When a privacy request names your testimonials
Testimonials and Data Deletion Requests
"Please delete all the personal data you hold about me." If that person once gave you a testimonial, the request reaches further than the quote on your homepage: the recording, the contact record, the request emails, the notes your team made. Privacy laws such as the UK GDPR and California’s CCPA give people a right to ask, set response deadlines and allow some exceptions. This checklist, built from the regulator guidance we read, helps your team log the request, find every record and answer on time. Your privacy lead or counsel makes the legal calls.
- Start the clock and log the request on day one
- Scope every record, not only the published quote
- Checks cite the UK ICO and California CPPA pages we read
The problem, solved
Where testimonial teams get erasure requests wrong
No StoryProof page claims a deletion or export feature, so these fixes cover finding and withdrawing the data. Ask StoryProof support how stored records are deleted, and keep their answer with the request.
We treated it as a simple takedown
Pulling the quote from the homepage feels done, but the request was for all their personal data, and the recording, contact and emails are still held.
With StoryProof: Contacts and smart lists live in the same workspace as the testimonials, so the contact record is one more item on the list you search, not a separate system to forget.
Their testimonial is in three widgets
The same approved testimonial was picked for the homepage, the pricing page and a campaign widget.
With StoryProof: You choose which approved testimonials appear in each widget, so withdrawing it means removing it from each widget’s selection and checking the page afterwards.
The hosted page still shows them
The Wall of Love is easy to forget because nobody edits it page by page.
With StoryProof: The Wall of Love is a hosted page of your approved testimonials, so it belongs on the scope list every time and is checked by opening its link.
Reminder emails kept going out
The person asked for deletion, and a follow-up asking for a testimonial still arrived two days later.
With StoryProof: The follow-ups automation skips anyone who unsubscribed and stops once a testimonial arrives. On day one, unsubscribe the person or remove them from request lists so nothing else is sent.
Nobody can say where else it went
Copies in decks, social images and partner materials were never logged, so recipients cannot be told.
With StoryProof: Tags are on every plan. Tag each testimonial with every place you share it as it is approved, and the tag becomes your list of recipients to contact.
Flip the switch to see how StoryProof handles each one.
Team checklist
Work a deletion request that includes a testimonial
Tick each item as it is done and copy the summary into your request log. Cited items paraphrase the regulator pages listed under sources.
Ticks stay in this browser tab. Nothing is sent or saved.
Removal request or deletion request?
In StoryProof
Prepare the workspace before the first request
- You will need
- A named privacy lead or counsel
- A request log your team can reach
- 1
Tag where each testimonial goes
As each testimonial is approved, tag every place it is shared. That list is your scope and recipient list on the day a request arrives.
- 2
Keep contacts tidy
Request lists built from contacts make it quick to find the person and take them off every list.
- 3
Know how widget selections work
Withdrawing a testimonial means removing it from each widget’s selection. Practise once on a test widget so the team knows the steps.
- 4
Ask support about deletion in advance
Write to StoryProof support now to ask how stored testimonials, files and contacts are deleted, and keep the answer with this checklist.
What happens next: Review the log each quarter with your privacy lead. Patterns in requests often point at a wording or consent problem upstream.
Before you start
What this page does not decide
Not legal advice
The checklist paraphrases UK ICO and California CPPA pages read on 2026-11-13. Whether you must delete, and what you may keep, is for your privacy lead or counsel.
Other laws apply elsewhere
EU member states, other US states and other countries set their own rules and deadlines. Check the law that applies to you and the person.
No deletion claim for StoryProof
This page does not state how StoryProof deletes stored data. Ask support and record their answer before you confirm deletion to anyone.
Copies outside your control
Reshares, screenshots and archives elsewhere are outside your reach. Take the reasonable steps your privacy lead advises and say plainly what you could not remove.
Exceptions need a person
Freedom of expression, legal claims and other exceptions turn on facts. Never apply one without a documented decision.
FAQ
Questions people ask
Short answers to what usually comes up next.
Do we have to delete a published testimonial if someone asks under GDPR?
Often, but not always: the ICO lists exceptions such as freedom of expression and legal claims. Your privacy lead decides, and the decision and reason should be recorded.
How long do we have to respond?
Under UK GDPR, one month, extendable by two more for complex requests if you say so within the first month. Under the CCPA, acknowledge within 10 business days and respond within 45 calendar days, with one extension if you tell the person.
They made the request on a phone call. Does it count?
Under UK GDPR, yes: requests can be verbal and go to any part of the organisation. Log it with the date and what was said.
Can we keep their testimonial anonymously instead?
Ask your privacy lead. Whether an edited quote still identifies the person depends on what remains, and the request may cover more than the quote.
Does StoryProof delete the data for us?
This site has no verified statement on how stored data is deleted. Ask StoryProof support, follow their steps and keep their reply with your request record.
Still have a question? Ask the StoryProof team or book a demo.
Keep testimonials you can account for
Approve before publishing, tag every placement and keep contacts in one workspace, so a privacy request is a search, not a hunt.
Sources
- Right to erasure, Information Commissioner’s Office (UK). Checked 2026-11-13.
- Frequently Asked Questions, California Privacy Protection Agency. Checked 2026-11-13.
Last updated 2026-11-13.