Skip to main content

Request erasure of a customer's personal data

POST 
/gdpr/v1/erasure

Use this to erase a customer's personal data once GET /gdpr/v1/lookup has confirmed they are eligible. Pass the customer's email and your own data-protection request reference; the reference is recorded in Two's audit trail alongside the erasure and returned to you in the response. Names, email addresses, phone numbers and identity verification data are replaced with anonymised placeholders. This is irreversible: there is no undo and Two cannot restore erased data, so double-check the email address before you call it. A 202 response means your request has been accepted, not that the data has been erased. Requests for customers who are ineligible or not_found are accepted in exactly the same way but nothing is erased, which is why you should always run the lookup first. Retrying is safe: resubmitting the same reference returns the same 202 and nothing is erased twice. Where a record is shared with another merchant, only your side of it is erased.

Request​

Responses​

The erasure request has been accepted.