The Erasure Request Arrived. Now What?

Sooner or later someone asks you to delete everything you hold about them, or to hand over a copy. Here is how to handle access and erasure requests in your CRM calmly, on time and with a record of what you did.

The email is short and polite: please delete all personal data you hold about me. It lands on a Tuesday, and the first reaction in most small teams is a mild panic. Where is their data? The contact record, obviously. But also the old lead from the web form, the notes from two calls, the files someone attached, the messages in the inbox. Does deleting the contact delete those? Can anyone prove it was done?

Under the GDPR you generally have a month to respond. That is plenty of time if you know where to click, and very little if you have to find out.

Delete is not erase

In Swelis One, a normal Delete keeps history so it can be restored — useful when someone removes the wrong record by accident, and the reason the audit log can undo deletions. That is exactly what you do not want for an erasure request.

For that, owners have a separate action: ⋯ → Erase permanently (GDPR) on a contact, or Erase (GDPR) on a lead. It destroys the record with its full history, notes, files, activities and messages, plus the same person's leads — and it logs the erasure with the reason you give.

A routine for erasure requests

  1. Confirm who is asking. Make sure the request really comes from the person whose data it is.
  2. Check whether you must keep anything. Invoices and some contract records have legal retention periods; those are a reason to keep specific documents, not the whole relationship.
  3. Find every record. Search the CRM for their name, email and phone — leads and contacts can be separate.
  4. Erase, with a reason. Use the GDPR erase action, not Delete, and write the request date in the reason.
  5. Reply in writing. Tell the person what was erased and when.
A data request is not a crisis. It is a process you have not written down yet.

Access requests and your own data

The other common request is for a copy of what you hold. For an individual, the contact record, its timeline and its files are the place to start. For the workspace as a whole, Settings → Account → Export your data downloads a ZIP of everything: all records with their change history as JSON, plus every uploaded file. It is free and always available — useful as a backup, and the answer to "can we get our data out?" when someone evaluates you. How Swelis One itself handles your data is set out in our privacy policy and data processing agreement.

Build the habits before the request

  • Keep only what you use. Fields you never read are data you have to erase later.
  • Let the right people act. Erasure is owner-only by design; make sure the owner knows where it is. Everyone else gets exactly the access their job needs — see Who Can See What.
  • Record consent where it is given. Web forms and chat flows can capture it at the moment it happens.
  • Use two-factor authentication for everyone with access to client data.

Handled well, a data request takes ten minutes and leaves a clean record. That is the kind of process clients notice when they decide who to trust with their customers.

Curious what else is in the workspace? Our features page starts from the problem that eats your week and shows the feature made for it.