attorney.

How fast do I have to answer? Email unsubscribes within 10 business days under federal law. Other deadlines depend on your state law. Under the CCPA, most requests get 45 calendar days, with one 45 day extension.

Do I have to delete everything? No. You can keep records the law requires you to keep, like tax records. Tell the customer what you kept and why.

How do I handle unsubscribe requests? Remove the person from every marketing list and tool, add them to a do-not-contact list, and log the date.

Audit check

Question: Does the business have one channel, a written log, and a set process for privacy requests, and does it meet its deadlines?
Pass looks like: A privacy email or form linked from the privacy notice, a request log with dates, identity checks, actions taken, and replies sent on time.
Fail looks like: No way to submit requests, requests lost in personal inboxes, opt-outs honored in one tool only, or no replies.
Evidence to collect: The request log, sample replies, the do-not-contact list, and screenshots of the opt-out in each marketing tool.

Where this fits

Do this first: 11.5 Data Map, 11.6.2 Sensitive Information, 11.1.10 Privacy Notice

Do this next: 11.6.6 Breach Notification

Sources

Federal Trade Commission, "CAN-SPAM Act: A Compliance Guide for Business" (checked October 17, 2026)
California Privacy Protection Agency, "Updated Monetary Thresholds in CCPA" (checked October 17, 2026)
State of California Department of Justice, Office of the Attorney General, "California Consumer Privacy Act (CCPA)" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.