YTYK You think you know

Card 9 of 18 The rights of the data subject ●●○ Working knowledge

Erasure is conditional

The right to erasure applies on specific grounds — the data is no longer necessary, consent is withdrawn and there is no other basis, the subject objects and no overriding ground exists, or the processing was unlawful. It yields to legal obligations, legal claims, and freedom of expression.

Why it is like this

An unconditional delete button would collide with every retention law and every ongoing dispute. The grounds are the negotiated boundary.

Not to be confused with

"The right to be forgotten" as an absolute. A customer cannot erase an invoice you are required to keep for tax purposes — though you can stop using it for anything else.

In practice

Erase the marketing profile; keep the invoice for the statutory retention period; and if the data was disclosed to others, take reasonable steps to inform them.

Source: Regulation (EU) 2016/679 (GDPR) — Article 17. Read on .

Predict Check yourself

A customer asks for complete erasure. You hold their invoices, which tax law requires you to keep for seven years. What is the correct outcome?

  1. Erase what has no retaining ground, keep the invoices under the legal obligation, and tell them which and why.
  2. Erase everything — the right to erasure overrides national retention law.
  3. Refuse the request in full, since part of it cannot be satisfied.
  4. Erase everything after the seven years, and reject the request for now.
Show the answer

Erase what has no retaining ground, keep the invoices under the legal obligation, and tell them which and why.

Erasure is assessed per processing purpose, not per person. A partial refusal must be reasoned and sent within the same deadline.