Data subject right to have personal data deleted in certain circumstances—also called right to be forgotten.
The right to erasure (right to be forgotten) allows data subjects to request deletion of their personal data in certain circumstances—when data is no longer necessary, consent is withdrawn, or processing was unlawful. Organisations must respond within one month. However, erasure isn't absolute—legal obligations, legal claims, and public interest can override the right. Organisations need processes to identify and delete data across all systems when valid requests are received.
Why It Matters
The DSC Perspective:
Erasure requests must be handled properly. Understand when you must comply and when you can legitimately refuse. Ensure you can actually delete data from all systems—including backups over time.