Organisations should first identify every third party that can access the relevant data, then confirm which processing activities must stop. The request has to be enforced across both the controller and its processors, with contract terms, operational workflows, and data maps aligned. Without that traceability, teams may continue prohibited sharing even when the request has been formally received.
What “do not sell or share” means in operational terms
A customer request of this kind is not satisfied by a policy acknowledgement alone. Organisations need to translate it into an exact suppression rule set: which disclosures stop, which downstream recipients are in scope, and which systems must enforce the restriction. In practice, the first challenge is not intent, but traceability across records, workflows, and data movement.
The key operational question is whether the organisation can reliably map the customer’s personal data to every place it is being disclosed. That includes direct recipients, processors, and any internal routing that feeds a third party. If the mapping is incomplete, the organisation may keep sharing data after the request has been received.
How to make the restriction effective across the controller and its processors
The request must be pushed through the whole processing chain, not just handled at the point where the customer contacted the organisation. That means contract terms, service instructions, and internal workflows all need to say the same thing, so that processors do not continue a disclosure that the controller has already stopped authorising.
This is where data maps and vendor inventories matter. Organisations need to know which third parties receive which categories of personal data, for what purpose, and through what mechanism. Without that visibility, teams cannot reliably determine whether the request requires a full stop, a selective stop, or an exception tied to another lawful basis or obligation.
In practice, the control problem is often less about one system and more about consistency: the CRM, marketing platform, analytics stack, support tools, and processor instructions all have to reflect the same preference state. If one downstream service remains outside the workflow, the request is only partially enforced.
What good handling looks like for practitioners
Effective handling starts with a defined decision path, then moves to execution and verification. The organisation should identify the relevant data categories, locate all third parties that can receive them, and confirm which sharing activities must stop or be limited. After that, teams should verify that the restriction has actually propagated into operational controls, not just case notes.
For customer rights requests, the practical standard is traceable enforcement. That means the organisation can show which processors were notified, which data flows were changed, and how the restriction was reflected in contracts, system rules, and exception handling. If the organisation cannot produce that evidence, it should assume the request is not yet fully implemented.
Risk and Threat Considerations
The main risk is continued disclosure after a valid customer instruction has been received. That usually happens when the organisation has fragmented data maps, incomplete processor visibility, or manual workflows that do not reliably propagate the restriction into every system that shares the data.
Failure mechanism: A third party, processor, or internal platform continues sending or using personal data because the stop-request was not translated into the exact operational point where disclosure occurs, or because a downstream recipient was not included in the inventory.
Impact: The organisation can expose personal data contrary to the customer’s direction, create privacy and contractual breach risk, and lose confidence in its ability to govern onward sharing.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
GDPR and SOC 2 (AICPA) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | A.5.1 — Lawfulness, fairness and transparency | Directly governs handling of customer privacy requests about data sharing. |
| A.5.2 — Purpose limitation | Restricting onward sharing depends on whether the original purpose still permits disclosure. | |
| A.5.3 — Data minimisation | Limits unnecessary personal-data disclosure to third parties. | |
| Recommendation — Align sharing restrictions to lawful processing and customer transparency requirements. Stop any third-party sharing that is not needed for the stated purpose. Reduce third-party access to only the data required for the service. | ||
| SOC 2 (AICPA) | PI1.1 — Processing Integrity | Third-party sharing must be executed completely and accurately once a customer instruction exists. |
| Recommendation — Ensure rights-request workflows change downstream processing exactly as intended. | ||
Practitioner Guidance
What to verify: Confirm that the request is tied to an authoritative list of recipients and data flows, not just a customer service ticket. If you cannot name every processor or third party that could still receive the data, the workflow is not ready for enforcement.
Decision rule: If the organisation cannot prove that the restriction reached both the controller’s systems and each relevant processor, treat the request as incomplete until the missing path is closed. Do not rely on manual reassurance from a single team that the request was “handled.”
Practitioner takeaway: The real control is not receipt of the request, it is end-to-end propagation of that preference into every place where disclosure can still occur.
Related resources from NHI Mgmt Group
- What should organisations do when third parties hold customer data under privacy rules?
- How should security teams control personal data sharing with third parties under GDPR?
- Which teams are accountable when a mobile app shares personal data with third parties?
- How should organisations share fraud intelligence across institutions without exposing customer data?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
