In WHMCS 8.0, we modernized user and login management, allowing access to multiple client accounts through a single user account. It's a powerful solution that's comprehensive, flexible, and, most importantly, useful. Client accounts own products and services. Each account represents an individual, business, or other entity: whoever's the billable party. Users, representing the specific individuals involved, are associated with one or more of those accounts and can log in and manage them seamlessly. Fine-grained controls easily adjust users' access to each account.

During the upgrade to WHMCS 8.0, we have converted each WHMCS installation to this system, ensuring that customers keep a great experience while gaining access to the new functionality. In addition to creating a user as the account owner for each client account, we also converted all subaccounts that had passwords into users. (All subaccounts without passwords became contacts.)

In WHMCS 8.1, we want to help you stay compliant with various laws and to keep your WHMCS installation uncluttered with unnecessary information. We've updated this new user management system to include deletion of users both manually and automatically.

The length of time you must keep data is often governed by the laws and regulations of your local jurisdiction. One thing most jurisdictions share in common, however, is that you should only keep personal data for as long as is necessary.

One of the most well-known restrictions on data retention comes through the General Data Protection Regulation (GDPR), which provides data protection for individuals in the European Union. The GDPR protects private, professional, and public data, and includes laws about handling, accessing, storing, and transferring it. It also grants individuals a right to erasure, allowing them to request at any time that you delete all of their identifying information.

Users are stored with names, email addresses, and access IP addresses that are considered personally-identifiable information. Because of how the new user management system handles data, if you need to remove identifying information you will need to delete (or anonymize) the associated user for that individual in addition to the desired accounts. This will ensure that you successfully removed all of the data involved.

You can delete any user in your WHMCS installation as long as they meet the necessary criteria. Users can't be associated with any accounts if they're being deleted individually (see below for more on how to delete individual users). When you're deleting an account and choose to also delete the associated users, WHMCS will only delete the associated users who are not also associated with any other accounts.


You can easily check the accounts a user is associated with by clicking on the user at Clients > Manage Users and viewing the list (above). Then, to make the user eligible for deletion, just go to each account's profile and click Remove for the user. You may need to first assign account ownership to a different user if the user you're removing had been that account's owner. (You can do this by finding the user who you want to make the owner in the client profile's Users tab, clicking Manage User, and checking the Make Owner checkbox. WHMCS will automatically transfer ownership and, assuming it's not associated with other accounts, the previous account owner will be eligible for deletion.)

If you receive a request for deletion from a single individual, you can perform the removal manually, from within the WHMCS Admin Area. In WHMCS 8.1, this is possible from the client profile's Summary tab. Click Delete Clients Account, set the toggle to YES to delete the associated users, and then confirm the deletion. Note that this won't delete users who are associated with another account, and will simply remove their association with the now-deleted account.


You can also delete individual users through the list of users at Clients > Manage Users without deleting an account. However, you'll find the Permanently Delete button unusable until the user meets the needed criteria (an empty Accounts list).

Since WHMCS 7.5, we have included Data Retention Policy automation to help you correctly handle this type of data and automatically enforce your policies. It deletes client records after a set number of months of inactivity (no invoices or other transactions). In WHMCS 8.1, this automation includes deleting users who are only associated with a client account that's being deleted.


In Configuration > System Settings > Automation Settings, select After no invoice or transaction activity has occurred for the following number of months: and set the number of months to wait before deleting. Then, set the toggle immediately below this to YES and click Save Changes. WHMCS will delete all of the client accounts and users that meet your criteria each time that the WHMCS cron runs.

Managing your data in WHMCS is important, so we include several features to help you keep what you need, find what you have, and get rid of what needs to go. If you want more information about your data and how to work with it, these resources should help:

• Data Retention Policy Automation
• Automatically Deleting Client Data
• How Can WHMCS Help With GDPR Compliance?

You can learn more about users and accounts here.