Use WordPress' Privacy tools so an administrator can export and erase data\nowned by a plugin from Tools > Export Personal Data and Tools > Erase Personal\nData. This is an engineering contract, not legal advice or a claim of GDPR\ncompliance.
\nBefore writing callbacks, trace every personal-data store and transfer:
\nExporters and erasers must cover the same inventory. Do not assume deleting a\nWP_User removes plugin tables, files, remote copies, or denormalized logs.
Capture personal data only after the host workflow has established that the\nsubmission or business event is valid. Early hooks such as\nrest_request_before_callbacks and priority-zero wp_ajax_nopriv_* observers\nrun before the target plugin's permission callback or action callback, including\nits callback-level nonce, spam, business validation, and success logic. The REST\nfilter runs after core authentication and registered argument validation, but it\ncan still persist data from requests the endpoint later rejects.
Prefer the integration's documented post-success hook and verify the exact\nform/list/action plus consent/feature state. Sanitization does not turn a failed\nsubmission into a valid collection event. Test invalid, spam, unauthorized, and\ndownstream-failure paths and assert that they create no durable profile data.
\nRegister factual, conditional text from admin_init. Describe what is\ncollected, why, retention, recipients, and user choices. Do not paste a legal\nguarantee or silently edit the site's published policy.
add_action( 'admin_init', static function (): void {\n wp_add_privacy_policy_content(\n __( 'My Plugin', 'myplugin' ),\n wp_kses_post(\n '<p class=\"privacy-policy-tutorial\">' .\n __( 'Suggested text: describe the data this plugin actually stores and sends.', 'myplugin' ) .\n '</p>'\n )\n );\n} );\nKeep the suggestion synchronized with feature flags. If telemetry or a remote\nintegration is optional, say when it is active and what leaves the site.
\nThe filter receives all exporters. Add a stable, plugin-prefixed key and return\nthe array. The callback accepts an email and a 1-based page number.
\nadd_filter( 'wp_privacy_personal_data_exporters', static function ( array $exporters ): array {\n $exporters['myplugin-submissions'] = array(\n 'exporter_friendly_name' => __( 'My Plugin submissions', 'myplugin' ),\n 'callback' => 'myplugin_export_personal_data',\n );\n return $exporters;\n} );\n\nfunction myplugin_export_personal_data( string $email, int $page = 1 ): array {\n $per_page = 100;\n $page = max( 1, $page );\n $rows = MyPlugin_Submission_Repository::find_by_email(\n sanitize_email( $email ),\n $per_page,\n ( $page - 1 ) * $per_page\n );\n $data = array();\n\n foreach ( $rows as $row ) {\n $data[] = array(\n 'group_id' => 'myplugin-submissions',\n 'group_label' => __( 'Form submissions', 'myplugin' ),\n 'group_description' => __( 'Submissions stored by My Plugin.', 'myplugin' ),\n 'item_id' => 'submission-' . (int) $row->id,\n 'data' => array(\n array( 'name' => __( 'Email', 'myplugin' ), 'value' => (string) $row->email ),\n array( 'name' => __( 'Message', 'myplugin' ), 'value' => (string) $row->message ),\n array( 'name' => __( 'Created', 'myplugin' ), 'value' => (string) $row->created_at_gmt ),\n ),\n );\n }\n\n return array(\n 'data' => $data,\n 'done' => count( $rows ) < $per_page,\n );\n}\nRules:
\ngroup_id and unique item_id; translate labels, not IDs.array( 'data' => array, 'done' => bool ) or WP_Error.add_filter( 'wp_privacy_personal_data_erasers', static function ( array $erasers ): array {\n $erasers['myplugin-submissions'] = array(\n 'eraser_friendly_name' => __( 'My Plugin submissions', 'myplugin' ),\n 'callback' => 'myplugin_erase_personal_data',\n );\n return $erasers;\n} );\n\nfunction myplugin_erase_personal_data( string $email, int $page = 1 ): array {\n $result = MyPlugin_Submission_Repository::anonymize_next_batch(\n sanitize_email( $email ),\n 100\n );\n\n return array(\n 'items_removed' => $result->changed > 0,\n 'items_retained' => $result->retained > 0,\n 'messages' => array_map( 'sanitize_text_field', $result->messages ),\n 'done' => ! $result->has_more,\n );\n}\nThe eraser response must contain all four keys. items_removed also covers\nsuccessful anonymization. items_retained means personal data was found but\nkept; explain why in messages without leaking the retained data itself.
form_email or provider-specific address fields.has_more explicitly.done => true while matching erasable rows remain.Privacy erasure, uninstall, and routine retention are different operations:
\nWordPress 7.1 schedules wp_privacy_personal_data_cleanup_requests daily. Core\nmarks expired request-pending user_request posts as request-failed and\nclears their confirmation key; it does not delete completed requests or\nplugin-owned personal data. Expiry follows user_request_key_expiration\n(normally one day), and the cleanup compares the site-local post_modified\ncolumn because the relative date is evaluated in the site timezone.
Do not duplicate this cron event or treat it as a plugin retention engine.\nWP-Cron is traffic-dependent, so operationally critical retention still needs\nmonitoring and a safe idempotent catch-up path. If filtering\nuser_request_key_expiration, test confirmation links and scheduled cleanup\ntogether; the filter changes both sides of the lifecycle.
Do not keep personal data in autoloaded options or permanent transients. Give\ntemporary exports/logs an expiry and cleanup path. Backups are usually managed\noutside plugin callbacks; document their retention instead of pretending the\nplugin erased them synchronously.
\nDecide whether data belongs to one site, network tables, or both. Core runs a\nsite's registered callbacks in that site's context; do not silently iterate an\nentire network without network authorization and a documented contract.
\nTest at least:
\ndone.wp-security-audit for request handlers and authorization.wp-settings-storage-audit for retention/autoload storage choices.wp-admin/includes/plugin.php: wp_add_privacy_policy_content().wp-admin/includes/ajax-actions.php: exporter/eraser response validation.wp-includes/comment.php: core paged exporter and eraser examples.wp-admin/includes/privacy-tools.php: export/erasure processing pipeline.wp-includes/functions.php: scheduled request cleanup and old export-file cleanup.