WordPress's erasure tool can remove or anonymise eligible personal data from core and participating plugins after a verified request. Review the scope and any retained records before running it, because the operation can be irreversible and does not automatically cover every connected service or backup.
IN THIS ARTICLE
01 Review identity and retention requirements
Use your established process to verify the requester and determine which data the request concerns. Consult the responsible privacy or business contact when records may need to be retained. Do not treat this article as a decision about which legal retention obligations apply to your organisation.
Identify external systems, exports and backups that hold related information. The WordPress tool does not erase data from every historical archive or third-party provider.
02 Run the supported workflow
- Open Tools > Erase Personal Data with an authorised account.
- Enter the relevant username or email and initiate the confirmation request.
- Wait for verification through the intended process and review the request status.
- Use the erasure action only after the scope and required approvals within your organisation are complete.
- Read the completion report, including any information the tool or participating plugins report as retained.
03 Verify what changed
Check the relevant application records through authorised administrative views. Erasure is not necessarily the same as deleting a WordPress user, deleting all authored posts or cancelling an external subscription. Complete those separate actions only when they are part of the verified request.
Document any remaining records and the reason they were retained through your approved process. Avoid recording unnecessary personal details in the completion note.
How should backups and failed erasures be handled?
Keep a procedure for ensuring a later backup restore does not silently reintroduce data that should remain erased. Do not delete all recovery backups indiscriminately without considering the applicable retention and security requirements.
If the tool fails partway through, inspect its report before repeating the operation. Some components may already have processed the request. Provide support with the request identifier and sanitised error rather than a full copy of the person's data.
When the request also covers an external platform, use that provider's documented process and verify completion separately. A successful WordPress status is evidence about this tool's scope, not a universal certificate that every copy everywhere has disappeared.