Privacy access and deletion request

How do we handle a data access or deletion request with the requester verified, the request run across every system, and the response sent on the legal clock?

Treat each privacy request as a case with a verified requester, a scope and a deadline. When a request arrives (from the privacy form, an email, an authorized agent, or a customer in any channel), Callvu classifies it (access, deletion, correction, portability, opt-out of sale or sharing, limiting sensitive data use) and the law that applies from the requester's location and the business's obligations (GDPR, CCPA and the other state laws), verifies the requester at the level the request and the law require (the account's authentication, a code to the contact on file, more for a deletion or an agent's request), chases a missing verification or an agent's authorization, runs the request across every system that holds the person's data (the order management, the marketing, the loyalty, the support, the analytics and the processors) through their interfaces, applies the exceptions (the records the law requires to be kept, the fraud and legal holds), routes a conflict or an exception question to the privacy office in the Decision Desk, sends the response in the required form inside the deadline, and logs the request and the outcome for the regulator's metrics.

In scopeComplex: multi-party handoffsCallvu moves: chase and verify, classify, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The deletion was confirmed to the customer, and their data kept arriving in the marketing emails from a system nobody had listed.

Today, without Callvu

Privacy requests arrive from a form and land on one person with a spreadsheet of systems. The requester is verified by replying to the email, or not at all. Each system's owner is asked by message; some answer; the response goes out late or incomplete; the deletion misses the marketing platform, the analytics vendor and the processor, and the customer discovers it from the next campaign. The regulator's metrics the law requires are a guess.

The laws set the request types, the verification standard, the deadlines (one month under GDPR with an extension, forty-five days under CCPA with one extension), the exceptions (the records that must be kept for legal, fraud or transaction reasons), the response form, the authorized agent rules and the reporting metrics. The systems that hold the data are known, or should be, and each has an interface. A request run as a case across the systems, with the exceptions applied and the deadline on it, is complete and provable.

A deletion that reaches every system is the only kind that was a deletion.

How it runs

From the requestto the system of record.

A privacy request arrives from the privacy form, an email, an authorized agent, or a customer in any channel. Callvu opens the case and starts the clock.

Requester or authorized agent: Verifies identity (and the agent's authorization), specifies the request, and receives the response.
Privacy office: Decides conflicts and exception questions in the Decision Desk and owns the metrics.
System owners and processors: Execute the request through their interfaces or confirm it through their links.
Callvu: Classifies, verifies, chases, runs the request across systems, applies the exceptions, routes, responds and logs.

Classify and verify
The request type (access, deletion, correction, portability, opt-out of sale or sharing, limit sensitive data use, a children's data request), the applicable law from the requester's residence and the business's obligations, the deadline and the response form are classified; the requester is verified at the level the law and the request require (the account's authentication for a logged-in customer, a code to the contact on file, matching data points the business holds, a document check for a deletion where the risk warrants it), and an authorized agent's written authorization and the consumer's confirmation are collected; a missing verification is chased with the deadline tolled only where the law allows.
Chase and verify across systems
The request is run across every system in the data map that holds the person's data (the order management system, the marketing platform, the loyalty system, the support system, the analytics and advertising vendors, the payment processor's token, the warehouse and the drop-ship vendors) through their interfaces, with a system owner or a processor confirming through a link where no interface exists; each system's result is read and checked (the data returned for an access request in the categories the law lists, the deletion or anonymization confirmed, the opt-out applied), and a system that has not confirmed is chased inside the deadline.
Apply the exceptions and decide
The exceptions are applied by rule (the transaction records kept for the legal retention period, the fraud and security records, the legal holds, the data needed to complete a pending order or a warranty), with the response stating what was kept and why; a conflict (a deletion that would remove a record under a legal hold, a request the business cannot verify, a request that is manifestly excessive, an agent without a valid authorization) goes to the privacy office in the Decision Desk with the case and only the allowed outcomes (fulfil, fulfil in part with the reasons, request more information, or refuse with the reasons and the complaint rights).
Respond and write back
The response is sent in the required form inside the deadline (the access package in a portable format, the deletion confirmation, the correction, the opt-out confirmation) with the information the law requires about what was done, kept and why and the complaint rights, and the case with its dates, the verification, the systems' confirmations, the exceptions and the outcome is logged in the privacy register, the system of record for the regulator's metrics, with the order management and the marketing systems updated.

