customer-data-privacy-requests.md

Uploaded 8/8/2026, 11:53:33 PM

# Customer Data Privacy Request Handling

When a policyholder submits a data access or deletion request, the Compliance Officer first verifies the requester's identity, then logs the request in the CRM.

Once verified, the Compliance Officer works with IT Security to pull or delete the requested data from the Policy Administration System and Claims Management System.

Policy requires data requests to be fulfilled within 30 days, per state privacy regulations. In practice, the Compliance Officer usually completes straightforward requests within a week, reserving the full 30 days for cases involving active claims that require legal review first.

Data tied to an open claim or active fraud investigation cannot be deleted until the case closes, which is an exception to the standard deletion timeline.