If you have a business or manage a company that handles personal data, sooner or later you might receive a request from a customer asking you to delete their information. What should you do in this situation? Are you required to delete the data in all cases? Are there any exceptions? In this article, we will try to answer all these questions so you can comply with the regulations and respond appropriately to these requests.<\/p>\n\n\n\n
The right to erasure according to the GDPR<\/h2>\n\n\n\n
Data erasure is a process aimed at permanently deleting <\/strong>personal data held by a company. The goal is to ensure that personal data<\/strong> is not kept longer than necessary and is handled in accordance with data protection laws.<\/p>\n\n\n\n In Europe, Article 17 of the General Data Protection Regulation (GDPR)<\/a> <\/strong>gives users the right to request the deletion of their personal data whenever certain circumstances are met.<\/p>\n\n\n\n But what exactly is this right? This right allows:<\/p>\n\n\n\n However, while the right to erasure<\/strong> is fundamental, it is not an absolute right, and data cannot always be deleted. There are some situations where companies are not obligated to delete a customer's data, even if requested.<\/p>\n\n\n\n There are several reasons why a company may refuse a data deletion request.<\/p>\n\n\n\n If your company receives a data deletion request, but the data falls under any of these exceptions, it is important to inform the customer clearly and transparently why it is not possible to delete the data at that time.<\/p>\n\n\n\n Your obligation will be to convert that data into blocked data<\/strong> until the retention period ends for one of the aforementioned reasons.<\/p>\n\n\n\n If a customer requests the deletion of their data, the first thing you must do is verify their identity<\/strong>. This is important to prevent unauthorized individuals from requesting the deletion of someone else's information.<\/p>\n\n\n\n By the way, don\u2019t go asking for their ID directly<\/strong>! Your obligation is to verify the identity of the person wishing to exercise a right, but you should not request invasive personal data<\/strong> (such as a photocopy of their ID) when you can verify their identity through simpler means.<\/p>\n\n\n\n Once you've confirmed their identity, you need to review the request and decide if the data can be deleted or if there's a legal reason to keep it<\/strong>. If the request is valid, you must delete it from all systems where it is stored and ensure it is no longer processed in the future.<\/p>\n\n\n\n\n
Do you always have to delete a customer\u2019s data?<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/lawwwing.com\/wp-content\/uploads\/2025\/03\/6c212355-d1e9-4010-817b-863f2102f6c6_16-9-aspect-ratio_default_0.jpg\")
<\/figure>\n\n\n\nSteps to handle a data delation request<\/h2>\n\n\n\n
\n