# Deleting an employee's personal data on request? > When a current or former employee asks for their personal data to be deleted, the request is logged and the person's identity is verified. Source page: https://dblinx.net/en/rehberler/kvkk-calisan-veri-silme-talebi --- KVKK # What to do when an employee requests deletion of their personal data? A step-by-step KVKK deletion request guide When a current or former employee requests deletion of their personal data, you need to log the request, verify the person's identity, separate what can be deleted from what must be legally retained, and respond with the outcome. This guide walks through the process step by step. 3 min readPublished: 17.10.2026 Turkey's Personal Data Protection Law No. 6698 (KVKK) gives individuals the right to request the erasure of their data. When a request comes from an employee or a former employee, the job is more than deleting one user: the same person's data sits in different places, such as email, files, sign-in logs and invoices. Some of it must be deleted, while some must be retained under legal obligations. **Note**This guide describes a general process and is not legal advice. For your organization's retention periods and exceptions, consult your legal counsel. ## Deletion request step by step - **Record the request.** Note the date, the channel it came through and its scope. Under the law, requests must be concluded within 30 days at the latest. - **Verify the person.** Make sure the request really comes from the data subject. - **Work out where the data is.** User account, contact details, sessions, mobile device records, forms, and personal settings in the products. - **Separate the data to delete from the data to retain.** Data that must be retained by law, such as accounting and security records, is not deleted; its link to the person is limited to an anonymous ID. - **Carry out the deletion in a single action.** Deleting piece by piece leaves personal data behind in any system that is overlooked. - **Reply with the outcome and keep a record.** Note what was deleted and what was retained and why; the record itself must not contain personal data. ## What's deleted, what stays? Data | Action | Name, username, email, phone, password | Deleted | Active sessions, mobile device records, invitation links | Deleted | Contact form messages written by the person | Deleted | Company business records (files, email, orders) | Remain in the organization; the person appears as “Deleted person” | Security audit and invoice records | Retained under an anonymous ID for the legal period | ## Deletion versus removal from the organization If an employee has only left the company and has not asked for their data to be deleted, it is enough to disable their access; the records may be needed later. Deletion cannot be undone; carry it out only when there is a request. ## How does DBLinx handle a deletion request? - **Single action:** The organization administrator clicks “Delete person and personal data (KVKK)” on the person's card in the organization dashboard, then types the person's username to confirm. - **Deleted centrally:** The person's name, username, email, phone and password in their DBLinx account are deleted; their account is closed in all products and their sessions are ended. - **In the products:** In SmartPass, the person's name and personal details are anonymised, their photo is deleted and their card is cancelled. In SmartFiles, AI chats are deleted and the share links they created are closed; files remain in the organization. - **Retained:** Security audit records and order and invoice records are kept under an anonymous ID for the legal period. [Document: deleting personal data](https://dblinx.net/en/belgeler/baslarken/kisisel-verileri-silme)[KVKK privacy notice](https://dblinx.net/en/kvkk-aydinlatma-metni) ## Frequently asked questions How quickly must a deletion request be answered? Under KVKK, the request must be finalized within 30 days at the latest. Are invoice records deleted too? No. Records that must be retained under tax law remain; their link to the person is limited to an anonymous identifier. What happens to emails sent by the deleted person? Business records belonging to the company stay in the organization; the person appears in these records as "Deleted person." ## Handle an erasure request in a single action From the DBLinx organization dashboard, a person's personal data is deleted across all Smart products in a single action; legally required records remain anonymised. [Request a quote](https://dblinx.net/en/teklif-iste)[Get in touch](https://dblinx.net/en/iletisim) ## Other guides - [SecurityWhat is CEO fraud? A guide to protecting against fake IBAN emailsCEO fraud is an email scam in which an attacker posing as an executive or supplier convinces an employee to make an urgent payment or pay a fake IBAN. The attacker wants the payment redirected to another account. These emails often carry no malicious link or attachment, so they easily pass through standard spam filters.6 min read](https://dblinx.net/en/rehberler/ceo-dolandiriciligi-sahte-iban) - [SecurityHow to spot a fake invoice email: a checklist for accounting teamsA fake invoice email is identified by checking the sender address, attachment, amount and bank details against independent records. These emails appear to come from a genuine supplier and report an unpaid invoice or changed payment details. The goal is to redirect the payment to the attacker's account or get the malicious attachment opened.6 min read](https://dblinx.net/en/rehberler/sahte-fatura-mailleri) - [ComplianceKVKK email retention period and corporate document retention: key principlesKVKK does not set a single fixed period for email retention; personal data is kept for the period required by applicable legislation or by the purpose of processing. This guide summarizes the basic principles of access, retention, deletion and recordkeeping for corporate email and files as general information; it is not legal advice.6 min read](https://dblinx.net/en/rehberler/kvkk-uyumlu-e-posta-ve-dosya-saklama)