An account-erasure request arrives while an order is still unresolved

Match the request to one real account and one real order

Start by confirming which account, order or support thread the request actually concerns, using your normal authorized verification process. A name or email address can locate candidate records, but it does not prove that two records belong to the same person or that the requester is that person. Record how the match was established and leave uncertain matches unresolved rather than merging records to make the request tidy.

Then identify the unresolved obligation in concrete terms: an order awaiting fulfillment, a refund in progress, a replacement under discussion, a dispute with the payment provider, or a support case with a promised follow-up. Write down what remains to be done and which team owns it. An erasure action taken before this mapping can destroy the very records needed to finish the obligation, and a refusal issued before it can rest on a purpose the business does not actually have.

An open order is a purpose, not a blanket exemption

The ICO's guidance on the right to erasure describes erasure as conditional: it applies in defined circumstances and is subject to exceptions that require consideration, including how backups are handled. Its storage-limitation guidance says retention must be justified by a purpose and reviewed, and that moving data to offline storage is not the same as erasing it. Both pages are UK guidance; the law applicable to your business may differ, and this page does not determine it.

The practical consequence is narrower than either extreme. An unresolved order can give specific records a current purpose, and that purpose is evidence the decision owner weighs — it is not, by itself, authority to retain. Whether an erasure ground applies to a given record, whether an exception covers it, and what response deadline the applicable law imposes are determinations for the authorized privacy owner, with qualified advice where needed. The reviewable unit is the record category and its documented purpose, not the account as a whole.

For each category, ask whether the open obligation actually uses it. Order items, amounts and delivery details may be needed to fulfill or refund. Marketing preferences, old account metadata or analytics identifiers may have no connection to the open work at all. Where you cannot articulate a current purpose for a category, mark it for the decision owner rather than inventing one.

Inventory every system that carries the person's data

An erasure decision that covers only the store admin misses the copies that matter. List the systems an authorized administrator can identify: the store's order and account records, the support mailbox or helpdesk, the fulfillment or warehouse handoff, the payment provider's records, any shipping service, and any exports or backups under your control. For each, record the category of data and the owner who can act on it. Do not paste the customer data itself into this worksheet; references and categories are enough.

Note where your control ends. A payment provider's own records follow that provider's processes, and a fulfillment partner's copy follows yours only to the extent your agreement and instructions reach it. Record those as separate action items with their own owners rather than implying one store action erased them. Backups deserve an explicit line: the ICO notes backup treatment requires consideration, so record what your backup cycle is and leave the handling decision to the authorized owner.

Sequence the decision around the open work

For each record category, the decision owner has three practical branches: act now because no current purpose exists, hold where the owner determines that an applicable lawful basis or erasure exception supports retention, or escalate because the applicable retention duty is unclear. An open obligation using the record is evidence for that determination, not a substitute for it, and the request is not automatically deferred until the order completes. Where a hold is chosen, record the basis relied on, the trigger that ends it, such as the order reaching completion, the refund settling or the dispute closing, and name the person who will revisit the request then. A hold without a recorded basis and a trigger is an unmade decision.

Communicate to the requester only what has actually been decided and done. Receiving the request, verifying it, deciding it and completing the applicable actions are separate events, and a reply should not claim erasure of records that are being retained under a determination the decision owner has recorded or that sit in systems still being handled. Where the applicable law requires a response within a period, that deadline comes from the law, not from this page; have the decision owner confirm it with qualified advice.

If the recurring problem is that your store's data handling is undocumented and every request becomes an investigation, that is a storefront and operations question you can raise in a Prism consultation. Describe the systems involved and the mapping gap in ordinary language; confirm scope, responsibilities, fees and terms before work. Keep the customer's records, identity material and any request details out of the public inquiry form.

Erasure request mapping sheet

Complete one sheet per verified request. Record categories, purposes, owners and decision branches without copying customer data into the sheet. A row stays open until its decision branch and revisit trigger are recorded by the authorized owner. This sheet does not determine legal retention duties or promise deletion.

Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.

These are temporary notes. Leaving or reloading this page may clear them. Worksheet entries are not sent automatically. If you copy notes into the consultation message and submit the form, Prism receives them as part of your request.