WordPress's personal-data export tool can gather information associated with a verified person from core and participating plugins. It is different from a content export and may not include every external system used by your business.
IN THIS ARTICLE
01 Verify the request and scope
Identify the requester through your established privacy process and confirm the relevant email address. Do not release an export merely because someone knows another user's name. Use the built-in confirmation workflow where appropriate and follow the site's applicable policy for handling requests.
Inventory connected systems such as a payment provider, mailing platform or support desk. Their records may need separate handling, and a WordPress export does not establish that the entire request is complete.
02 Generate the export
- Open Tools > Export Personal Data with an authorised account.
- Enter the appropriate username or email and send the confirmation request.
- Wait for the request to be confirmed through the supported process, then review its status.
- Use the available export or delivery action to generate the archive.
- Provide the result only through the intended verified delivery route and record completion according to your policy.
03 Protect the generated archive
The archive can contain personal information and should not be placed in a public Media Library or ordinary shared folder. Limit access, retain it only as required by the handling process and avoid copying its contents into a public support conversation.
Review participating plugins and the export result for obvious gaps. If a plugin stores customer records but does not integrate with the exporter, consult that plugin's documented process.
What if a personal-data export cannot complete?
If confirmation mail is missing, verify the address and delivery logs before bypassing identity checks. If generation fails, record the request status and the plugin or error involved, then retry only after understanding whether a partial export exists.
This tool does not export a complete website backup or transfer posts for migration. Use the appropriate content or backup workflow for those tasks. For uncertainty about retention or the legal scope of a request, have the responsible privacy contact review it while keeping the technical export process and the identity check clearly documented.