"Delete Account" button and GDPR related request by a user to delete his data

Question

Assuming I provide something like a "Delete Account" button on my webpage and/or App, which, after pressed by the user, deletes all his data, and I point this out in my privacy policy. If such a button is accessible after login, there is no requirement for any user identification process which would simplify things.

Now assuming a GDPR related request by a user to delete his data, do I have to do this, or can I ask the user to do it by himself (by pressing the Delete-button), or can I ignore the request because the user agreed to the privacy policy and should be aware of the button?

Answer 1

Assuming that the right to erasure applies to the data (it doesn't always) then you have to comply. Even if there is a valid exemption allowing you not to comply to the specific request you still can't ignore the request, instead you have to respond with the reason why the request has been refused.

Having a "Delete Account" button on the site is insufficient to replace responding - after all the user may not be able to access their account. It's not a bad idea per se, make sure that the button deletes the data in a GDPR-compliant way (including how any backup data is to be put "beyond use") and you may avoid most people making erasure requests in the first place. But if they do make them you have to respond.