A Customer Access or Deletion Request: Who Receives It, What to Search, What to Record

This is a technical and operational description of a working process, not legal advice. What must be disclosed, what may be refused and what any step means legally all go to legal counsel. What can be described with a source: what the regulations set about how a request is submitted and the timelines, and what a process capable of meeting them looks like.

What the regulations set

The Privacy Protection Regulations (Conditions for Inspecting Information and Procedure in an Appeal against a Refusal), 5741-1981 provide that a person seeking to inspect information submits to the database owner a written request, signed by them. They further provide that a party refusing the request notifies the applicant within 21 days of receiving it, and that the Registrar may extend this by a further 15 days in specified cases. They also provide that a failure to respond within the period is treated as a refusal, and that the applicant has a right of appeal to a district court within 30 days.

It matters to say what this is not: it is not a complete picture of today's obligations. Amendment 13 to the Privacy Protection Law came into force on 14 August 2025, and its effect on the process is exactly what to establish with legal counsel and against the Privacy Protection Authority's publications.

Why this fails operationally rather than legally

Almost no business fails such a request because it refused. The ordinary failure is simpler: the request arrived at an address nobody reads, or nobody knew what to do with it, so three weeks passed with no response.

The second failure is an inability to answer. A business holding data about a customer in five places - the order system, a mailbox, WhatsApp, a salesperson's spreadsheet, and an old backup - cannot say what it holds on a given person without a week of searching. That is not a matter of willingness but of mapping, which is exactly what is described in a personal data map for a small business.

The process that has to exist

1. One intake point - an address or form defined for this and actually read.
2. Immediate logging - date received, who asked, and what they asked for.
3. Identifying the applicant - confirming this is the person the data relates to.
4. Searching by the data map - going through every system on the list, not through memory.
5. A decision with counsel - what is disclosed, what is not, and on what reasoning.
6. Response and record - what was provided, when, and by whom.

Step two is the only one that sounds redundant and is the most critical: a recorded receipt date is what makes the timeline measurable. Without a date there is no way to know whether three days remain or the deadline has passed.

What to keep from the process itself

The fourth row is the one that protects the business. A request answered partially because nobody remembered a particular system looks identical to one answered partially on purpose - and recording the systems searched is the difference between the two.

What to prepare before the first request arrives

Nearly all the work in this process can be done in advance, and that is the difference between answering in days and answering in weeks:

1. Define one intake point and publish it where a customer can find it.
2. Name a responsible person, and a deputy for absences.
3. Keep a current list of every system holding customer data.
4. Know which outside suppliers hold data on the business's behalf.
5. Agree with legal counsel in advance what the decision route is when a request arrives.

The third is the heaviest and the only one that cannot be deferred, because without it every other step describes a process with nothing to act on. The rest is an hour of work.

What about a deletion request

Deletion is not the same as inspection, and it is operationally harder: some data has to be retained for other reasons, some sits in backups, and some sits with outside suppliers. Each of those questions - what is deleted, what is retained and why - is one for legal counsel and the accountant, not for an internal ruling.

What can be prepared in advance is the technical side: knowing which suppliers hold data on the business's behalf, and what each of them allows. A business that knows this can answer within days; one that does not will discover it mid-process, and that is exactly what stretches the process past the timeline.

When the request comes from an employee or a former one

This is a separate case and more common than it seems, and it differs for two reasons. First, the volume of data is larger - an employee file usually holds far more than an order system holds about a customer. Second, some of the material also concerns other people.

Operationally that means the same process runs, with two additions: search the systems holding employee data as well as customer data, and take advice before disclosing where documents mention other people.

What may and may not be disclosed in each of those cases is a question for legal counsel rather than a call made by whoever is handling it. What is operational is knowing in advance where that data sits, which is part of digital employee records.

How long does it actually take?

At a business with a data map, locating is an hour or two and the rest is decision and response. At a business without one, the first stage alone is days - so the investment that pays is not in the response process but in the mapping done before it.

That is also the logic behind the recommended order: first know where the data is, then write a procedure. A procedure written without a map describes steps that cannot be carried out.

Sources

• Privacy Protection Regulations (Conditions for Inspecting Information), 5741-1981
• Israel Privacy Protection Authority
• A personal data map for a small business
• Amendment 13 and the customer spreadsheet
• Book a call