WordPress Erasure Requests: A Complete UK GDPR Compliance Guide
17 August 2026
Fulfil WordPress erasure requests under UK GDPR in 2026. Learn step-by-step compliance, plugin tips, and ICO guidance for your site.
What Is a WordPress Erasure Request Under UK GDPR?
A WordPress erasure request occurs when an individual asks you to delete their personal data from your website, exercising their 'right to erasure' under UK GDPR. This can include user accounts, form submissions, comments, or any data you've collected via cookies or analytics. For UK site owners, the Information Commissioner's Office (ICO) enforces these rights. If your site is aimed at UK visitors or established in the UK, you must comply. An erasure request can be made verbally or in writing, and you must respond within one month. Understanding what counts as personal data and where it lives on WordPress is the first step.
Legal Requirements for Handling Erasure Requests in the UK
Under UK GDPR Article 17, you must erase personal data without undue delay when someone requests it, provided there's no legal basis to keep it. For WordPress site administrators, this means checking whether you have a lawful reason to retain data, such as tax records or ongoing legal disputes. You also have a duty to verify the requester's identity to avoid disclosing data to fraudsters. If erasure impacts other users' rights, you may need to balance interests. The ICO expects you to log each request, document your actions, and notify any third parties who have received the data. Non-compliance can lead to fines, regulatory action, and compensation claims.
Step-by-Step Process for Fulfilling an Erasure Request on WordPress
Start by verifying the requester's identity. Then use WordPress's built-in privacy tools, located under Tools > Erase Personal Data, to find and delete user data. For data outside the user profile, like comments or custom post types, perform a database search using a plugin like WP Crontrol or phpMyAdmin. Remove attachments and media associated with the person. Check third-party integrations, such as email marketing or analytics, and delete data there too. After erasure, disable your site cache to ensure no copies remain. Finally, email the requester confirming completion, and archive the request for your records. Remember to update backups to exclude the deleted data or delete old backups that contain it.
Using WordPress Plugins to Automate Erasure Requests
WordPress offers a native Erase Personal Data feature, but it only handles user accounts and some meta. For deeper erasure, plugins like GDPR Compliance & Cookie Consent, WP GDPR, and Complianz provide extended tools to scan custom tables, log requests, and anonymise data. These plugins can automate emails and generate audit trails, saving time. However, no plugin is a silver bullet—you must manually review custom code and third-party services. When choosing a plugin, ensure it's actively maintained, compatible with the latest WordPress version, and aligned with ICO guidance. Always test erasure workflows on a staging site first. Comprehensive plugin documentation helps you configure data mapping and retention schedules effectively.
Common Pitfalls and Best Practices for UK Site Owners
A frequent mistake is forgetting cached versions of your site—deleted data can reappear from CDN or server caches. Always purge all caches after erasing. Another pitfall is ignoring backups; if your backup contains personal data and you keep it for months, you risk non-compliance. Set a short backup retention policy, ideally no longer than 30 days. Also, ensure your privacy policy clearly explains erasure rights, as this is a legal requirement under UK GDPR. Best practice includes maintaining a data inventory, training staff, and creating an internal procedure for handling requests. Review ICO guidance yearly, as regulations and enforcement priorities evolve in 2026.
FAQ
Under UK GDPR, you must respond to an erasure request within one calendar month. If the request is complex or there are many requests, you can extend this by two additional months, but you must inform the requester within the initial month. Failing to meet deadlines can lead to complaints to the ICO and fines.