Removing someone's data.
WHAT TO ESTABLISH FIRST
Whether the right applies in this case.
WHEN IT TYPICALLY DOES
The data is no longer needed for its purpose Consent was the basis and is withdrawn The processing was unlawful There is a legal obligation to erase
WHEN IT TYPICALLY DOES NOT
You must retain by law The data is needed for legal claims Freedom of expression or public interest grounds apply
WHAT TO DO
Delete what you can, and explain the rest.
WHERE TO DELETE FROM
Every system holding it.
WHAT PEOPLE MISS
Backups Analytics Email Third parties you sent it to Support records
WHAT TO DO ABOUT BACKUPS
Decide and document your approach: usually, backups expire rather than being edited.
WHY
Editing backups is impractical and risks corrupting them.
WHAT TO STATE
That live systems are cleared, with backups expiring within a stated period.
WHAT ABOUT THIRD PARTIES
Inform them, where you passed the data on.
WHY
The obligation follows the data.
WHAT TO BUILD
A deletion process covering every system, tested.
WHAT TO RECORD
The request, what was deleted, what was retained, and why.
WHAT TO CONFIRM TO THE PERSON
What was done.
