Data requests: access and deletion

Play this lesson

Show me my data

Under the UK GDPR, a player can ask the studio for the personal data it holds about them. That is a subject access request. They can also ask for it to be deleted: the right to erasure.

One month

The UK's Information Commissioner's Office (ICO) says to answer a request "without undue delay and at the latest within one month of receiving the request". It can be extended "by up to a further two months, where necessary".

"In most cases, you cannot charge a fee".

Count the days

Priya gets a simple request on 3 March. What is the latest the studio can answer?

  1. 3 April
  2. 3 June
  3. 3 March next year
Show the answer

3 April

One month from receiving it. Extensions of up to two more months are only for complex requests.

Children's requests

The ICO: "If you are confident a child can understand their rights, you should respond directly to the child." If not, a parent with parental responsibility can usually act for them.

The studio first makes sure it knows who is asking, and asks for identification only if necessary.

Erasure

A request to erase also has "one month". The ICO adds "an emphasis on the right to have personal data erased if the request relates to data collected from children".

Backups can't always be changed at once, so the data in them is put "beyond use" until they are replaced.

Quick check

A deleted player's data is still in last week's backup. What does the ICO expect?

  1. Put that backup data beyond use until it is replaced
  2. Restore the backup and then delete them
  3. Nothing: backups don't count
Show the answer

Put that backup data beyond use until it is replaced

The backup is never used for anything else, and the data disappears when the backup is replaced on its schedule.

Build it in

Remy builds "Download my data" and "Delete my account" into Shard Garden's settings. One script finds a player in every database, store and export, so nothing is missed by hand.

Quick check

Before answering a request, the studio should make sure it really comes from that player, or someone allowed to act for them.

Show the answer

True

Sending a player's data to the wrong person would itself be a data breach.

AI reads player text too

The last risk in this stage comes from AI that reads what players write.

Bolt says: Next: AI agents and security reviews.

Fact-checked 12 October 2026