A Customer Asked for a Copy of Their Data or Its Destruction: How Does Your Business Reply Lawfully and on the Record?

Which requests may a person make to your business?

The Law sets out the rights of the data subject, and the Implementing Regulation details the rules for exercising them. Five requests are the ones a small business or online store sees most, and each has a rule the employee receiving the request should know before replying.

• Access: the person sees the personal data you hold about them. The Regulation allows this on request, or through a tool the business provides that lets them reach their data automatically without a request, such as the account page in the store.
• A copy: the person asks for a copy of their data in a readable and clear format. As a rule it is provided in a commonly used electronic format, and they may ask for a printed copy where that is feasible.
• Correction: the person asks you to correct, complete or update their data. You may ask for supporting documents where necessary, provided you destroy them once verification is finished, and they may ask you to restrict processing of their data while you check its accuracy.
• Destruction: the person asks you to destroy their data that is no longer needed, without prejudice to the cases in which the Law requires it to be kept for a period.
• Withdrawal of consent: the person withdraws consent to the processing of their data at any time, and the business stops the processing that rests on that consent without undue delay. Withdrawal does not affect the lawfulness of what was done before it, nor processing that rests on a legal basis other than consent.

There is also the right to be informed, which is met mainly by the privacy policy published before or at the time of collection, not by answering a later request. If the data subject lacks full legal capacity, their legal guardian may exercise their rights on their behalf, and the business then verifies the guardian's standing before acting.

The checklist: from the request arriving to closing its file

The Implementing Regulation in force requires the controller to carry out rights requests without delay and within a period not exceeding thirty days. It may extend this by no more than thirty additional days if carrying out the request needs unexpected or unusual extra effort, or if it receives multiple requests from the same data subject, provided it tells the person in advance about the extension and its reasons. The steps below turn this duty into a daily routine a customer service employee can follow without waiting for the lawyer every time.

1. Set your receiving channels and announce them. The Regulation lists means the data subject may choose from, depending on what the business offers, including email, text messages, the national address, communication through electronic applications, or any other lawful channel the business sets up for this purpose. Name the same channels in your privacy policy.
2. Log the request as soon as it arrives. Give it a number, and record the date received, the channel, the type of request, the requester's name and the date the period ends. An oral request made by phone or in the shop is logged too, because the Regulation requires all requests to be documented and kept, including oral ones.
3. Verify the requester's identity before acting. The practical way is to match the account details, mobile number or email you already hold, and to ask only for what is enough to verify, so that verification does not itself become a new collection of data. If a guardian makes the request for a person lacking capacity, verify their standing.
4. Identify the data concerned and where it sits: the store's customer database, order history, payment system, marketing messaging tool, shipping company, and any provider processing data on your behalf under a data processing agreement.
5. Make the decision and record its reason in the log: full execution, partial execution, a reasoned refusal, or an extension with advance notice to the data subject.
6. Carry it out, then inform those concerned. On a correction, notify the parties you previously disclosed the data to. On destruction or withdrawal of consent, take appropriate steps to notify those you disclosed the data to and ask them to destroy it. On destruction, destroy every copy in your systems, including backups, having regard to the relevant legal requirements.
7. Send the written reply through the channel the data subject chose, and keep a copy in the request file.
8. Close the file in the log with the reply date and outcome, and keep the log as evidence of compliance if a complaint is made later.

What does the written reply state?

The written reply is what stays both in the customer's hands and in your file, so make it clear, specific and in plain language a non-specialist understands. It does not need long drafting, but it does need fixed elements, none of which should be missing.

• The request number, the date it was received, and its type as the business understood it.
• Exactly what was done: the data made accessible, the attached copy and its format, the fields corrected, the data destroyed, or the processing stopped.
• What was not done and why, with the basis stated briefly if execution was partial.
• The parties notified of the correction or asked to destroy the data, where that was required.
• Any data the business keeps because a legal basis requires it, and when it will be destroyed.
• The contact channel for any follow-up question.

