# A contact sends a GDPR deletion request: what a small sales team does in Pipedrive

https://salesbond.app/blog/pipedrive-gdpr-deletion-request/
Published: 2026-10-06 · Updated: 2026-10-26

Treat a GDPR deletion request as a small project with one owner: find everywhere the person appears, decide what has to go, delete or anonymize it, and write down what you did and when. Pipedrive’s own help describes you as the data controller for your contacts and Pipedrive as the processor, so the request is yours to handle, not theirs ( [Pipedrive and GDPR](https://support.pipedrive.com/en/article/pipedrive-and-gdpr)). The deleting itself takes a few clicks. The finding and the deciding are the actual work.

One note before anything else: this is not legal advice. The deadline you have to answer by, and the cases where you may keep some data anyway, come from the law and from your lawyer, not from this article.

## The email lands in a rep’s inbox on a Tuesday

Picture Kira, a rep on a four-person team, who gets a two-line reply to an old follow-up (“Please delete all my personal data and confirm when it’s done”), deletes the person in Pipedrive and writes back “done”. Three weeks later the same person complains to the founder, because a colleague emailed them from a webinar spreadsheet exported in spring.

The request was treated as a click. It is a search.

## Who answers, and why it isn’t the rep

Pick one owner per request, and make it the person who can see the whole account. On a small team that is usually the sales manager or the founder, for a plain reason: in Pipedrive, deleting a person or an organization needs admin settings, and deleting deals or activities needs a permission the admin has switched on in Settings > Manage users > Permission sets ( [How can I delete items in Pipedrive?](https://support.pipedrive.com/en/article/how-can-i-delete-items-in-pipedrive)). “I deleted what I could see” is not a confirmation you want to send.

Before anything gets deleted, make sure the request really comes from the person. The simplest check: reply to the email address already on their record and ask them to confirm.

The rep still has a job. Forward the request to the owner the same day, do not reply to the person yourself beyond “received, we’re on it”, and do not touch the record. If the rep deletes the person first, the owner loses the easiest map of where else that person appears: the deals, notes and emails linked to the record.

Say it once at a team meeting, plainly: “A delete-my-data email goes to me within the day. You don’t answer it and you don’t delete anything.” That sentence covers most of the the risk. When a customer asks for paperwork before signing instead, here is how a [data processing agreement in a sales deal](https://salesbond.app/blog/data-processing-agreement-sales-deal/) fits into the CRM.

## One person, many places

Open the person’s detail view and you see the obvious trail: deals, activities, notes, emails, files. Deleting the person does not take all of it. Pipedrive’s help says that deleting an item also deletes its linked historical information, with the examples of invoices, notes and attachments, and that admins can restore it within 30 days; after that it is gone for good ( [How can I delete items in Pipedrive?](https://support.pipedrive.com/en/article/how-can-i-delete-items-in-pipedrive)). The deals themselves stay in the account. So the record is the easy part, and the deals are where the person keeps living.

The hard part is everything that is not linked to this one record. Start with duplicates. Someone who wrote from a work address one year and a personal one the next is often two people in Pipedrive, sometimes three. Search by last name, company and phone, not only by the email the request came from. Delete one twin, confirm, and the other keeps getting sequences; here is [how duplicate records in Pipedrive happen and how to find them](https://salesbond.app/blog/duplicate-records-in-pipedrive/).

Then the notes on deals. The help page mentions that when a deal is deleted, notes linked to both the deal and a person are not deleted if the person remains active. In our reading, that is a hint at the bigger problem: a note on a deal can describe the person in detail (“spoke with the CFO, she’s leaving in March, personal mobile is…”) while being attached to the deal and an organization, not to the person. Open each linked deal and read the notes before you delete anything.

Emails are their own system. If your team uses email sync (it is only available on Growth and higher plans), deleting a person does not mean the conversations vanish from a rep’s Sales Inbox. Archiving an email keeps its links to contacts and deals and can be restored; deleting removes it from Pipedrive entirely, with no restore. Depending on a sync setting, deleting in Pipedrive can also move the message to trash in the connected mailbox, and deleting in the email client deletes it in Pipedrive too ( [Archive and delete emails in Pipedrive](https://support.pipedrive.com/en/article/archiving-and-deleting-emails)). A private conversation is not visible to the admin, so the owner has to ask each rep who wrote to this person to check both Pipedrive and their own Gmail or Outlook.

Integrations are the last stop: a calling app, an e-signature tool, a marketing platform, a Zapier flow that copied the contact into a sheet. List the apps connected to your account and ask what each one stores. Nobody in Pipedrive’s help is going to tell you what your dialer kept.

