Best GDPR Data Request and Erasure Plugins for WordPress
You have one month. That is the number this category is built around and the one most WordPress sites discover only when the first email arrives. Under Article 12(3) of the GDPR you must respond to a subject access or erasure request without undue delay and in any event within one month of receipt, extendable by two further months for genuinely complex requests, but only if you tell the person within that first month that you are extending.
WordPress ships tools for this. They are better than nothing and considerably less than complete. This article covers what the obligation actually requires, exactly where core stops, and what to add, including the honest answer that for most sites the right purchase is nothing at all.
Verified August 2026. This is a practical guide, not legal advice.
What the obligation actually is
Two rights drive nearly all requests. Article 15, access, entitles someone to a copy of the personal data you hold about them plus information on why you hold it, who you share it with, and how long you keep it. Article 17, erasure, entitles them to have it deleted where one of several conditions applies, most commonly that you no longer need it or that consent was the basis and has been withdrawn.
Neither right is absolute. You keep what you must keep for other legal reasons, and tax and accounting rules that require retention of transaction records for years override an erasure request for those specific records. The correct response to “delete everything” from a customer who bought something last month is partial erasure with an explanation, not refusal and not blanket deletion.
Article 12(6) lets you request additional information to confirm identity where you have reasonable doubts, which matters more than it sounds. Disclosing someone’s data to a person impersonating them is itself a breach, and it is a much more common failure than missing a deadline.
The 6 options compared
1. WordPress core privacy tools
Free, already installed, and the correct starting point for every site. Under Tools you will find Export Personal Data and Erase Personal Data. You enter an email address, WordPress sends a confirmation link to that address, and once the person clicks it you can generate a downloadable archive or run the erasure.
The confirmation step is quietly the most valuable part, because it does your identity verification for you: only someone with access to that inbox can confirm. The export covers core data, meaning the user profile, comments, media, and sessions, and it also covers any plugin that has registered itself with the exporter and eraser hooks. WooCommerce does. Many plugins do not, and that gap is the entire subject of the next section.
- Price: Free, in core since WordPress 4.9.6
- Covers: Core data plus participating plugins
- Best for: Every site, as the foundation
- Watch out for: Silent gaps where plugins never registered
2. A documented process and a form
The answer for most sites, and it costs nothing beyond the form plugin you already have. Build a request form that captures the email address, the type of request, and a free-text field. Route it to a monitored inbox. Write a one-page internal checklist listing every system that holds personal data and what to do in each.
That checklist is the deliverable, not the form. A request arrives perhaps twice a year on a small site, and the failure mode is never that the software was inadequate. It is that nobody knew the newsletter platform, the helpdesk, the CRM, and the backup archive each held a copy, or that the person who knew has left. A written list turns a scramble into fifteen minutes of work, and it doubles as evidence of a process if you are ever asked to demonstrate one.
- Price: Free with any form plugin
- Covers: Everything, because a human follows the list
- Best for: Most sites, honestly
- Watch out for: The list going stale as your stack changes
3. Complianz Premium
At $59 a year for a single site, flat, this is the sensible consolidation if you also need consent management, which nearly every site subject to a data request also needs. Buying one licence that covers the banner, the blocking, the consent log, and the request workflow beats assembling four tools.
Its contribution here is structure rather than magic. It generates the request pathway, keeps records of what was asked and when, and pushes you through the documentation the regulation expects you to have. The actual retrieval still depends on core’s exporters for anything stored in WordPress, so the gap described below applies equally. Treat it as the administrative layer, not as a universal data-finder.
- Price: From $59 a year, single site, flat
- Covers: Request workflow, records, plus full consent management
- Best for: Sites that need consent tooling anyway
- Watch out for: Retrieval still relies on core exporters
4. Delete Me
A free plugin that adds a delete-my-account link to the user profile, with an optional password confirmation and a choice of what happens to the person’s content. On a membership site or community, self-service deletion removes most erasure requests before they become emails.
Two cautions. It has roughly 7,000 active installations and was last updated in June 2024, with WordPress.org flagging that it has not been tested against the latest releases, so verify it on staging before trusting it. And self-deletion moves most content to trash rather than removing it, which is a reasonable safety default but means the request is not actually complete until the trash is emptied. Configure that deliberately rather than assuming.
- Price: Free
- Covers: Self-service account deletion by role
- Best for: Membership sites and communities
- Watch out for: Last updated June 2024; content goes to trash
5. iubenda and Termly
Hosted compliance platforms that supply a request portal alongside policies and consent. The appeal is that the intake, the identity confirmation, the clock, and the audit record live on their infrastructure rather than in your inbox, which is genuinely useful once request volume stops being occasional.
Both run free tiers with real limits and paid plans that meter on pageviews or sites, so price them against your own numbers rather than the headline. The structural point is that a hosted portal handles intake and record-keeping, not retrieval; nothing external can read what is inside your database and your third-party tools. You still need the checklist. What you are buying is the paperwork and a defensible trail, which is worth real money to organisations that must demonstrate process, and very little to a site that gets two requests a year.
