Recognise the request
These requests can arrive in any wording, such as delete my account or send me my data. Tag them as privacy requests the moment you see them and move them out of the normal queue.
Verify who is asking
Confirm that the person owns the account before you act, using a method you already trust, such as a message to the account email. Never delete or send data on an unverified request.
Know the deadline
Many privacy laws set a time limit, often around a month. Note the date the request arrived and set a reminder well before it ends. Ask your legal adviser which rules apply to you.
Do the work in a set order
Find the data, decide what you must keep for legal or accounting reasons, delete or export the rest and check that the result is complete. A checklist keeps each case consistent.
Reply plainly
Tell the person what you did, what you kept and why, and when it was done. A clear, short note avoids follow-up questions and shows you took it seriously.
Keep a record
Write down the date, the steps and who did them. If anyone asks later, you can show what happened without relying on memory.