Why data requests need a proper process
Website owners often think data requests are only for big companies with large support teams. In reality, any business that collects names, contact details, order information or booking records should be ready to deal with access, correction and deletion requests.
Under South African privacy rules, people can ask what information you hold about them, request changes if it is wrong, and in some cases ask for deletion. If you do not have a simple internal process, these requests can pile up, get missed, or be answered in an inconsistent way. That creates avoidable risk and can frustrate customers who just want a straight answer.
The good news is that a practical process does not need to be complicated. It needs to be clear, recorded and followed every time.
What to collect before you act on a request
Before any correction or deletion takes place, confirm who is making the request and what exactly they want. Many delays happen because the request is vague. A person might say, “Remove my data,” when they only want marketing messages stopped or their delivery address corrected.
It helps to collect enough details to identify the person safely, but no more than necessary. Ask for the account email address, order number, booking reference, or another reasonable identifier. If the request comes through a web form, keep the form fields short and focused.
- Full name and contact details used on the site
- What type of request it is: access, correction or deletion
- Which record the request relates to
- Any deadline mentioned by the person
- How you verified their identity
A short intake form can save hours later. It also gives your staff a consistent way to sort simple queries from requests that need legal or technical review.
How to handle access requests without oversharing
An access request means the person wants to know what personal information you hold about them and how it is used. The safest approach is to give a clear summary and attach only the records that are relevant. Do not dump every internal note, draft message or system log into one message unless it is required.
For an online shop, this might include customer profile details, order history, delivery address, payment status and communication preferences. For a booking site, it may include the appointment record, the contact details used, and any consent given for reminders. If some information must be withheld for legal or security reasons, explain that in plain language.
Keep your answer practical. People should be able to understand what data you have, why you have it, and what happens next. If your team works from Gardens, Cape Town CBD or Sea Point, make sure everyone uses the same reply template so the tone stays consistent across the business.
- Confirm the request in writing
- Check whether the data can be shared safely
- Provide a structured summary, not a pile of files
- Record what was sent and when
- Keep the response within your internal time frame
Correction requests should update every linked record
Correction requests are often simple, but the follow through can be messy if your records sit in more than one place. A customer may ask you to update a surname, phone number, delivery address or company registration detail. Once corrected, that change should flow through your website form entries, client records, invoices, marketing lists and any third-party systems you use.
It is not enough to fix one screen and leave the old data in another file. That creates contradictions and can cause a parcel to go to the wrong street in Claremont or a statement to reach the wrong person in Bellville. If your records are duplicated, the correction must be applied everywhere it is relevant.
Use a simple checklist before you close the case:
- Update the main record first
- Check related records and exports
- Confirm whether the old data must be retained for audit or tax reasons
- Tell the person once the correction is complete
- Note who made the change and on which date
This is where small businesses often slip. Someone updates a spreadsheet, but the message platform or booking system is left behind, and the old information pops up again later.
Deletion requests need a clear retention rule
Deletion sounds simple, but not every request means every record must disappear at once. Some information can be removed because it is no longer needed, while other records may need to be kept for tax, accounting, dispute handling or legal compliance. The key is to know what can be deleted and what must be retained.
A practical way to manage this is to separate records into three groups: information that can be deleted immediately, information that must be retained for a lawful reason, and information that should be anonymised or archived. For example, a newsletter subscriber can usually be removed from marketing lists, but an invoice may need to stay in the accounting system for the required retention period.
Write down your rules before the request arrives. That way your team is not making it up on the spot, which is where mistakes happen. If a customer in Stellenbosch asks for deletion after a cancelled booking, your answer should explain what will be removed, what must remain, and why.
Be direct and respectful. People accept a refusal more easily when the reason is clear and lawful.
A local example from a Cape Town service business
Think of a small service business in Gardens that takes online bookings for home repairs. A customer submits a request asking to see all their personal information, then follows up asking for an old phone number to be corrected and past marketing messages to stop.
The business first confirms the identity of the requester, then pulls the booking record, invoice history and message consent details. It updates the contact number in the main client file, removes the person from the promotional list and keeps the invoice record for the required retention period. The owner also notes which systems were changed and sends a short written response explaining what was done.
That is a good example of how to stay practical. No drama, no guessing, just a steady process that protects both the customer and the business. In a town where many clients compare service quickly and expect replies fast, that kind of handling builds trust.
- Identify the request clearly
- Check the legal basis for keeping each record
- Make the change across all linked systems
- Explain the outcome in plain language
- Keep a record of the request and response
Keep your team ready before requests start coming in
The easiest way to manage data requests is to prepare before they arrive. Give staff a short internal process, a response template and a clear place to log each request. If different people answer customers on different days, everyone should follow the same steps. Otherwise one person may promise deletion and another may say the records must stay, which creates confusion.
Review your website forms, privacy notices and support workflow at the same time. Make sure people know where to submit a request and what information they need to include. If your business handles ecommerce, subscriptions, bookings or lead generation, build the process into your normal operations rather than treating it as an occasional admin task.
Handled well, access, correction and deletion requests become routine. That means less back-and-forth, fewer compliance headaches and a better experience for customers across Cape Town, Paarl and beyond.
