When a customer asks for a copy of everything you hold
Somebody asks for everything you hold about them. The request takes one sentence; the answer is spread across messages, media, internal notes, contact records and logs - and the notes are the part that catches people out.
This is not legal advice. What follows is the engineering and operational shape of answering one; the scope of your obligations depends on your jurisdiction and your lawyer.
Where it hides
- The conversations, obviously - all of them, across every channel and every number.
- Media they sent, and media you sent them.
- Internal notes about them. Written by colleagues, never intended to be read by the customer. See internal notes.
- The contact record: tags, lists, opt-in state, custom fields.
- Delivery logs - what was sent, when, and what happened to it.
- Anywhere they were exported to. A CSV in somebody's downloads folder is still yours in the eyes of the obligation.
Build the export before you need one
The first request is always slower than expected, and the deadline is fixed. A button that assembles a customer's conversations, media and contact record into one archive turns a two-day job into a two-minute one - and it is the same machinery a customer needs when they leave your product entirely.
Identity, before anything
Verify who is asking. A data request is a request to hand somebody's conversation history to whoever sent an email, and "prove you are the person whose data this is" is not obstruction, it is the obligation working. Be proportionate: a message from the number that holds the conversation is strong evidence; an email from an address you have never seen is not.
Other people in the conversation
A group conversation contains other people's messages and numbers. Redacting or excluding them is normal and expected - handing over a group history to satisfy one member's request creates a second problem for everybody else in it.
Deletion is a different request
Access and erasure often arrive together and are not the same thing, and erasure has more exceptions - records you are required to keep, and records you need to defend a legal claim. What matters operationally is that your delete actually reaches everywhere the data went.
Questions people actually ask
Do internal notes have to be included in a data request?
Generally yes, where they are personal data about the person asking. This surprises people and it is the reason notes should be written as though the customer will read them.
How quickly must a data request be answered?
Regimes differ - a month is common, sometimes extendable. The practical point is that assembling the answer takes longer than people expect the first time, so build the export before you need it.
Njiwa
One inbox for WhatsApp, Facebook and Instagram, and an API that sends over either WhatsApp rail. 7 days free, no card.