Q: A user emailed asking me to delete their data. What's the correct step-by-step?

A: Under GDPR this is a 'right to erasure' request, and you have about 30 days. Handle it cleanly:

— Step 1: Verify identity. Confirm the requester owns the data before deleting anything — don't let one person erase another's record.
— Step 2: Locate every copy. Your database, email list, CRM, backups, and any processor you forwarded the lead to.
— Step 3: Check for legal holds. Some data (transaction records) you must keep for tax/fraud reasons — keep only that, delete the rest.
— Step 4: Delete and tell your processors to delete. Forwarding the request downstream is your responsibility.
— Step 5: Confirm in writing to the user what was deleted and what was lawfully retained.
— Step 6: Log the request and your action. Proof you complied.

Short version: verify, find all copies, keep only legally required data, delete downstream too, confirm, log.

Still stuck? Drop your case in the comments.