How to handle GDPR and CCPA requests

You will learn

Learn how to export a profile’s data and record a profile deletion when customers contact you with a GDPR or CCPA request.

Your user role determines whether you can export or delete profiles. If Export profile or Delete Profile is unavailable, ask your account Owner or Admin for help.

Export a profile's data

1. Navigate to the profile you want to export.
2. In the upper right, select Profile actions.
3. Click Export profile. A modal will appear prompting you to confirm your export.
   

4. Click Start export to export the profile data.
   

A notification confirms that your export has started. Click View all downloads to open the Downloads page, or navigate there manually:

1. Select your account name in the lower left.
2. Click Settings > Other > Downloads.
3. Wait until Processing changes to Download for the profile export, then click Download to save the profile data as a .zip file.

Record GDPR and CCPA deletion requests

When responding to a deletion request, you can keep a record in your account’s list of deleted profiles. The record includes the request date and, once deletion finishes, the completion date.

When you delete a profile, Klaviyo redacts identifying information in its event history and permanently deletes the profile. In campaign recipient activity, a deleted profile’s email address appears as a random email address that starts with the word "redacted."

Deleting a profile cannot be undone. If you also need a copy of the profile’s data, finish downloading the export before deleting the profile.

To delete a Klaviyo profile:

1. Navigate to the profile.
2. Open the Profile actions dropdown.
3. Click Delete Profile. A warning message will prompt you to confirm your decision.
   

4. Select Delete profile in compliance with data privacy request to keep a record of the request. Without this selection, Klaviyo deletes the profile without adding a deletion-request record.
5. Click Delete profile to start deleting the profile and add a record to your account’s list of deleted profiles.

A Delete started notification confirms that the request was submitted. The profile remains accessible until deletion finishes. Your list of deleted profiles keeps a permanent record of the request.

Open your list of deleted profiles directly, or follow these steps:

1. Select your account name in the lower left, then navigate to Settings > Other > Profile maintenance.
   

2. Under Remove Profiles, click here in the sentence about profiles deleted in compliance with data protection laws.

On Deleted Profiles (Data Protection Requests), find the profile and check Completion Date to confirm that deletion has finished. The list displays names as initials and partially hides email addresses, phone numbers, and external IDs.

Additional resources