UCPA Step 04: Erasure Requests for UCPA

The right to deletion requires the same broad steps as the right to access but with some additional considerations:

1. Provide users with ways to submit their access requests

To fulfill this obligation, you must provide your consumer in your Privacy Notice of one or more secure ways to submit a request. Typically these are:

• A form or privacy center to automatically accept requests from consumers.
• An email address or customer support system to intake consumer requests.

2. Collect information necessary to identify users

As the business receiving the request, you are responsible for verifying the identity of the consumer.

To minimize privacy risks, you should not request additional information that you do not already have to verify their identity. For example, if you don’t already have their driver’s license, don’t ask for it to process privacy requests.

The most common method to verify a user’s identity is sending a verification code to their email address or phone number. This MFA code allows you to ensure that the consumer making the request is who they say they are.

3. Delete their personal data from your systems

After approving users' deletion requests, you must then delete all of their data from your business systems to the third-party vendors you employ.

If you are doing this manually, be very careful to ensure you are not deleting confidential company information, information necessary for reporting or regulatory purposes, or data belonging to other users.

Note: you may retain personal information for regulatory obligations. For example, if you’re a retailer, you may need to retain order history information and the consumer's state of residence to calculate taxes for reporting purposes.

The deletion request process can be costly, labor-intensive, and risky. Therefore we strongly recommend using an automated system such as the Fides privacy engineering and intelligence platform to automate this process end-to-end for you.