Features
Part of Personal privacy rights guide: an overview
Tracking a fictional personal data access and deletion request case
Fictional privacy request case: identify a UK organization, scope access, verify identity, review the response, request deletion, and document a complaint.
What to take away
- Access can clarify what exists before a deletion request is finalized.
- The responsible organization and applicable jurisdiction must be identified first.
- A clear date range and account identifiers help without surrendering the full scope.
- Identity proof should use a verified, proportionate channel.
- A partial response should be reviewed item by item before complaint.
- The final file should preserve receipt, dates, explanations, retained data, and unresolved points.
This fictional case illustrates a UK request workflow using official guidance available during research. It is not a legal opinion, prediction, or account of a real person or company. Live requests require a current check because rules and guidance can change.
The old subscription
Nadia lives in Manchester. She canceled a fictional meal-planning subscription called Cedar Plate eighteen months ago. The app account no longer opens, but she still receives personalized email offers. A customer-service reply says a marketing partner may hold her preference profile.
Nadia wants to know what personal data remains, where it came from, who received it, and how long it will be kept. She also wants eligible account and marketing-profile data deleted after she receives the access response.
Identify the organization and law
The old receipt and saved privacy notice name Cedar Plate Services Ltd as the organization responsible for customer data. The current notice gives a privacy email and UK address. It also distinguishes the delivery provider and email vendor as service providers.
Nadia saves the current notice, old notice, cancellation email, recent marketing message, customer-service reply, and receipt. She records the date and URL for each. She does not send identity documents yet.
Sequence access before deletion
Immediate deletion could make it harder to see the source, recipients, purposes, and retention of the marketing profile. Nadia writes that she first seeks access to defined personal data and processing information. After the access response, she asks the company to complete the deletion portion for eligible data and explain anything retained.
Access first, then deletion
- Write access request for defined data
- Receive access response
- Request deletion of eligible data
- Explain anything retained
Her access scope covers:
- account and subscription records from a two-year period;
- email marketing preferences and suppression status;
- inferred food-interest profile fields;
- sources, purposes, recipients, and retention;
- records showing the account cancellation and later marketing selection.
She excludes meal recipes and generic newsletters that do not concern her.
Submit and record
Nadia emails the privacy address from the email formerly attached to the account. She includes her name, old customer number, subscription dates, postal code at signup, request scope, preferred electronic format, and a request for receipt.
What the email must include
- Name and old customer number
- Subscription dates
- Postal code at signup
- Request scope
- Preferred electronic format
- Request for receipt
The company confirms receipt the next day and gives reference CP-418. Nadia records both dates without deciding the legal due date from memory.
Handle identity proportionately
Cedar Plate asks for a full passport and utility bill through ordinary email. Nadia does not ignore the request. She asks why both full documents are needed when she wrote from the registered email and supplied a customer number, dates, and signup postal code. She asks for a secure portal and whether a redacted document will suffice.
The company agrees to verify her through a logged-in recovery link sent to the registered email plus the last four digits of the old payment card. Nadia completes that method and records the confirmation date. She sends no passport.
Review the access response
The company sends a password-protected archive and the password through a separate channel. It includes account details, orders, marketing events, and a profile table. The response says an email vendor received contact and campaign data, but it does not name the source of two inferred preference labels or give a retention period for marketing events.
Three issues to chase
- Source of two preference labels
- Retention period for marketing events
- Whether email vendor still holds events
The ICO's guidance on SAR responses describes UK response information such as purposes, sharing, retention, sources, correction or deletion options, objection or restriction, complaints, and certain automated processing details. It also explains that a response may provide personal data rather than every complete original document. Nadia uses that checklist and does not demand unrelated internal files.
She creates a three-row issue table for the missing preference sources, unnamed retention period, and whether the email vendor still holds campaign events. She replies under CP-418 instead of opening a new request.
Complete the deletion stage
Cedar Plate explains that the preference labels came from Nadia's past recipe clicks. It says marketing events are retained for three years, then aggregated. It agrees to delete the active preference profile, click-level events not needed for a suppression record, and the email vendor's matching data.
Deleted vs retained data
Deleted
- Preference profile
- Deleted
- Click-level events
- Deleted
- Vendor matching data
- Deleted
- Transaction records
- —
- Suppression entry
- —
- Correspondence
- —
- Security logs
- —
Retained
- Preference profile
- —
- Click-level events
- Suppression only
- Vendor matching data
- —
- Transaction records
- Tax period
- Suppression entry
- Minimal
- Correspondence
- Kept
- Security logs
- Defined period
The company retains transaction records for a stated tax period, a minimal unsubscribe suppression entry, the request correspondence, and security logs for defined periods. Nadia does not assume every retention decision is lawful merely because it is written.
The ICO's right to deletion page explains that UK erasure applies in specified circumstances and lists situations in which an organization may continue processing. Nadia uses it to ask which ground supports each retained category and when the category will expire. She does not demand deletion of a record that is legally required without considering the stated exception.
Raise the unresolved complaint
Cedar Plate explains the transaction and suppression records but gives no reason for keeping security logs for five years. Nadia sends an internal privacy complaint with the request, proof of receipt, identity exchange, responses, and a one-page issue summary. She asks for the purpose, legal basis, necessity, and retention decision for those logs.
The company replies that only a smaller fraud subset needs five years and shortens general access logs to one year. It gives the deletion date and confirms the written retention schedule was corrected.
Nadia records the outcome. She does not complain to the ICO because the company addresses the remaining issue. If it had not, she would verify the current ICO complaint steps and filing period before sending the indexed evidence.
Close the file
Nadia checks that marketing messages stop, the profile no longer appears in the supplied account view, and the final response lists retained categories and dates. These observations do not prove every backend deletion. They confirm the user-visible state and the company's written commitments.
She stores the correspondence and response securely, deletes the temporary extracted archive, and sets a reminder for the stated log-deletion date. The case closes with a clear record rather than a claim of total erasure.
Common questions
Why did Nadia not request immediate deletion?
She wanted access to sources, recipients, purposes, and retention before the eligible data disappeared from ordinary systems.
Was the passport request automatically unlawful?
The case does not reach that conclusion. Nadia questioned proportionality and obtained a lower-data verification method.
Did retained transaction data mean the deletion request failed?
No. The company deleted some categories and stated grounds and periods for others. Nadia reviewed each category separately.
Did the final account view prove backend deletion?
No. It supported a limited user-visible check alongside the written response and scheduled follow-up.