Where it ends: The request was classified under the right law, the requester verified, the request executed and confirmed in every system that holds the data with the exceptions applied, the response sent in form inside the deadline, and the case logged for the metrics. The Decision Trace shows the classification, the verification, each system's confirmation and any decision; the Audit Trace shows the receipt, the chases and the response with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

GDPR: The General Data Protection Regulation gives data subjects the rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21), to be answered without undue delay and within one month, extendable by two further months for complex or numerous requests with notice; the controller must verify the requester's identity with reasonable measures, provide the information free of charge unless requests are manifestly unfounded or excessive, apply the exceptions (legal obligations, legal claims, freedom of expression), and inform processors and recipients of an erasure; the data subject may complain to the supervisory authority.
CCPA: The California Consumer Privacy Act as amended by the CPRA gives consumers the rights to know and access, to delete, to correct, to opt out of sale or sharing, to limit the use of sensitive personal information and to non-discrimination; a business must respond within forty-five days of receipt, extendable once by forty-five days with notice, verify the consumer's identity to a reasonable or reasonably high degree of certainty depending on the request, honor authorized agents with written permission, apply the deletion exceptions in the statute, provide the access response in a portable format, and keep records of requests and their handling for twenty-four months with metrics published where the business meets the thresholds.
Other state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the others) and the children's privacy rules (COPPA): The other state laws grant similar rights with forty-five day response periods and their own exceptions and agent rules, several require honoring universal opt-out signals, and COPPA governs the deletion and parental access rights for children under thirteen; the classification applies the law for the requester's residence.

Company policies

Every request is classified with its law and deadline on arrival, and the requester is verified before any data moves.
The request runs across every system in the data map, and each system confirms; nothing is complete on a promise.
The exceptions are applied by rule and stated in the response; the privacy office decides conflicts.
The privacy register is the system of record for the request and the metrics, with the order management and marketing systems updated.

Controls

Request and law classification with deadline.
Risk-based requester and agent verification.
Execution across the data map through interfaces and owner links.
Confirmation reading and chases.
Exception rules and Decision Desk for conflicts.
Timed response in form and register logging.

Clocks and deadlines

GDPR response: One month from receipt, extendable by two months with notice.
CCPA response: Forty-five days from receipt, extendable once by forty-five days with notice; the receipt confirmed within ten business days.
System confirmations: Chased inside the deadline with escalation to the owner.

Documents and checks

The request and its classification
The verification and any agent authorization
Each system's confirmation
The exceptions applied and any decision
The response and the register entry

In the Decision Trace

The classification and the law.
The verification level and the exceptions applied.
Any decision with the person.

In the Audit Trace

The receipt with time.
Each system's execution and confirmation with time.
The response with time.

The handoff

Between the front doorand the back office.

The front door

The privacy form, an email, an authorized agent, or any channel, with a secure link for the verification.

The back office

The privacy office decides only conflicts and owns the metrics; system owners confirm through links where no interface exists.

The Decision Desk

A deletion against a legal hold, an unverifiable requester, a manifestly excessive request or an agent without valid authorization goes to the privacy office in the Decision Desk with the case and only fulfil, fulfil in part with reasons, request information, or refuse with reasons and rights.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

How is the requester verified?

At the level the law and the request require: the account's authentication, a code to the contact on file, matching data points, or a document check for a high-risk deletion; an authorized agent provides written authorization and the consumer's confirmation.

How is a deletion proven complete?

By running it across every system in the data map through their interfaces and reading each system's confirmation, with owners and processors confirming through links where no interface exists, and the exceptions stated in the response.

What are the deadlines?

One month under GDPR with a possible two-month extension; forty-five days under CCPA and most state laws with one extension; the clock is on the case from receipt.

Related processes

Marketing consent capture and change Account recovery and takeover Traveler profile setup and update Age verification for restricted products Try it in the sandbox All travel and ecommerce processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.