How to handle GDPR and CCPA requests

Estimated 3 minute read

Updated Jun 9, 2025, 8:24 PM EST

Learn how to export a profile’s complete data or a record of deletion to share with customers when they contact you with a GDPR or CCPA request.

Export a profile's data

Navigate to the profile you want to export.
In the upper right, select Profile actions.
Click Export profile. A modal will appear prompting you to confirm your export.
Click Start export to export the profile data.

A green callout will confirm that the profile data is available on your Downloads page. To go there:

Select your account name in the lower left.
Click Settings > Other > Downloads.
On this page, click Download to export your profile data as a .zip file.

Record GDPR and CCPA deletion requests

When responding to a deletion request, you can choose to add a profile to your account's list of deleted profiles, preserving a record that your business has complied with the deletion request.

Only the most recent 20 deletions are shown in the list of deleted profiles. You can find other deleted profiles by using the search box.

For a profile's event history, any customer-specific information is replaced with the word "redacted," and then the customer's information is permanently deleted from Klaviyo. For every recipient record associated with a profile, the profile's email address is replaced with a random email address that starts with the word "redacted."

A Klaviyo campaign's analytics showing a deleted profile as redacted in the recipient activity

To delete a Klaviyo profile:

Navigate to the profile.
Open the Profile actions dropdown.
Click Delete Profile. A warning message will prompt you to confirm your decision.
Check the box on the warning message to specify that the contact requested their profile be deleted in compliance with a data privacy request.
Click Delete profile to add this profile to your account's list of deleted profiles.