Two different requests
A data request asks: what do you hold about me? You answer it with a bundle.
An erasure request asks: remove me. You answer it by removing them.
They are handled separately because they mean different things and carry different risks.
How one arrives
A member raises it themselves from the portal. Someone who is not a portal user can raise an erasure request through the guest form on your public pages, so a former member who never signed in still has a route.
You can also raise one on a member's behalf, for the person who telephones instead.
The clock
A data request carries a 30-day deadline, with one extension available if the request is genuinely complex. Both are visible on the request, so nobody has to remember what the law says or count days in their head.
Sembr will not let the deadline pass quietly. That is the whole reason it is a queue with dates on it rather than an email in somebody's inbox.
What the bundle contains
Everything you hold about that member, assembled by Sembr rather than by you going table to table. The member downloads it from their portal.
Erasure, and the seven days
An erasure request does not execute immediately. There is a seven-day cooling-off period, and either side can cancel during it.
That exists because erasure cannot be undone, and because "delete me" sent in anger on a Tuesday is sometimes regretted on a Wednesday. Seven days costs nothing and prevents the one mistake that has no fix.
What erasure actually does
It anonymises in place. It does not delete rows wholesale.
The person stops being identifiable. What has to survive, survives: an invoice that was paid is a financial record your organization is required to keep, and it stays, without the name attached. Erasing the invoice too would leave your accounts untrue and would not be lawful either.
Files that belong to the member are removed from storage as part of the same job. So is any mention of them in an Ask Sembr query history.
What you should do first
Read the request. Confirm the person is who they say they are, by whatever means your organization normally uses. Sembr cannot verify identity for you and does not pretend to.
Then work it. The queue shows what is outstanding and how long it has left.
The audit record
Every step is written to an append-only log: raised, extended, cancelled, executed, by whom, when. If a regulator ever asks how you handled a request, the answer is a record rather than a recollection.