WHMCS GDPR Compliance Setup: Retention, Consent, Export and Deletion

WHMCS GDPR compliance setup means configuring the tools WHMCS provides: data retention pruning in Automation Settings, the marketing opt-in and terms acceptance in General Settings, the JSON client data export under Reports, and client deletion in the client profile. WHMCS gives you tools, not compliance. The legal duties stay with you and your adviser.

This is not legal advice. I am a developer, not a lawyer. For the law itself, read the EU GDPR text on EUR-Lex or the UK regulator's ICO guidance on UK GDPR, and ask a qualified adviser what applies to your business. This guide covers what WHMCS can and cannot do, checked against the WHMCS 9.1 documentation.

Which WHMCS settings relate to GDPR?

About a dozen settings across Automation Settings, General Settings, Reports and the client profile. This table maps each one to the job it does.

How do I set up data retention in WHMCS?

Turn on Automatically Delete Inactive Clients at Configuration > System Settings > Automation Settings, set the number of months, and choose whether to delete users linked only to those clients. The Data Retention Pruning task then runs with the daily cron, so the WHMCS cron must be working.

Read the Automation Settings documentation carefully before you save, because two details matter:

• Some deletions happen at once. When you enable the feature, WHMCS deletes clients in the Inactive or Closed status who have no invoice or transaction history straight away, without waiting for the months you set.
• The clock starts at the last paid invoice or transaction. The months you enter count from that activity, not from the date the client closed.

Who counts as Inactive depends on Client Status Update in the same section. By default WHMCS marks clients older than two days with no active services as Inactive. Put together, a person who registered but never ordered can be deleted as soon as you enable retention. That may be what you want, but check first. On a staging copy, this read-only query gives a rough preview of the immediate group:

SELECT c.id, c.firstname, c.lastname, c.status
FROM tblclients c
WHERE c.status IN ('Inactive', 'Closed')
  AND NOT EXISTS (SELECT 1 FROM tblinvoices i WHERE i.userid = c.id)
  AND NOT EXISTS (SELECT 1 FROM tblaccounts a WHERE a.userid = c.id);

WHMCS's own logic may differ in detail, so treat the result as a preview, not a promise. On the number of months, WHMCS only says that local law decides and that most jurisdictions agree data should be kept no longer than necessary. Tax and accounting rules often require invoices to be kept for years, so get the number from your adviser.

How do I handle marketing consent in WHMCS?

Keep Require User Opt-In enabled on the Other tab of General Settings, so the Newsletter Opt-In toggle starts at No and a client must choose Yes. The Other tab documentation says both Marketing Emails and Require User Opt-In are enabled by default. If you disable Require User Opt-In, clients receive marketing mail until they opt out.

• Opt-in wording. Marketing Email Opt-In Messaging appears next to the toggle. WHMCS says it must reflect the marketing emails you actually send.
• Campaigns. Tick Marketing Email? in Utilities > Email Campaigns for every promotional message, or opted-out clients receive it too.
• Changing preferences. Users change it in their Client Area profile, and admins in the user's profile.
• Terms of service. Enable TOS Acceptance on the Ordering tab and set the Terms of Service URL, so clients must tick the box before they create an account or order.

Two gaps to know about. The documentation I read describes the settings, not a history of who consented to which wording and when, so decide whether you need to record that yourself. And if you sync clients to an outside mailing tool, opt-outs in WHMCS do not reach it unless your integration sends them.

How do I export a client's data for an access request?

Go to Reports > Reports, choose Client under Exports, search for the client, tick the data to include and click Generate and Download Export. WHMCS's Export Client Data page describes this and the resulting JSON file. For many clients at once, it points to the Clients report instead.

The export covers what is in WHMCS. It does not include the files in a client's hosting account, registrar records, payment gateway profiles, email you exchanged outside the ticket system, or copies in backups. Store the export securely and delete your copy once it is sent.

How do I delete a client's data in WHMCS?

Use Delete on the client's Summary tab, after you have dealt with the services and data that live outside WHMCS. The Summary tab documentation separates closing from deleting:

My order for an erasure request: terminate hosting services through their modules so the server account goes too, deal with domains at the registrar, remove stored pay methods, then delete the client. Delete Encrypted Credit Card Data on the Security tab removes local card data but, as WHMCS notes, not the tokens held at the gateway. Whether you may erase invoices at all is a legal question, not a WHMCS one.

What does WHMCS not do for GDPR?

It does not make the legal decisions, and it does not reach data outside its own database.

• Legal work. Lawful basis, privacy notice, records of processing, contracts with processors such as gateways, registrars and mail providers, and breach notification are yours.
• Other systems. Server accounts, registrars, gateways, help desks, mailing tools and backups keep their copies. A deleted client stays in old database backups until they rotate out.
• Your website. Cookie consent and analytics on your theme or marketing site are outside the settings above.
• Propagation. WHMCS provides PreDeleteClient, ClientDelete and ClientClose hooks, listed in the client hooks reference. A hook can tell other systems to delete their copy. Test on staging whether it fires for automated retention deletions too. My WHMCS hooks guide shows how hooks are built.

What is a WHMCS GDPR checklist?

1. Get the retention periods for clients, invoices and tickets from your adviser in writing.
2. Back up the database, then preview who the retention setting would delete at once.
3. Enable Automatically Delete Inactive Clients with the agreed months, and confirm the daily cron runs.
4. Set Prune Ticket Attachments and Module Log Pruning.
5. Keep Require User Opt-In on and rewrite the opt-in message to match what you send.
6. Tick Marketing Email? on every campaign, and sync opt-outs to outside tools.
7. Enable TOS Acceptance with a current Terms of Service URL.
8. Write down how you verify identity, export data and answer requests within the legal deadline.
9. Write an erasure procedure that covers servers, registrars, gateways and backups.
10. Remove stored card and bank data you no longer need.

What are the risks of turning these settings on?

• Deletion is permanent. Neither automated pruning nor manual deletion has an undo inside WHMCS. Only a backup brings data back.
• Immediate pruning. Enabling retention deletes Inactive and Closed clients without billing history, with no waiting period.
• Broken references. Custom modules and outside reports that expect a client ID can fail once it is gone. Test on staging.
• False confidence. The settings cover WHMCS's database. Most of a GDPR program is process, contracts and other systems.

Where the gaps are technical, such as pushing deletions to other systems or recording consent, that is custom work I do as WHMCS API integration and automation, and a WHMCS security audit covers how the install stores and protects the data.

Last reviewed 12 October 2026. Disclosure: I sell WHMCS and web development work, so I am not neutral. I am CTO at ElySpace, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI. Settings come from the WHMCS 9.1 documentation as I read it on that date.