- Price: Free tiers; paid plans meter by pageviews or sites
- Covers: Intake, tracking, audit trail, policies
- Best for: Organisations that must demonstrate process
- Watch out for: Retrieval is still yours to do
6. WebToffee GDPR Cookie Consent
Listed here because it is frequently recommended in this context and the recommendation is partly misplaced. It is a consent plugin at $69 a year for a single site with unlimited pageviews, which is a strong pricing position against the metered platforms, and its consent log exports to CSV.
What it does not include is a data subject request form or an automated request workflow. A consent record is evidence about consent; it is not an answer to “what do you hold about me”. If you want it, buy it for the consent side, where the flat pricing is a real advantage over per-pageview competitors, and handle requests with core plus your checklist. Multi-site licences run $199 for five, $399 for twenty-five, and $1,199 for a hundred.
- Price: $69/yr single site; $199 for 5; $399 for 25
- Covers: Consent and consent logging, not data requests
- Best for: Consent management with unlimited pageviews
- Watch out for: No request form despite the category it appears in
Comparison table
| Option | Price | Request form | Retrieves data | Audit record |
|---|---|---|---|---|
| Core privacy tools | Free | No, admin-initiated | Core plus participating plugins | Basic |
| Process and a form | Free | Yes, yours | You do, from a checklist | Your records |
| Complianz Premium | From $59/yr flat | Yes | Via core exporters | Yes |
| Delete Me | Free | Self-service link | Account and content only | Email notice |
| iubenda / Termly | Free tiers; metered paid | Yes, hosted | No | Yes, hosted |
| WebToffee | $69/yr flat | No | No | Consent log only |
The data core does not know about
Core’s export is only as complete as the plugins that opted into it. A plugin registers exporters and erasers through dedicated hooks; if its authors never did, its data is invisible to the tool and your export will look tidy while being wrong. This is the single most common failure in this whole area, and it is silent.
Check these specifically:
- Form plugins. Every submitted entry is stored personal data, and entries often outlive any reason to keep them. Set a retention period and enforce it.
- Email marketing. The list lives on an external platform. Erasure there is a separate action in a separate account.
- CRM and helpdesk. Support tickets contain more personal detail than almost anything else you hold.
- Membership and LMS plugins. Progress records, quiz attempts, and profile fields sit in custom tables core will never see.
- Analytics. Cookieless tools usually hold nothing identifiable, which is one of their advantages. Anything storing IP addresses or user IDs is in scope.
- Backups. Erasing live data leaves copies in backup archives. The accepted approach is to document that backups are retained on a fixed cycle and that erased records are removed as those backups age out, rather than surgically editing archives.
One more, because the idea list still circulates: WP GDPR Compliance was permanently closed on WordPress.org on 23 February 2024 at the author’s request. It is not available and should not be sourced from elsewhere. If you have it on an old site, remove it.
Related guides
Frequently asked questions
How long do I really have?
One month from receipt. You may extend by two further months for complex or numerous requests, but you must tell the person within the first month that you are doing so and why. Silence is the failure, not slowness.
Can I charge for a request?
Generally no. Requests are free. A reasonable fee or refusal is permitted only where a request is manifestly unfounded or excessive, particularly if repetitive, and the burden of showing that sits with you.
How do I verify who is asking?
Confirmation to the email address on the account is usually sufficient and is what core’s tools do. Ask for more only where you genuinely doubt identity; demanding ID documents as routine creates a new pile of sensitive data and can itself be a problem.
Do I have to delete a customer’s order history?
Usually not in full. Transaction records typically fall under retention obligations in tax and accounting law, which override erasure for those records. Delete the marketing profile and the account, keep the invoice, and explain the distinction in your reply.
What about backups?
Erase from live systems, document your backup retention cycle, and confirm the data disappears as those backups expire. Restoring from an old backup afterwards must not silently reinstate erased records, so note the request somewhere that survives a restore.
Does any of this apply if I am outside the EU?
If you offer goods or services to people in the EU or monitor their behaviour, yes, regardless of where you are. Several US state laws now create comparable rights with their own deadlines, which is a good argument for building one process rather than one per jurisdiction.
The verdict
For most sites: buy nothing. Use core’s export and erase tools, add a request form pointing at a monitored inbox, and write the one-page checklist of every system holding personal data. That combination answers a request properly and costs an afternoon.
If you need consent management too: Complianz Premium at $59 a year, flat, which folds the request workflow and records into a licence you were going to buy anyway.
If you run a membership site or community: add Delete Me so members can remove themselves, after testing it on staging and configuring what happens to their content.
If you must demonstrate process to an auditor or client: a hosted portal from iubenda or Termly for the trail, with the checklist still doing the retrieval. No product finds your data for you, and any that implies otherwise is selling paperwork.