![Trail map of one person in Pipedrive: notes, attachments and invoices go with the record; duplicates, deals, emails, apps, exports do not.](https://salesbond.app/wp-content/uploads/2026/10/pipedrive-gdpr-deletion-request-2.png)

A quick disclosure, since this is where our product fits: we build SalesBond, and one of the things it checks is whether contact and deal data in the CRM is complete and consistent, which is what makes a search like this short. It will not make you GDPR-compliant; it makes “find everywhere this person appears” a question with one answer. [Check your CRM with SalesBond](https://salesbond.app/) to see how that looks on your account.

## Delete, anonymize or keep: deciding each item of a GDPR request

Decide per item, not per request. For most of the trail the honest answer is yes, delete it. But you will usually find two or three items where deleting breaks something that is not about the person at all.

The common one is the won deal. The deal itself survives the delete, with its value and dates, but by the help page above the person’s linked notes, attachments and invoices go with them. If that invoice is something your books still need, what we do is anonymize the person by hand instead of deleting them: open the record, replace the name with a neutral placeholder, clear the email, phone and any custom fields that identify them, and leave the deal and its history in place. Pipedrive’s help has no separate anonymize step, so this is your own editing; write down that you did it.

The other common one is a legal or accounting reason to keep something. Whether such a reason exists in your case is the lawyer’s call, and it is the one place in this process where “I’m not sure” should stop you from deleting rather than from keeping. Park the item, ask, then act.

Two things are not a deletion, though people confuse them with it. An unsubscribe is a marketing status: if the person wrote “stop emailing me”, that is a different request, which we covered in [what to do with unsubscribed contacts in Pipedrive](https://salesbond.app/blog/pipedrive-marketing-status-unsubscribed-contacts/), and if they wrote “delete my data”, unsubscribing them is not enough. Archiving is not a deletion either. Archived deals and leads are out of sight, not out of the account, which is fine for [old deals you want to stop looking at](https://salesbond.app/blog/pipedrive-archive-old-deals-leads/) and useless for a person who asked to be removed.

When you are ready to delete, the steps from Pipedrive’s help are these ( [How can I delete items in Pipedrive?](https://support.pipedrive.com/en/article/how-can-i-delete-items-in-pipedrive)):

1. Click the name of the person to open the detail view.
2. Click “…” in the upper right.
3. Select “Delete”.
4. Confirm in the prompt.

Duplicates can go together from the list view (tick the checkboxes, click the trash can icon, confirm), and an admin can restore anything deleted within 30 days if you pick the wrong twin. Emails are deleted separately, from the Sales Inbox or the conversation itself, and the help page warns that deleted emails cannot be recovered.

## After the delete: the exports and copies you forgot

Every export is a copy of the person that Pipedrive’s delete button does not know about.

Exports in Pipedrive sit in Tools and apps > Export data > Generated exports and are available for 28 days ( [Exporting data from Pipedrive](https://support.pipedrive.com/en/article/exporting-data-from-pipedrive)). The same page says only global admins and regular users with the export permission can export at all, and that each user can only export what their visibility lets them see. So the list of people who could have made a copy is short and the owner can go through it name by name. Ask each of them one question: “Did you export contacts in the last few months, and where is the file now?”

By then the files are rarely in Generated exports. They are on laptops, in a shared drive folder called “webinar list final v2”, in a mail-merge tool. This is a conversation, not a search box, and ten minutes at the next team meeting gets you most of the way.

## A short log you can show later

Write the log the same day, while the names of the files are still fresh. It does not need a template or a tool, a note in a shared doc per request is enough. Ours has these lines, in the order we do the work:

- Date the request came in, who received it, and the exact wording (paste the email).
- How the request was confirmed as coming from the person.
- Owner assigned, date acknowledged to the person.
- Records found: person records (how many, including duplicates), organization, deals, notes on deals that mention the person, files.
- Emails: which reps corresponded, whether the conversations were deleted in Pipedrive and in the mailbox.
- Exports and copies: who exported, which files, where they were, what was done with each.
- Connected apps checked, and what each one held.
- Decision per item: deleted, anonymized, or kept (with the reason and who confirmed it).
- Date deleted. Note the 30-day restore window and who is allowed to restore.
- Date the person was told it was done, and what exactly they were told.

On Pipedrive’s Enterprise plans, part of this is on record without you. Security alerts can email you when data is exported or deleted, and the alerts show up in a security dashboard audit log ( [Security alerts](https://support.pipedrive.com/en/article/security-alerts)). An alert does not know why the deletion happened, or what you decided to keep, or which laptop had the spreadsheet. That part is yours. If a buyer asks the same kind of question before signing, here is [what to tell a buyer who asks about your data](https://salesbond.app/blog/sales-security-questionnaire-pipedrive/).

![A one-page deletion request log filled in by hand, from request received to the date the person was told it was done.](https://salesbond.app/wp-content/uploads/2026/10/pipedrive-gdpr-deletion-request-3.png)

The confirmation email to the person can then be short and true: what you deleted, what you anonymized and why, and the date. That is the difference between Kira’s “done” and a reply you would be comfortable forwarding to a lawyer six months later.