Right to Erasure/Blocking

It is the right of a data subject to suspend, withdraw, or order the blocking, removal, or destruction of their personal data from a personal information controller's filing system.

A data subject can request deletion upon discovery and substantial proof that their data is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary.

Any personal data that is proven to be incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary for its original declared purpose.

The company must verify the requestor's identity, evaluate the provided proof, and upon validation, promptly block or destroy the data across all systems, while logging the actions taken.

The data subject must present substantial proof demonstrating that the data falls under the specific statutory conditions, such as evidence that it is outdated, false, or unlawfully obtained.

While the statute does not explicitly use the term 'right to be forgotten,' the right to erasure, removal, or destruction of personal data provides a very similar protective mechanism.

Yes, a company can legitimately refuse if the data is still strictly necessary for the performance of a contract, a legal obligation, dispute resolution, or if the request is deemed vexatious.

While the DPA does not always state a specific day count for every request type, organizations are required to act immediately or within a reasonable timeframe as defined by general NPC guidelines.

Blocking restricts further processing without deleting the data, removal takes it out of active systems, and destruction permanently obliterates the data so it cannot be recovered.

Organizations should maintain a comprehensive Data Subject Request Log detailing the request date, identity verification, technical actions taken, and notifications sent to third parties. Tools like WatchDog Security's Compliance Center can help retain evidence of request handling, approvals, and completion status for audit review.

Erasure requests often fail when teams cannot prove intake, review, approval, deletion actions, and third-party notices were handled consistently. Tools like WatchDog Security's Compliance Center can centralize control ownership, request evidence, action logs, and framework mappings so the organization can demonstrate a repeatable process.

Approved erasure or blocking requests may require notifying processors, vendors, or other recipients that previously received the data. Tools like WatchDog Security's Vendor Risk Management can maintain a vendor catalog, processor relationships, and follow-up records so third-party notification obligations are easier to track.