Implementing Right to Erasure Workflow

Overview

The right to erasure under GDPR Article 17 allows data subjects to request the deletion of their personal data. This right is not absolute — it is subject to specific grounds for erasure and a set of exceptions. This skill provides the complete operational procedure for receiving, assessing, executing, and confirming erasure requests.

Legal Foundation

GDPR Article 17 — Right to Erasure ('Right to be Forgotten')

Six Grounds for Erasure Under Art. 17(1)

The data subject has the right to obtain erasure where one of the following grounds applies:

1. Art. 17(1)(a) — Purpose fulfilment: The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
2. Art. 17(1)(b) — Consent withdrawal: The data subject withdraws consent on which the processing is based under Art. 6(1)(a) or Art. 9(2)(a), and there is no other legal ground for the processing.
3. Art. 17(1)(c) — Successful objection: The data subject objects pursuant to Art. 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing under Art. 21(2).
4. Art. 17(1)(d) — Unlawful processing: The personal data have been unlawfully processed.
5. Art. 17(1)(e) — Legal obligation: The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.