Data Erasure Request Handling
Plain English Translation
The GDPR right to erasure, often called the right to be forgotten, empowers individuals to ask organizations to delete their personal data. Organizations must process a GDPR data deletion request without undue delay, typically within one month, and securely remove the data from all active systems. However, organizations can retain certain data if they have a legal obligation to do so or if another valid exception applies.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Create a dedicated email alias or web form to receive GDPR data deletion requests.
- Manually verify user identity and delete records directly from primary databases and core tools.
Required Actions (scaleup)
- Formalize the GDPR Article 17 erasure request process into standard operating procedures with predefined response templates.
- Use a centralized privacy management tool or ticketing system to track the GDPR deletion request response time and coordinate deletions with sub-processors.
Required Actions (enterprise)
- Implement automated data deletion workflows across all internal microservices and third-party APIs.
- Automate the handling of data in data lakes and ensure backups are put beyond use while waiting for standard rotation cycles to overwrite.
The GDPR right to erasure gives individuals the power to request the deletion of their personal data when it is no longer necessary, when consent is withdrawn, or if the data has been unlawfully processed.
Organizations must respond to a GDPR data deletion request without undue delay and at the latest within one month of receipt. This period may be extended by two months for complex or numerous requests, provided the data subject is notified.
To verify identity for GDPR erasure requests, you should rely on existing authentication mechanisms if the user has an account. If doubts exist, request the minimum additional information necessary, taking care not to collect excessive new personal data.
An organization can refuse an erasure request if processing is necessary to exercise the right of freedom of expression, to comply with a legal obligation, for public health reasons, or for the establishment, exercise, or defense of legal claims.
You should maintain a detailed data subject request log that tracks the request date, identity verification steps, systems modified, and the final response provided. This acts as essential GDPR erasure request log and evidence for auditors.
To delete personal data from backups GDPR regulators generally accept that you do not need to immediately destroy immutable backup archives. Instead, you must put the data beyond use and ensure it is overwritten during the standard backup retention cycle.
When evaluating a GDPR erasure request vs data retention requirements, you must retain the specific data mandated by law, securely delete the rest, and clearly explain the GDPR right to erasure exceptions legal obligation to the user.
The GDPR Article 17 erasure request process requires querying your data inventory map to locate all instances of the data, deleting the primary records, and formally instructing all relevant SaaS vendors and sub-processors to securely erase the data from their systems.
Under Article 19, organizations must communicate the erasure to each recipient to whom the personal data was disclosed, unless this proves impossible or involves disproportionate effort. This is typically done via automated API integrations or secure ticketing systems.
A compliant response should confirm that the requested data was deleted, specify any data retained under legal exceptions, explain the reasoning for partial refusals, and remind the data subject of their right to lodge a complaint with a supervisory authority.
Erasure requests often fail due to unclear ownership, missed deadlines, and incomplete deletion across systems. Tools like WatchDog Security's Compliance Center can map the control to required evidence and track fulfillment status, while WatchDog Security's Asset Inventory helps teams identify where personal data may exist across SaaS and cloud assets so deletion tasks are assigned to the right owners.
Audit defensibility depends on a reliable trail showing intake date, identity verification, actions taken, and closure within the SLA. Tools like WatchDog Security's Policy Management can standardize procedures and track acknowledgements of the process, and WatchDog Security's Compliance Center can centralize evidence and link request records to the control for consistent reporting.
"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;"
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-23 | WatchDog Security GRC Team | Initial publication |
