Right to erasure

What it means

The right to erasure is the data subject’s claim to have their personal data deleted once the ground for processing has fallen away: the purpose is spent, consent was withdrawn, an objection was upheld, or the processing was unlawful. GDPR sets the conditions, not the firm’s internal policy.

It is not a right to vanish at will. Where the data are needed for a legal obligation, such as retaining accounting documents, or to bring or defend legal claims, the request is refused and the reason is explained.

Erasure must be told apart from restriction of processing: the data stay stored but, apart from being kept, are no longer used. Irreversible anonymisation can count as erasure, but pseudonymisation cannot, because with additional information the data can again be linked to a specific person.

How it works in practice

A request is handled without undue delay and within one month, with an extension where the case is complex. The data protection officer, where one is appointed, drafts the answer, which must state what was erased and what stays and on what legal basis.

Erasure reaches every copy, including backups and the systems of a processor bound by a processing agreement. The accounting and payroll systems are not swept: the data there are merely restricted until the retention period ends.

When a client’s former customer asks for erasure, we help sort the data: the contact on the e-mail marketing list is deleted at once, invoices and contracts stay until the retention period ends, and correspondence about an open receivable stays until it is settled. Each category has its own reason and its own deletion date.

What to watch out for

Firms take the request literally and delete invoices and payroll records too. The document is then missing at a tax audit, the expense is disallowed and tax is assessed with a penalty, although the duty to keep accounting records outranks an erasure request.

The opposite mistake is missing a request or answering late. The deadline runs from delivery to any of the firm’s contacts, including a general inbox, and missing it is a breach in its own right that the person can report to the supervisory authority. A log of requests kept alongside the record of processing activities helps.