A data subject request is a formal demand from an individual that a brand act on the personal data it holds about them, such as to access a copy of it, correct it, delete it, or stop a particular use. Privacy laws grant these rights and set a deadline for answering.
A member sends a request through whatever channel the brand has published, such as a web form, a privacy inbox, or sometimes a phone line. The brand verifies that the person is who they claim to be, locates every system holding their data, performs the action, and responds within the statutory window. Under GDPR that is normally one month. Under California law it is 45 days, extendable once.
Verification is the step that trips programs up. The brand has to be confident enough to act, without demanding so much new identification that it collects more data than it started with. For a loyalty program the usual approach is to authenticate through the member account itself, since the member already has credentials tied to the record in question.
The harder part is completeness. Loyalty data rarely lives in one place. A member record sits in the loyalty software, their email history in the marketing platform, their support tickets in the service desk, their scanned receipts in storage. A request covers all of it. A response that only clears the loyalty system is an incomplete response.
Deadlines are short and the clock starts when the request arrives, not when someone notices it. A brand without a defined path will spend most of its window working out who owns the problem.
For loyalty specifically there is a second reason. Members who request their data are often engaged rather than hostile. They are the people who care enough to ask. A clean, fast, legible response is a retention event. A messy one, or silence, converts an engaged member into a complainant with a documented grievance and a regulator to send it to.
Deletion also has a consequence specific to loyalty, because it wipes out an earned balance. That has to be disclosed before the fact, not discovered after.
A brand receives a deletion request from a member holding 4,200 points. The team verifies identity through the member's own account login, confirms the systems involved, which are the loyalty software, email platform, receipt image storage and service desk, and replies first with a short note stating that deletion will permanently close the account and forfeit the balance, and asking the member to confirm. The member confirms. Deletion runs across all four systems, and the brand keeps a dated record of the request, the disclosure, the confirmation and the completion.
Running deletion only where it is easy. Clearing the member record in the loyalty software while receipt images sit in storage and the address stays live in the email platform produces a response that is confidently wrong. The brand reports completion, the member keeps receiving email, and the gap between the two is the evidence in any complaint that follows. Map the systems before answering the first request, not during it.
Where TrueLoyal fits: Fan Club™ can export all of a member's data as a password-protected spreadsheet and permanently delete the member record, which covers the Fan Club™ portion of an access or deletion request. The brand coordinates the remaining systems.
This entry explains how data subject requests work in a loyalty context. It is not legal advice, and response procedures should be reviewed by qualified counsel in each market.
Under GDPR the standard window is one month from receipt, extendable by two further months for complex requests if the individual is told why. Under California law it is 45 days, extendable once by another 45. The clock starts when the request arrives, not when it is noticed.
Through the member's own account wherever possible, since the credentials are already tied to the record. The standard is to be confident enough to act without collecting significant new identification, because demanding extra documents means gathering more personal data in order to honor a privacy request.
In practice yes, because deleting the member record closes the account that holds the balance. Since that is a real loss to the consumer, the better practice is to disclose it and ask for confirmation before processing, while still honoring the request.
All of them. Loyalty data is typically spread across the loyalty software, the email or marketing platform, receipt or document storage, and the customer service desk. A response that clears only the loyalty system is incomplete, and incompleteness is what turns a handled request into a complaint.
GDPR consent for loyalty programs is the freely given, specific, informed and unambiguous agreement a member must provide before a brand can process their personal data for loyalty purposes. Consent has to be an active choice, recorded, and as easy to withdraw as it was to give.
CCPA compliance for loyalty programs is a brand's obligation under California privacy law to disclose what member data it collects, honor requests to access, delete or opt out of its sale or sharing, and publish a notice of financial incentive explaining why offering rewards in exchange for data is permitted.
Marketing opt-in is a member's explicit agreement to receive promotional messages from a brand on a named channel. It is a separate permission from joining a loyalty program, and it is granted per channel. Agreeing to email does not grant SMS.
The platform for consumer brands serious about earning loyalty. Rewards to shape behavior. Fan Club™ to nurture your brand's super fans.
