If a user informs us that they no longer want to delete their data before we process the order deletion request, are we legally required to cancel it? Or can we modify, meaning delete the data regardless? (Though this is not preferred.) I basically want to ask whether we are forced to answer even if the user cancels the request? example procedure: A person requests deletion of data. An email is sent to them stating their data will be deleted in few days. The person replies that they never sent such a request and the other person was impersonating them. Can we then cancel the request and ask for compensation from impersonator?

  • 5
    If your scenario is true, then you actually have other issues in that your verification process is faulty and could expose PII, which may get the attention of regulators.
    – user28517
    Commented Feb 1, 2021 at 19:13

1 Answer 1


If you have reason to believe that the original request was (or might have been) fraudulent, in that it was from someone other than the data subject, you cannot treat it as a valid request. If the data has not yet been deleted, you should stop processing the request until you are able to verify whether the original request was or was not from the actual data subject.

After which you may want to consider whether your initial validation procedure needs to be changed, if the initial request was indeed from an impersonator.

Article 12 (section 6) says:

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

(Note: Deletions come under article 17, and so are within "Articles 15 to 21")

If, however, the case is simply that the data subject has changed his or her mind, and wishes to cancel a valid previous request, then the Controller is certainly entitled to cancel the request. If the controller is not otherwise required to retain the information, then the controller could optionally delete the personal data. (This in the case that there is no issue of impersonation.)

Can we ... ask for compensation from impersonator?

There is no provision, as far as I know, in the GDPR, that authorizes such compensation. It might be that under some other law such a suit would be authorized. That would probably be a matter of national law. But how much actual damage would there be? Proof of actual damage might well be needed for any recovery. And of course, one would need to identify the impersonator, and have good evidence that s/he had in fact committed an act of impersonation.

  • “If the controller is not otherwise required to retain the information” – such a requirement could for example be an Art 18 restriction of processing, which a data subject can request as an alternative to erasure under some circumstances.
    – amon
    Commented Feb 15, 2022 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .