Foundation · 2 min
What you need to know
How should ecommerce stores handle customer data requests?
Use a documented intake, identity verification, scope, search, review, redaction, provider coordination, response and evidence process tied to applicable deadlines.
How can customers request access to their data?
Provide a clear privacy contact or request form and explain required identification and scope. Do not force people to create a new account merely to exercise a right unless justified.
How can customers request correction of their data?
Let customers identify inaccurate data, verify identity, correct authoritative records, and propagate the change to relevant providers while preserving required audit history.
How should customer-data deletion requests be handled?
Verify identity, locate data and obligations, delete or anonymize eligible records across systems, retain only justified exceptions and report completion or limits.
Does deleting a customer mean deleting every transaction record?
No. Transaction records may need retention for tax, accounting, disputes or fraud. Remove or restrict unnecessary personal identifiers while preserving required business evidence.
How should customer identity be verified before fulfilling a data request?
Use proportionate information already available or another secure channel, avoid collecting unnecessary new identity data, and apply stronger checks before disclosing sensitive records.
How should data requests involving third-party apps be handled?
Identify every app holding relevant data, send and track provider requests under contract, reconcile completion and explain any supported exception or delay.
A quick store check
Submit a controlled access request and verify identity checking, search scope, redaction, provider coordination and deadline tracking.
Foundation · 2 min
Frequently asked questions
Should every requester receive internal fraud notes?
Review access rights and permitted restrictions; disclose applicable personal data while protecting others and legitimate confidential information.
Can request deadlines be paused while an app responds?
Do not assume so. Track provider work inside the deadline applicable to the merchant.