When may a request be refused, and how is the refusal recorded?

Refusal is the exception, not the rule. It must rest on a ground in the Law or its Regulation, it must give reasons, and the data subject must be told. The cases set out in the Law and the Regulation in force include the following.

• A request repeated without justification, or one that needs extraordinary effort to carry out: the business may decline to process it, provided it gives reasons and the data subject is notified.
• Access or a copy that would harm the rights of others, such as intellectual property rights or trade secrets, or would disclose personal data identifying another individual. The safer course is to withhold the affected part and carry out the rest, rather than refuse the whole request.
• Restricting access where necessary to protect the data subject or others from harm, and not granting access in cases the Law sets out, including where it would endanger someone's safety, breach another individual's privacy, conflict with the interest of a person lacking capacity, or prevent a crime from being detected.
• A request to destroy data that a legal basis requires to be kept for a set period, or data closely connected to a case pending before a judicial body. Here you postpone destruction until the period ends or the judicial proceedings are complete, and you tell the data subject so.
• Withdrawal of consent does not stop processing that rests on a legal basis other than consent, such as fulfilling an open purchase order. Explain this to the data subject rather than ignoring the request.

The refusal is recorded in the same log: the reason as stated in the reply, the basis the business relied on, the name of whoever made the decision, and the date the data subject was notified. The Law allows the data subject to file a complaint with the competent authority, and a refusal without reasons or without a record weakens the business's position if a complaint arrives.

The privacy policy and the request pack: how do they work together?

The privacy policy is the published promise, and the request pack is how you keep it. When you collect data directly from the person, the Implementing Regulation requires you to tell them their rights, how to exercise them and how to withdraw consent, and this is usually written in the privacy policy. If the policy says a customer can ask for a copy of their data by email, your team must know what to do when that email actually arrives.

• Channels: the channels named in the policy are the same ones your team monitors and logs requests from.
• Rights: every right the policy mentions has a matching reply template and execution step in the pack.
• Withdrawing consent: the Regulation requires the withdrawal procedure to be as easy as, or easier than, the procedure for giving consent, so if consent took one click, do not make withdrawing it a formal letter.
• Retention: the retention periods, or the criteria for calculating them, stated in the policy are what you rely on when you answer a destruction request in part.
• Providers: your data processing agreements should ideally oblige your providers to help you carry out requests and to destroy what they hold when you ask.

That is why we recommend starting with a compliant privacy policy from template D-03, then linking it to the DSR Response Pack I-06, and in the same exercise reviewing the processing agreements with your providers and your store's cookie notice, so that every document says the same thing.

The draft Regulation amendments on Istitlaa: what do they propose for requests?

The Saudi Data and AI Authority (SDAIA) has published a draft titled Amendments to the Implementing Regulation of the Personal Data Protection Law on the Istitlaa platform, with comments accepted until 5 November 2026. We stress that it is a draft: nothing in it applies today, and its wording may change or it may never be adopted. What follows is our reading of the comparison table on the draft page, in our own words rather than its text.

• The draft keeps the period for carrying out requests as it is in the Regulation in force, and proposes an addition treating the lapse of the period without action as a refusal by the controller.
• The draft proposes an express reference, within the provisions on requests, to the data subject's right to file a complaint with the competent authority.
• The draft keeps the duty to document all requests, including oral ones, and the option not to process a repeated or burdensome request, provided reasons are given and the data subject is told.
• The draft proposes requirements for the privacy policy, including clear and simple language and publication in more than one language, Arabic among them.

What should you do now? Do not build your procedures on the draft, but learn from its direction: silence after the period ends is not a solution in any case, so keep to the period in force today and log every request and every reply. If you want to comment, participation is open on the Istitlaa platform until the announced date. We will update this guide and template I-06 if the final text is issued.

Frequently asked questions